Privacy Policy — bookaLEAP B.V.

Effective Date: 01.07.2023 Last Updated: 01.09.2026 Version: 3.2

1. Introduction

At bookaLEAP B.V. (“bookaLEAP”, “we”, “us”, or “our”), we value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect your information when you use our platform, apps, services, and website.

We comply with the General Data Protection Regulation (GDPR), the Dutch GDPR Implementation Act (UAVG), and other applicable privacy laws.

2. Who We Are

bookaLEAP B.V. Jan Pieter Heijestraat 107H, 1053 GN, Amsterdam, Netherlands KvK: 89959973 — VAT: NL86516506B01 info@bookaleap.com

We act as a Data Controller for personal data collected through our platform and services.

3. What Personal Data We Collect

A. Account and Profile Information

Phone number (verified by SMS code — this is how you sign in; we do not use passwords).
Email address (verified by email code where provided).
Full name, country, city, and time zone.
Profile photo, cover photo, the free-text “about” description, and any social-media links (Instagram, TikTok, X, Facebook, or a website address) you add to your profile. You can add, change, or remove these at any time from your edit-profile screen.
Date of birth and gender (optional, client profiles).
Your sign-in identities: if you use Google or Apple sign-in, we store the provider and the account identifier the provider gives us, linked to your phone-verified account.
Your acceptance of the Terms and Conditions (version and time) and your marketing preference.
Referral code and, where applicable, who referred you.
Last login time.

B. Partner and Business Verification Data

If you register as a professional (Partner) or a Business, we additionally collect the data we need to verify you and pay you:

Legal name, business registration number and registering authority, registered address.
For Partners: whether you are registered for VAT (BTW) and, where you are, your VAT (BTW) number. We do not collect a separate tax number from Partners.
For Businesses: the organisation’s tax number, and whether it is registered for VAT (BTW). The tax number is required before we can pay a Business out, because we issue a self-billed supplier invoice that must name a tax-registered counterparty.
Bank details (IBAN, BIC) — stored encrypted.
Certificates or qualification documents you upload.
Verification (KYC) status and history.
An optional public map location (latitude/longitude) that you explicitly choose to show on your public profile. Your registered address itself is never published or geocoded.

C. Booking and Transaction Data

Bookings, purchases (sessions, class packs / punch cards, combo offers, event tickets), payment status and amounts, promo-code usage, and remaining punch-card credits.
Invoices and credit notes relating to your purchases.
Payment card and bank details are collected directly by Stripe, our payment processor, and never touch bookaLEAP’s servers. We only receive confirmation of payment and a transaction reference.

D. Event Registration Answers

Event organizers may ask registration questions (for example about experience level or information relevant to participating safely). Your free-text answers are stored with your registration and shared with the organizer of that event. If you choose to include health-related information in an answer, see Section 5.

E. Content You Publish

Feed posts, comments to the extent the platform supports them, and images you upload (profile photos, post images) are stored and displayed as you direct.

F. Communications and Forms

If you contact us through our public contact or event-hosting forms, we collect the name, email address, and message you submit.

G. Technical Data

IP address — used for security and abuse prevention (rate limiting). For some security counters we deliberately store only a one-way hash of the IP or email, not the raw value.
Device type, operating system, app version, and server logs.
Address and map-location lookups: when you type an address into our location search, the query text is sent to our geocoding provider (Section 7) to return suggestions. When you place or drag a pin on a map to choose a location, the coordinates of that point are sent to the same provider to look up the address there.

H. Calendar Data (Partners)

If you connect your Google Calendar for availability sync, we store your Google account email and the access tokens Google issues — encrypted — and use them only for the sync you configured.

To work out when you are unavailable, we read the events in your selected calendar within the window we are checking. From each event we use only whether it is cancelled, whether it is marked “free” or “busy”, whether you declined it, and its start and end times. All we derive from this is a list of busy periods — the start and end times of blocks in which you are unavailable — which is held briefly in memory (up to one minute) and never written to our database. Event titles, descriptions, locations, attachments, and the identities of other attendees are never stored by us.

We also write events into that calendar for the bookings you receive, and update or remove those events when a booking changes or is cancelled. We only ever modify or delete events that bookaLEAP created; events you or anyone else created are never changed.

That is how calendar sync works on the bookaLEAP platform. Our earlier ILU app, which is still running while we migrate people across, syncs calendars differently: it connects through Nylas (section 7), and that integration receives more than busy times — event titles, times, attendees and updates — because it keeps whole events in step across platforms rather than only reading availability. If you connected a calendar in the ILU app, that is the integration you authorised. Disconnecting it there ends it; connecting on the new platform gives you the narrower access described above.

How we handle this data is further restricted by the Limited Use commitments in section 7.

I. Push Notification Registration (Mobile Apps)

If you allow push notifications in our mobile app, we store the notification token your device’s operating system issues, which platform it is (Android or iOS), and when we last saw it. The token identifies a device rather than you by name, but we keep it against your account so we can reach your devices, so we treat it as your personal data.

We keep at most the ten most recently used devices per account; registering an eleventh removes the least recently used one. If you never allow push notifications, we never hold a token for you and this section does not apply to you.

J. Reviews You Write

If you review a Partner who coached you or a Business whose venue hosted you, we store the rating you gave, any text you wrote, which booking earned you the right to write it, and when. The review is published: your first name and profile picture appear next to it on that Partner’s or Business’s public profile, which anyone can read without signing in. Your full name, phone number and email address are not shown.

A review is also personal data of the person it is about. Do not include anyone else’s personal data in the text.

If someone reports your review and we decide to hide it, we keep the report, our decision and the reason for it, and we send that reason to you.

K. Feedback You Send Us

If you send us feedback about the app, we store what you wrote, which account sent it, when, and — so that a bug report carries the build it came from — the platform and app version you sent it from. Feedback is a private channel to our team: unlike a review it is never published and no other user can see it.

Write what you like about the app itself, but please do not include other people’s personal data, and do not use it to raise a complaint about a specific person — that is what the report route on a review, and info@bookaleap.com, are for.

4. How We Use Your Data

Purpose	Legal Basis
To provide and manage user accounts (including phone/email verification and SSO sign-in)	Contractual necessity
To publish the reviews you write, and to show ratings on Partner and Business profiles	Contractual necessity
To read, triage and act on feedback you send us about the app	Legitimate interest
To assess reports about a review and record the decision and its reason	Legal obligation (Digital Services Act)
To book, schedule, and deliver sessions, class packs, and events	Contractual necessity
To process payments via Stripe and issue invoices	Contractual necessity / Legal obligation
To verify Partners and Businesses before they can offer services or receive payouts	Contractual necessity / Legal obligation
To pay out Partners and Businesses and issue self-billing invoices	Contractual necessity / Legal obligation
To share your registration answers with the organizer of an event you registered for	Contractual necessity
To personalize services where you volunteer health-related information	Explicit consent
To notify you about your own bookings, events, purchases, invoices, payouts, and account — in the app, by email, and, where you have enabled them, by push notification	Contractual necessity / Legitimate interest
To text you when a session or event you are booked on is cancelled shortly before it starts	Legitimate interest
To send marketing communications	Consent (opt-in)
To secure the platform (rate limiting, abuse and fraud prevention, audit logging)	Legitimate interest
To detect and diagnose faults — server errors, web-page failures and mobile app crashes — so we can fix them	Legitimate interest
To show professionals and events near a location you search for	Legitimate interest
To comply with legal obligations (tax, accounting, platform reporting)	Legal obligation

We do not require health information and do not systematically collect it. Event registration questions or your communication with a professional may invite information relevant to safe participation (for example injuries or conditions); providing it is optional and constitutes your explicit consent to process it for that booking. You can decline to share it, and you may ask us or the organizer to delete it at any time via info@bookaleap.com.

6. Marketing Communications

We only send marketing communications if you opt in — via the checkbox during registration or your profile settings. You can withdraw at any time via your profile settings or by contacting info@bookaleap.com.

Push notifications and SMS are not marketing. We use them only to tell you about your own bookings, events, purchases, invoices, payouts, and account — the same notices you already see in the app. You control push notifications through your device’s notification settings, and turning them off there stops them without affecting your in-app or email notifications.

We only share your data with third parties where necessary to operate the platform:

Stripe — payment processing (payment amounts, currency, and transaction references; your card/bank details go to Stripe directly).
Supabase — our database, authentication (SMS and email verification codes, Google/Apple sign-in), and file storage (uploaded images, invoice documents) provider.
Google — if you sign in with Google or connect Google Calendar sync.
Nylas — calendar synchronisation for our earlier ILU app only, which is still running while we migrate people onto the bookaLEAP platform. Nylas receives Google Calendar data for users who connected a calendar in that app — event titles, times, attendees and updates — and uses it only to keep those calendars in step. It is not used by the bookaLEAP platform, whose calendar sync talks to Google directly and reads only busy periods (section 3H). This entry goes when the ILU app is retired.
Google (Firebase Cloud Messaging) — delivery of push notifications to your mobile devices. Firebase receives your device notification token and the content of the notification, which can include your name, the title of a service or event, and when it starts.
Apple — if you sign in with Apple. On iPhones and iPads, push notifications also pass through Apple’s Push Notification service on their way to your device, carrying the same content described above.
Twilio — sending SMS, used only to tell you that a session or event you are booked on starting within the next 24 hours has been cancelled.
Resend — delivery of transactional emails (for example contact-form notifications).
Photon (komoot) — geocoding: the address text you type into our location search, and the coordinates of a map pin you place, so we can return the matching addresses. Nothing else about you is sent with either lookup.
Cloudflare — network security and content delivery in front of our services.
Render and Vercel — hosting of our backend and web applications.
Sentry — error and crash monitoring. When something goes wrong — our servers fail to complete a request, a page in our web app breaks, or one of our mobile apps crashes — Sentry receives a technical report of the failure. That report contains the error message, the technical stack trace showing where in our code it happened, and context about the environment: the app or browser version, the operating system, the device model on mobile, the address of the page you were on, and our server’s hostname. In every app that reports to Sentry we have switched off the setting that would attach your identity, your IP address, or the contents of your request, and we have asked Sentry not to store the IP address its servers see when your browser or phone sends a report. Our admin panel, which only our own staff use, reports nothing to Sentry at all.

What can still reach Sentry is whatever our own error messages happen to say. Those messages are written for engineers, and some of them name the record that failed — usually an internal reference number for an account or a booking, which means nothing outside our systems. Two cases used to go further, and we would rather say so than quietly drop them: a failed SMS or email carried the number or address we were trying to reach, and a failure from our authentication provider could carry that provider’s own response. Both have since been removed — the recipient is masked before it is written down, and the provider’s response is kept at a level of detail that is never sent on to Sentry.
Professionals and event organizers — when you book with them, they receive your name, the booking details, and your registration answers. For a one-to-one session you book with a professional, they also receive your email address and phone number, so they can reach you about that session. Event organizers do not receive your contact details.
Authorities — where we are legally required to report (for example tax reporting on platform sellers under DAC7, which applies to Partners and Businesses, not Clients).

All processors act under data processing agreements and only process your data per our instructions. We never sell or rent your personal data.

What other users can see

Parts of your profile are visible to other people on the platform, so that everyone can recognise who they are training, booking, or attending an event with:

Your client profile — your name, your profile photo, your cover photo, your free-text “about” description, and any social-media links you have added are visible to any signed-in user who opens your profile, for example a professional or organizer reviewing the participant list for their own event. There is no requirement that you have booked with them first.
What your profile never shows — your phone number, email address, date of birth, gender, LEAP-coin balance, payment details, or your booking history. None of these appear on your profile, whoever opens it. Some of this data can still reach a professional or organizer when you book with them — the sharing list above says exactly what, and when.
Partner and Business profiles are public-facing by design, since they exist to advertise offers and events.

Because the “about” description is free text that other users can read, write only what you are comfortable sharing — in particular, you do not need to put health information there (see section 5). You can edit or clear it at any time in your profile settings, and the same applies to your social-media links: adding them is optional, and clearing a field removes that link from your profile.

Google Calendar data — Limited Use

bookaLEAP’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Concretely, that means:

We use the data we receive from your Google Calendar only to provide and improve the availability-sync feature you switched on — the feature that reads when you are busy and puts your bookaLEAP bookings into your calendar.
We do not transfer or sell that data to anyone, except as necessary to run that feature, to comply with applicable law, or as part of a merger or acquisition after giving you notice.
We do not use that data for advertising of any kind, including personalised, retargeted, or interest-based advertising.
We do not use that data for creditworthiness or lending purposes.
We do not allow humans to read that data, unless you have given us your explicit consent to read specific events, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymised so that it can no longer be linked to you.

You can disconnect your Google Calendar at any time from your partner settings, or revoke bookaLEAP’s access from your Google Account permissions page. Disconnecting stops all further reading and writing; see section 10 for what happens to the data we already hold.

8. International Data Transfers

Some of our processors may process data outside the EU/EEA. In such cases we ensure adequate safeguards, such as Standard Contractual Clauses (SCCs) or transfers to countries with an EU adequacy decision.

Our Sentry organization is hosted in Sentry’s European region, so the error and crash reports described in section 7 stay in the EU and no transfer mechanism is required for them.

9. How We Protect Your Data

HTTPS encryption for all traffic.
Bank details (IBAN) and calendar tokens stored encrypted (AES-256).
Phone-code and email-code sign-in — no passwords to leak.
On mobile, session tokens are stored in the device’s secure storage (Android Keystore / iOS Keychain).
Role-based admin access; every admin action affecting your data is recorded in an audit log, including access to decrypted bank details.
Security counters (login throttling) store hashed identifiers rather than raw values.

10. Data Retention

Account and profile data: for as long as your account exists. When you ask us to delete your account it is closed immediately — you are signed out and can no longer sign in — and we erase your personal data within one month of the request. Erasure means the data is overwritten in place, not that your records are removed: the entries below survive it, and for Partners and Businesses so does the DAC7 information described further down.
Transaction data and invoices: 7 years, as required by Dutch tax law (art. 35a Wet OB).
Marketing preference: until you withdraw it.
Event registration answers: for the life of the registration and any legally required period.
Push notification tokens: for as long as the device stays registered. We delete a token when you sign out on that device, when the device stops being reachable, when it falls outside the ten most recently used devices on your account, or when your account is deleted.
Reviews you write: published until you delete them or we hide them. Deleting your account anonymises your reviews rather than removing them — the rating and text stay so that a Partner’s or Business’s rating history is not rewritten by unrelated account closures, but nothing identifying you remains attached. This is an exception to the erasure described at the top of this section, and rests on our legitimate interest in an honest, stable public rating.
Reports about a review, and the moderation decision and reason: kept for as long as needed to handle complaints about that decision and to meet our Digital Services Act obligations.
Feedback you send us about the app: kept while we work on what you raised and for as long as it stays useful to the product, then deleted. It is not published at any point. Deleting your account does not automatically remove feedback you have already sent; ask us at info@bookaleap.com if you want it removed as well.
Google Calendar connection (section 3H): the access and refresh tokens are held only while the connection is active. When you disconnect, we revoke the refresh token with Google and erase both tokens immediately; a record that the connection existed and was disconnected — your Google account email, the calendar identifier, and the relevant dates — is kept as part of your account data and erased with it. Busy periods read from your calendar are never stored, so there is nothing further to delete.
Security logs and hashed rate-limiting data: short rolling windows.
Error and crash reports (section 7): held by Sentry for the retention period of our plan, then deleted automatically. Because a report is a snapshot of a moment a fault happened, deleting your account does not reach back into reports already sent — see the list in section 11.

You have the right to access, correct, delete, restrict, and port your data, to object to processing (including marketing), and to withdraw consent at any time.

To delete your account, use Delete my account on your profile in the app or on the web. You confirm by typing a short word, after which your account closes immediately and we erase your personal data within one month. We email you a confirmation when the request is received and again once the erasure is complete. Before you confirm, the app tells you if you still have upcoming bookings or a pending payout — we will not refuse the request because of them, but deleting does not cancel or settle them.

To get a copy of your data, use Download my data on your profile in the app or on the web. We prepare a file containing your personal data and notify you when it is ready; the download link stays available for seven days, after which the file is deleted and you can request another. The file includes a machine-readable copy you can take to another service, and a readable summary explaining why we hold each kind of data and how long we keep it. Where a booking involves someone else, it shows their display name and the booking details, never their contact details. You can request an export twice a day.

To exercise any other right — correction, restriction, objection, or withdrawing consent — contact us at info@bookaleap.com. You can also use that address for deletion or access if you prefer. We respond to any request within one month. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

What deleting your account does not erase

Some data must survive an erasure request, either because the law requires us to keep it or because another legal obligation applies to it:

Invoices and payment records are kept for 7 years (art. 35a Wet OB, Dutch tax law). They stay linked to a pseudonymous account identifier, not to your name or contact details.
Partners and Businesses only — DAC7 reporting. Where we have reported you as a platform seller to the tax authorities (see section 8), we must keep the identifying information behind that report. In practice this means your name is retained after erasure, together with the seller-identification details collected for that report: for Partners, legal name, business registration number and authority, registered address, and VAT (BTW) number; for Businesses, the organisation’s tax number. Where a Partner account still holds a tax number collected before we stopped asking for one, that value is retained on the same basis. Your email address, phone number, bank account number (IBAN), and all public profile content — description, public address and map location, date of birth and gender — are erased. This obligation does not apply to Clients, whose data is erased in full.
Error and crash reports already sent to Sentry (section 7). A report is a snapshot of the moment something broke, so it is not linked to your account and cannot be looked up by it. Those reports expire on their own retention schedule rather than on your erasure request. If you would like us to look for and remove a specific one, write to info@bookaleap.com.

If you are a Partner or Business, please read this before you delete: the retention above is not something we can waive, and it is the one part of your data that a deletion request will not remove.

12. Cookies & Tracking

We use essential storage only. Our web apps keep you signed in using browser local storage (session tokens), not tracking cookies. Stripe may set cookies strictly for payment security and fraud prevention. Our error-monitoring provider (Sentry, section 7) sets no cookies and is not used to profile you: it only reports technical failures, and only when one happens. We use no analytics, advertising, or marketing cookies or SDKs, and we do not track your activity across our website or apps for any other purpose.

Category	Purpose	Consent required?
Essential	Keeping you signed in, enabling core booking functionality, processing payments securely (including Stripe fraud-prevention cookies), remembering interface preferences	No — required for the platform to function

If this changes — for example if we introduce analytics — we will update this section, request consent where required by law, and give you a way to accept or reject non-essential cookies.

13. Data Carried Over From ILU

bookaLEAP B.V. operated a booking platform under the name ILU, and that app is still running while we move everyone across. bookaLEAP is the same company, with the same registration (KvK 89959973) and the same responsibility as Data Controller for that data. It has not been sold, shared with, or transferred to anyone else.

While both are live, the two apps handle calendars differently — see section 3H and the Nylas entry in section 7. Everything else in this policy applies to both.

If you had an ILU account, we have moved your records onto the bookaLEAP platform so that your history stays with you. What we carried over:

Your name, email address and phone number.
Your booking and event history, and any purchases or session credits still owed to you.
Your LEAP Coin balance, where you had one.
Your profile picture and, for Partners, your venue photos and description.

What we deliberately did not carry over:

Your bank account number (IBAN). No payment details were migrated at all. Partners set up payouts again from scratch through Stripe.
Your marketing preference. We could not verify what you originally agreed to, so we have set marketing email to off for everyone who came across. If you want to hear from us, turn it on in your profile settings — nothing is sent until you do.
Your date of birth and gender. These were not migrated.

Your data is now held on the infrastructure and by the processors described in section 7, which are not the same as ILU’s. The purposes we use it for, described in section 4, have not changed.

Everything else in this policy applies to your migrated data exactly as it does to data you give us directly — including your rights in section 11 and the retention periods in section 10. If you would rather we did not keep your ILU history at all, use Delete my account, or contact us at info@bookaleap.com.

14. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or app alert. Continued use of the platform implies acceptance of the updated policy.

15. Contact Us

bookaLEAP B.V. Jan Pieter Heijestraat 107H, 1053 GN, Amsterdam, Netherlands info@bookaleap.com