Privacy & GDPR.

Privacy by Design

VoxelBooking is built for European freelancers deploying for European businesses serving European customers. Privacy controls are part of the booking flow, including consent collection, data access, export, deletion requests, and retention tools.

Consent Collection

The booking form includes a privacy consent checkbox. Link to your privacy policy directly from the booking page. Consent is time recorded and stored with the booking record.

Customer Data Rights

Every customer has a self-service privacy page at /book/{slug}/privacy/{customer_id}. Customers reach it from the manage-booking page:

• From the manage-booking page — a "Your data & privacy" link with a shield icon appears below the action buttons

Data Access (GDPR Art. 15)

The privacy page shows the customer's stored personal information (name, email, phone), full booking history with statuses, and consent records with timestamps and the exact text they agreed to.

Data Export (GDPR Art. 20)

Customers can export all their held data as a JSON file with one click.

Deletion Request (GDPR Art. 17)

Customers can request deletion of their personal data. The request is confirmed via a two-step UI (initial click → warning → confirm). On submission:

1. A deletion_requested_at timestamp is set on the customer record
2. The request appears in the operator's Admin → Deletion Queue
3. The operator reviews and approves or ignores the request
4. On approval, VoxelBooking anonymizes the customer — name, email, phone, and notes are permanently removed. Booking records are preserved in anonymized form for business analytics

The two-step process (customer requests, operator approves) prevents unauthorized deletions while providing right-to-erasure request tooling.

Data Retention

Configure automatic data retention periods per business:

• Set how long personal data is kept after the last booking
• Expired records are automatically anonymized by the cron job
• Booking statistics are preserved without personal identifiers

Cron Job

VoxelBooking uses a single cron route for processing:

• Email reminders
• Data retention enforcement
• Cleanup tasks

Configure a cron job to hit /cron/run?token={cron_secret} at regular intervals.