Online reservations
Timastra Bookings: Privacy
Updated
Read or download the October 4, 2026 legal documents. The dated archive preserves this release; your order or acceptance record identifies the documents that apply to you.
Scope
This privacy information is specific to Timastra Bookings, which Timastra LLC provides and is responsible for. The website and account privacy policy separately covers visits to timastra.com, central sign-in, hosted purchase information and correspondence with Timastra LLC.
Who controls your data
For workspace data that a customer uploads or connects, the customer is the controller and Timastra LLC processes that data on the customer's instructions. Timastra LLC is responsible for the account, billing and support information it needs to run the service. Our data processing agreement, which forms part of the service agreement, and our sub-processor list describe how we process that data; email support@timastra.com for a countersigned copy.
Information the product handles
- Customer names, emails, phone numbers and account links
- Services, staff, appointment times, prices, booking status and no-show history
- Booking notes, custom-field answers, waitlists and review content
- Notification history, account security records, subscription events and product-use events
Purpose
Provide availability, reservations, staff scheduling, customer communications, billing administration and operational reporting.
Providers, permissions and sharing
Bookings supports subscription payments through Paddle and booking notifications by email through Resend. Online payments from customers, such as deposits or cancellation fees, are not currently offered. Service logs are archived to encrypted storage in Cloudflare R2 and deleted after 90 days. Push availability depends on the selected deployment and plan.
Timastra Bookings runs on a server Timastra rents from netcup in Singapore, behind Cloudflare. Service email is sent through Resend from its Tokyo region, subscriptions are billed through Paddle, and encrypted backups are stored in Cloudflare R2. The sub-processor list names each provider, its purpose and location. Optional connections are identified before use.
Retention and deletion
Core booking records and audit evidence may remain after customer details are removed. Notifications, account information and archived service logs have separate retention needs, and backup copies follow separate schedules, documented holds and the expiry stated in the deletion response. Before uploading workspace data, request the applicable processing and retention schedule. It must identify the export or return window when service ends, the live-data removal date, the expiry of each backup, recovery and operator copy, and any retained category's purpose, authority and review or expiry date. A backup rotation or subscription cancellation alone does not establish those deadlines. The customer chooses return or deletion at the end of the service, subject to documented legal retention obligations; recovery must reconcile completed deletion requests before records are used again.
Removing a business's customer record is separate from deleting the central Timastra sign-in account, run by Timastra at auth.timastra.com, which may be used with other businesses and Timastra products. The service anonymizes the customer record and removes associated personal content, while the sign-in account remains until you ask for it to be deleted. State which records you want reviewed. Upcoming bookings or messages already being sent may need to be resolved first.
Hosted data is backed up daily to encrypted storage. The standard managed rotation selects 14 daily, 4 weekly and 3 monthly copies. Protected release snapshots, legacy backups, provider recovery history and operator copies have separate schedules; rotation alone is not a guaranteed expiry date. Your deletion response identifies affected copies, documented holds and expected expiry. Recovery must reconcile completed deletion requests before reopening access.
Your requests
For access, correction, deletion or questions about processing, email support@timastra.com. Identify the relevant organization if applicable. We answer within one month, extendable where the law allows. Available rights and exceptions depend on the circumstances and applicable law; see the legal bases, international transfers and your rights sections of the website privacy policy.