Privacy Policy

Last updated: 11 May 2026 · How MyBookaro handles your personal data.
Operated by Anastasiou Konstantinos — sole proprietorship (ατομική επιχείρηση «ΑΝΑΣΤΑΣΙΟΥ ΚΩΝΣΤΑΝΤΙΝΟΣ»), registered in Greece. Registered seat: Vasileos Georgiou 78, Almyros, Greece · VAT / ΑΦΜ: EL135141174 (ΔΟΥ Nea Ionia Volou) · Email: anastasiou.ks@gmail.com.
Plain-English summary. We collect the data we need to sell you a license, deliver and support the product, run our affiliate program, and meet legal obligations. We do not sell your data. We use Stripe for payments, Twilio for outbound SMS (Pro only), Google for optional Calendar sync (Pro only), and a handful of analytics and email tools listed below. Cookies are explained in the cookie banner. You can request access, correction, deletion, or export of your data at any time by emailing the address in Section 12.

1. Who we are

This Privacy Policy applies to mybookaro.com and the MyBookaro WordPress plugins (Lite and Pro). References to “MyBookaro”, “we”, “us”, or “our” mean Anastasiou Konstantinos (sole proprietorship «ΑΝΑΣΤΑΣΙΟΥ ΚΩΝΣΤΑΝΤΙΝΟΣ»), the operator of mybookaro.com and the data controller for the processing described here. Registered seat: Vasileos Georgiou 78, Almyros, Greece. VAT / ΑΦΜ: EL135141174. Email: anastasiou.ks@gmail.com. We have not appointed a Data Protection Officer, as our processing does not meet the GDPR Article 37 thresholds; data-protection queries go to the email above. References to “you” mean any person who visits the website, installs the plugin, or buys a Pro license.

For questions about this policy or to exercise the rights described below, see Section 12 — Contact.

2. What we collect and why

We collect the minimum data needed for each purpose. Categories and lawful bases:

  • Account & License data (name, email, hashed password, license keys, activated site URLs). Collected when you buy Pro or sign up for the affiliate program. Lawful basis: contract.
  • Billing data (billing name, address, country, VAT number where supplied, last 4 digits of payment card, Stripe customer ID, order history, invoices). Lawful basis: contract + legal obligation (tax records).
  • Support data (ticket subject, body, attachments, screenshots, system status snapshots you choose to send). Lawful basis: legitimate interest in providing the support you requested.
  • Affiliate data (referral link clicks, referred customers’ order totals, your payout method and payout email, tax form data where requested). Lawful basis: contract.
  • Website usage data (IP address, browser user-agent, pages visited, referring URL, approximate location). Lawful basis: legitimate interest in maintaining and improving the website, or consent via the cookie banner where required.
  • Plugin telemetry (anonymous, opt-in only — currently disabled by default in Lite and Pro). If enabled, we receive plugin version, WordPress version, PHP version, and counts of bookings/providers — no booking content. Lawful basis: consent.
  • Communications (emails you send to support, replies to newsletters, messages via the contact form). Lawful basis: legitimate interest in answering you.

3. How long we keep your data

  • Account & License data: while your account is active, plus 7 years after closure for accounting/audit reasons (in line with EU and US tax-record norms).
  • Billing data: 7 years from the date of the transaction.
  • Support tickets: 24 months from last activity, then archived in cold storage for an additional 24 months.
  • Website analytics: 14 months (rolling) for aggregated metrics, 30 days for raw event logs.
  • Affiliate commission records: 7 years (mirrors billing retention).
  • Email subscriptions: until you unsubscribe; logs of consent retained for 3 years after unsubscribe.

We delete data sooner on request unless we are required to retain it for a legal reason (tax, fraud investigation, regulator order).

4. Third-party processors

Where MyBookaro relies on a third party to deliver the service, we use a vendor that publishes its own privacy practices. Current processors:

  • Stripe — customer payment processing and fraud screening for Pro purchases. stripe.com/privacy.
  • PayPal (where used) — payment processing or affiliate Mass Pay. paypal.com/legalhub/privacy-full.
  • Twilio (Pro only, optional) — SMS reminder delivery. twilio.com/legal/privacy.
  • Google (Pro only, optional) — OAuth + Google Calendar sync if you connect an account. policies.google.com/privacy.
  • Our hosting provider — server infrastructure for mybookaro.com. Names available on request to support.
  • Our transactional email provider — license keys, order confirmations, support replies. Names available on request to support.
  • WordPress.org — distribution of Lite. WordPress.org sets its own cookies on its plugin page; we don’t control them.
  • SliceWP (in-database, our affiliate engine) — runs locally on our server; no third party.

We use Data Processing Agreements with every processor that handles EU/UK personal data on our behalf. If you ask, we’ll share the current list and the standard contractual clauses where applicable.

5. Cookies and tracking

The site uses three categories of cookies:

  • Necessary — login, cart, checkout, CSRF protection, affiliate-referral attribution. Set without consent.
  • Functional — language, accepted-cookie-policy state, video-player preferences. Set with consent.
  • Analytics — first-party analytics (currently Microsoft Clarity or Google Analytics 4 — see the cookie banner). Set with consent. We do not run third-party advertising trackers.

The affiliate cookie (`slicewp_ref`) is set when you click a referral link, lasts 60 days, and identifies the affiliate who introduced you. It does not identify you personally to the affiliate — only the affiliate’s payout system sees that they earned a commission.

You can change your cookie choices at any time via the floating cookie-consent badge in the bottom-left of any page.

6. International transfers

We are based in the European Union. Some of our processors (Stripe, Twilio, Google) are headquartered in the United States and process data there. Transfers outside the EU/EEA rely on:

  • The EU-US Data Privacy Framework (Stripe Payments, Google, Microsoft) where the recipient is certified;
  • Standard Contractual Clauses (SCCs) where the recipient is not certified;
  • Your explicit consent for some optional features (e.g. Google Calendar OAuth).

7. Your rights (EU/UK/EEA/Switzerland)

You have the right to:

  • Access the personal data we hold about you;
  • Rectify data that’s wrong or out of date;
  • Erase your data (subject to legal-retention exceptions in Section 3);
  • Restrict processing while a complaint or correction is investigated;
  • Port your data to another provider in machine-readable form;
  • Object to processing based on legitimate interest;
  • Withdraw consent at any time for processing based on consent;
  • Lodge a complaint with your local Data Protection Authority.

Email the address in Section 12 and we will respond within 30 days (extendable to 60 days for complex requests, with notice).

8. Your rights (United States)

If you live in California (CCPA/CPRA), Colorado, Connecticut, Virginia, Utah, or another US state with comprehensive privacy law, you have similar rights to those listed in Section 7, plus the right to opt out of the sale or sharing of personal data. We do not sell or share personal data for cross-context behavioural advertising; the “Do Not Sell or Share My Personal Information” link is provided as a courtesy but takes no extra action because no such sharing occurs.

If you are a “Sensitive Personal Information” category holder under CPRA (health, financial account credentials, precise geolocation), we do not request or process that category. You may still contact us under Section 12 to confirm.

9. Children

MyBookaro is a business tool. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided data, please notify us via Section 12 and we will delete it.

10. Security

We protect personal data with industry-standard controls: TLS 1.2+ for transit, encryption at rest for backups, hashed/salted passwords, principle-of-least-privilege access, regular dependency updates, audit logging on admin actions, and an internal incident-response process.

If a breach affects your personal data, we will notify the relevant DPA within 72 hours and notify you directly without undue delay where the law requires.

11. Changes to this policy

We may revise this policy as our processing changes. The “Last updated” date at the top reflects the current version. Material changes (new processors, new categories of data, expanded retention) will be announced via a notice on this page for at least 14 days before they take effect, and via email to active Pro customers where the change materially affects them.

12. Contact

Questions, requests under Sections 7 or 8, or complaints about how we handle your data — use the contact page or open a support ticket if you are a Pro customer.

You also have the right to lodge a complaint with the supervisory authority in your country of residence. Our lead supervisory authority is the Hellenic Data Protection Authority (HDPA / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 11523 Athens, Greece — www.dpa.gr. EU/EEA residents may also complain to their local DPA on the EDPB members list; in the UK, the Information Commissioner’s Office (ICO).