1. Who we are
ConfirmZen is operated by CONFIRMZEN LTD, a company registered in England and Wales under company number 16442330. Our registered office is 17 Tudor Court, Prestwich, Manchester, England, M25 0EP.
For privacy questions or requests, contact us at info@confirmzen.co.uk.
Depending on the context, ConfirmZen may act as a data controller (for example, for account, billing, application and support information) or as a data processor/service provider for a salon, barber or other business using ConfirmZen to manage its own customer information.
2. What this policy covers
This policy applies to personal data processed through ConfirmZen websites and services, including our public website, application/onboarding flow, booking experiences, owner and staff dashboards, messaging and review tools, support channels and integrations.
Where a salon, barber or other ConfirmZen customer controls the purpose and means of processing its clients’ data, that business remains responsible for its own privacy notices and legal obligations to those clients.
3. Personal data we collect
The categories of information we may process depend on how you use ConfirmZen.
| Category | Examples |
|---|---|
| Business and account data | Business name, owner/staff names, email addresses, phone numbers, service details, opening hours, settings, plan and account identifiers. |
| Booking and customer data | Customer names and contact details, appointment dates/times, services, staff assignments, booking status, notes and communication preferences supplied through the service. |
| Communications data | Email/SMS content, templates, delivery status, replies, review requests, feedback, support messages and campaign activity. |
| Billing data | Subscription, invoice, payment status and transaction references. Payment card details are processed by our payment provider; ConfirmZen does not need to store full payment card numbers. |
| Technical and security data | IP address, browser/device information, timestamps, session/authentication data, logs and security events. |
| Google integration data | Google Business Profile account/location identifiers, business details, reviews, review metadata, replies, connection state and OAuth credentials/tokens needed to provide the connected feature. |
We may also receive information from the business using ConfirmZen, from its authorised staff, from customers interacting with a booking/review flow, from connected providers, and from information you send directly to us.
4. Google Business Profile & Google API data
How ConfirmZen uses Google data
If a business chooses to connect its Google Business Profile, ConfirmZen may request access to Google data needed to provide the review-management feature. This can include Business Profile accounts and locations, review content and metadata, business replies, and OAuth access/refresh tokens.
We use Google-derived data only to provide or improve user-facing ConfirmZen features that the connected business expects, such as:
- connecting and identifying the business’s authorised Google Business Profile location;
- displaying and synchronising Google reviews within the ConfirmZen Reviews experience;
- showing review status and relevant review activity;
- allowing an authorised user to draft, publish or manage a business reply where Google permits it;
- maintaining the authorised connection and diagnosing sync/connection errors; and
- providing user-requested assistance around review replies or wording where that feature is enabled and permitted.
Google OAuth credentials
OAuth tokens are used server-side to maintain the connection you authorise. We do not ask you to share your Google password with ConfirmZen. Access can be revoked through the relevant Google account permissions and, where available, through ConfirmZen connection settings.
Limited Use
Our handling of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
We do not sell Google user data, use it for advertising profiles, or use it for unrelated purposes. Google-derived data is not used to train a general-purpose AI model. If a user deliberately invokes an AI-assisted feature that processes review text, processing is limited to producing the requested user-facing result and is subject to our applicable provider safeguards and Google API policy.
Disconnecting Google
Disconnecting the integration stops future API access once the relevant authorization is revoked. We may retain limited records where reasonably necessary for security, audit, dispute resolution or legal compliance, but we do not retain Google OAuth access merely to continue using the integration after authorization has been withdrawn.
5. How we use personal data
We may process personal data to:
- provide, configure and maintain ConfirmZen services;
- create and secure accounts and sessions;
- process bookings, reminders, confirmations and service communications;
- provide Email/SMS messaging, review, referral and other features included in the customer’s plan;
- provide customer support and respond to requests;
- process subscriptions and payments;
- prevent abuse, fraud, unauthorised access and security incidents;
- monitor reliability, troubleshoot errors and improve the service;
- comply with legal, regulatory, accounting and tax obligations; and
- send lawful marketing about ConfirmZen where permitted and subject to applicable opt-out rights.
We do not use personal data for a materially different purpose without an appropriate legal basis and, where required, additional notice or consent.
6. Lawful bases
Where ConfirmZen acts as controller under UK data protection law, we rely on one or more lawful bases depending on the activity:
- Contract: processing needed to provide the service you have requested or to take steps before entering into a contract.
- Legitimate interests: operating, securing, supporting and improving ConfirmZen, protecting our business and users, and appropriate B2B communications, where those interests are not overridden by individuals’ rights.
- Consent: where we specifically ask for consent, including certain marketing or connected-account permissions.
- Legal obligation: where processing is necessary to meet legal, tax, accounting or regulatory requirements.
Where ConfirmZen acts only as a processor for a customer business, we process personal data on that customer’s documented instructions and under the relevant contractual arrangements.
8. International transfers
Some service providers may process information outside the United Kingdom. Where UK data protection law requires safeguards for an international transfer, we use an appropriate transfer mechanism or rely on another lawful basis for the transfer, together with supplementary measures where appropriate.
9. How long we keep data
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing the service, maintaining security/audit records, resolving disputes and meeting legal, accounting or tax requirements.
Retention varies by data type. Active account and operational data is generally retained while the service relationship continues. After closure, disconnection or a valid deletion request, data is deleted or anonymised within a reasonable period unless we need to retain specified information for legal, security, fraud-prevention, contractual or dispute-resolution reasons.
OAuth credentials are retained only while needed to support an authorised connection or another legitimate security/audit requirement. Revoking authorization prevents us from continuing to use those credentials for future Google API access.
10. Security
We use technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure or loss. These may include encrypted network connections, restricted access, authentication/session controls, secrets management, logging, monitoring and provider security controls.
No online service can guarantee absolute security. Businesses using ConfirmZen are also responsible for protecting their own login credentials, devices and authorised-user access.
11. Email, SMS & marketing
ConfirmZen supports operational communications and, on eligible plans, customer engagement features using Email and SMS. Businesses using those features are responsible for ensuring they have a valid legal basis and comply with applicable direct-marketing and electronic-communications rules, including opt-out requirements.
Where ConfirmZen sends marketing about our own services, we do so in accordance with applicable UK privacy and electronic-communications law. You can opt out of marketing communications at any time using the method provided in the message or by contacting us.
Service, security, billing and transactional messages may still be sent where they are necessary to provide or administer the service.
12. Your rights
Depending on the circumstances and applicable law, you may have rights to:
- be informed about how your personal data is used;
- access personal data we hold about you;
- correct inaccurate or incomplete data;
- request deletion of personal data;
- restrict or object to certain processing;
- receive certain data in a portable format;
- withdraw consent where processing relies on consent; and
- raise a complaint with the UK Information Commissioner’s Office (ICO).
If your data is controlled by a salon, barber or other ConfirmZen customer, you may wish to contact that business first. We will assist our customers with valid data-subject requests where required.
14. Children
ConfirmZen is a business service and is not directed at children. Business customers should not use the platform to collect children’s personal data unless they have a lawful basis, appropriate safeguards and any required parent/guardian permissions.
15. Changes to this policy
We may update this policy as ConfirmZen, applicable law or connected services change. We will update the “Last updated” date and, where a change is material, provide additional notice where appropriate. We will update this policy before introducing a materially new use of Google user data.
16. Contact & complaints
CONFIRMZEN LTD
17 Tudor Court, Prestwich, Manchester, England, M25 0EP
Company number: 16442330
Email: info@confirmzen.co.uk
If you are unhappy with how we handle personal data, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office.