Security Policy

1. Our Commitment to Security

At Booktroz, security is an important consideration in providing our white-label appointment booking SaaS platform. We recognize the importance of protecting platform accounts, business information, customer records, appointment details, and other information processed through our services.

We aim to apply appropriate technical and organizational measures to protect information against unauthorized access, accidental loss, misuse, alteration, and disclosure. The specific measures applied depend on the services, platform configuration, and applicable contractual requirements.

2. Information Protection

Booktroz may process information necessary to provide appointment booking and business management functionality. Depending on the platform configuration, this may include account information, customer contact details, professional profiles, appointment records, scheduling information, and subscription-related data.

We seek to protect information through appropriate access restrictions, secure configuration, data handling practices, and other safeguards suitable for the services provided. Customers should avoid entering unnecessary sensitive information into the platform.

3. Secure Website Communications

Booktroz aims to protect information transmitted between users and the platform through secure communication protocols where implemented and supported by the relevant service. Customers should access the platform using the official website and avoid submitting account credentials through untrusted websites or communication channels.

No internet transmission or online service can be guaranteed to be completely secure in every circumstance.

4. Account Security and Access Control

Access to Booktroz accounts and administrative functionality should be limited to authorized users. Account owners are responsible for managing access permissions and ensuring that only appropriate personnel can access business and customer information.

Users should maintain strong, unique passwords, protect their login credentials, sign out of shared devices, and promptly report suspected unauthorized account access. Where additional authentication or access control features are available, users should configure them appropriately.

5. Appointment and Customer Data

Appointment booking platforms may handle personal information such as customer names, contact details, booking dates, appointment times, and professional information. Customers using Booktroz are responsible for ensuring that their collection and use of personal information complies with applicable privacy and data protection laws.

Businesses operating healthcare, legal, financial, or other professional services should assess whether the information they collect requires additional safeguards or regulatory obligations.

Booktroz should not be assumed to be certified for any particular healthcare, financial, or other regulated data standard unless that certification or compliance status has been expressly confirmed.

6. Secure Platform Operations

Booktroz aims to maintain appropriate operational practices for the security and reliability of its platform. Depending on the applicable deployment and service configuration, these practices may include secure application configuration, software maintenance, vulnerability remediation, restricted administrative access, and monitoring for relevant operational issues.

Security controls and operational responsibilities may differ depending on the hosting environment, subscription arrangement, and third-party services involved.

7. Passwords and Authentication

Users are responsible for protecting their account credentials and ensuring that passwords are not shared with unauthorized individuals. Business administrators should promptly remove access for employees, contractors, or other users who no longer require it.

If a user suspects that their account has been compromised, they should change their password where possible and contact Booktroz support promptly.

8. Third-Party Services and Integrations

Depending on the features enabled and services purchased, Booktroz may interact with third-party providers such as payment gateways, messaging platforms, hosting providers, email services, and other external systems.

These providers may process information under their own terms, privacy policies, and security practices. Booktroz does not control every aspect of the security of third-party systems, and customers should review the relevant provider's documentation before enabling an integration.

9. Payment Information

Where payment functionality or payment gateway integrations are available, payment processing may involve external payment service providers.

The information collected and processed depends on the payment method and integration used. Customers should review the applicable payment provider's privacy and security documentation to understand how payment information is handled.

Customers should not submit full payment card details, passwords, or other sensitive authentication credentials through ordinary support messages or unsecured channels.

10. Data Retention and Deletion

Information may be retained for as long as necessary to provide the applicable services, maintain business records, meet contractual obligations, resolve disputes, and comply with legal requirements.

Customers should review their own data retention obligations and ensure that personal information is retained only as permitted by applicable law.

Requests concerning account closure, information access, or data deletion may be submitted through our contact channels. Requests will be assessed according to the applicable service terms, technical capabilities, and legal obligations.

11. Security Incident Reporting

If you suspect unauthorized access, a compromised account, exposure of customer information, or another security issue involving Booktroz, please notify our team promptly.

When reporting a concern, include a description of the issue, the approximate time it occurred, and any relevant non-sensitive details that can help us investigate. Do not send passwords, authentication codes, or other confidential credentials in your report.

We will review reported issues and take appropriate investigative or corrective steps based on the circumstances. Notifications will be provided where required by applicable law or contractual obligations.

12. Customer Responsibilities

Customers and businesses using Booktroz are responsible for securing their own devices, managing account access, protecting login credentials, and configuring their business operations appropriately.

Customers should also ensure that information submitted through the platform is appropriate for the service, that they have a lawful basis for processing personal information, and that their users are informed about relevant privacy practices.

Businesses remain responsible for their own legal and regulatory obligations, including obligations related to customer records, appointment information, and professional confidentiality.

13. Security Limitations

Although appropriate safeguards may be implemented, no software platform, internet-connected service, or data transmission method can guarantee absolute security. Security risks may arise from unauthorized access, software vulnerabilities, user actions, third-party failures, or circumstances beyond reasonable control.

Booktroz does not guarantee that unauthorized access, data loss, service interruptions, or security incidents can never occur.

14. Policy Updates

Booktroz may update this Security Policy to reflect changes to its services, operational practices, technology, or applicable legal requirements. The latest version will be published on this page with the applicable update date.

Where required, customers will be notified of material changes in accordance with applicable law or contractual obligations.

15. Contact Information

If you have questions about this Security Policy or wish to report a security concern, please contact the Booktroz team through our Contact Us page.

Please include sufficient details to help us understand your concern, but do not include passwords, authentication codes, or other sensitive credentials.