Belcome Privacy Policy
Version 2026-10-20
This policy explains what Design Master Solutions LLC ("we", "us" or "our"), the company that makes Belcome, does with personal information in Belcome: the website at www.belcome.app, the Belcome Pro app and the booking pages at belcome.app.
Two kinds of information
- Information about businesses and their team. When a salon, spa or studio signs up, we collect the owner's and team members' names, emails, phone numbers, sign-in details and the business's details. For this information we decide how it is used.
- Information about the businesses' clients. When someone books with a business, the business collects that client's name, contact details, appointments and notes through Belcome. That information belongs to the business. We process it only on the business's behalf and following its instructions. To ask about it, contact the business you booked with.
What we collect
- Account details: name, email, phone, password (stored only as a one-way hash) and two-step verification settings.
- Business details: name, address, hours, services, prices and team.
- Booking details entered by clients or the business: name, email, mobile phone, appointment times, the client's choice about text messages, and notes.
- Technical details: device and browser type, the time of each request and security logs. Our error reports remove names, emails and phone numbers before they leave our servers.
- Website: the details you send through the early access form, kept to contact you about Belcome.
How we use it
To run the Service: show the calendar, take bookings, send confirmations and reminders, keep accounts secure, give support, prevent abuse, bill subscriptions and meet legal duties. We do not sell personal information, we do not share it for cross-context behavioral advertising, and the website runs no advertising pixels.
Text messages
Design Master Solutions LLC is the sender of the booking alerts that business owners and team members turn on in Belcome Pro (Account, Booking alerts): they enter their mobile number and tick a consent box, unchecked by default, and we text them about new, changed and cancelled bookings at their business. A client of a business gets appointment texts only after opting in at booking. Texts never name the client or the booked service. Reply STOP to any message to stop, or HELP for help. Full terms: www.belcome.app/sms-terms.
Mobile information and SMS opt-in consent are never shared with third parties or affiliates for marketing or promotional purposes, and are never shared with any third party for any other purpose. SMS opt-in data and consent remain with Design Master Solutions LLC, the original consent recipient, and are never shared with or sold to any third party.
Who helps us
We never sell, rent or trade personal information. Every category below excludes text messaging opt-in data and consent: that information is never shared with any third party. We share data only with providers that run the Service, under contracts that limit what they can do with the information:
- Amazon Web Services: hosting, database, email and text message delivery for the Service.
- Stripe: payments and subscription billing.
- Cloudflare: the www.belcome.app website and its early access form.
- Sentry: error reports, with personal details removed before sending.
- Google: sign-in with a Google account, calendar sync when a business user turns it on, Firebase Cloud Messaging for app notifications, and Google Analytics on www.belcome.app only after a visitor allows optional analytics. The website measurement covers public page visits, sign-up link clicks and, for visitors who allowed it, the fact that an account was created and how (email, Google or Apple); it does not include information entered in the registration form or Belcome booking and health information.
- Apple: optional Sign in with Apple and delivery of notifications to Apple devices. Social sign-in may provide a name, email (including an Apple relay email) and a provider account identifier.
- ClickSend: delivery of the booking alert texts to business users who turned them on.
- WhatsApp Business Platform, by Meta: delivery of WhatsApp appointment messages, only where a business turns them on.
- The full list of the providers that process clients' information for businesses, with their addresses, is at www.belcome.app/subprocessors.
Apps a business connects. A business can connect other apps to its Belcome account (for example Microsoft Outlook, QuickBooks Online, Xero, Mailchimp, Klaviyo, Zapier or Make). When it does, we send that app only what it needs, because the business asked us to, and this stops when the business disconnects it. For med spas and other health businesses, apps that would receive client details stay off.
We may disclose information when the law requires it, to protect people's safety, or as part of a sale of our business, with notice to you.
Google user data
When a business user signs in with Google, we receive their name, email address and profile picture to create and secure their account. When a staff member connects Google Calendar, we read the busy times of their calendar to avoid double bookings, and we create, update and delete the events of their own Belcome appointments; for health businesses those events say only "Busy". We do not use Google user data for advertising, we do not sell it, we do not use it to train artificial intelligence models, and people at Belcome do not read it except with the user's permission, for security, or when the law requires it. Disconnecting Google Calendar in the app, or removing Belcome at myaccount.google.com/permissions, stops access, and we then delete the stored Google tokens.
Belcome's use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Recognition on later bookings
After a public booking, Belcome stores your name and contact details in that browser to prefill later bookings. The platform also keeps a contact profile separate from each business's client records, containing first and last name, email, mobile number, language and verification status. After you confirm a code sent to your contact, this profile can prefill your details on other businesses' Belcome booking pages. It does not contain appointment history, clinical notes, forms, payment cards or addresses. “Not you? Clear” removes remembered details and recognition from that browser; it does not cancel appointments or delete records held by businesses. Requests about the contact profile may be sent to Belcome's privacy contact.
Notifications in Belcome Pro
The mobile apps use technical app and device identifiers for their functions, including Firebase Cloud Messaging and Apple's notification service. When booking alerts are permitted on the device, Belcome associates a notification token and platform with the signed-in business user. Alerts carry generic text and internal booking and business references, without client names or booked services. Permissions can be changed in device settings; signing out requests removal of the registered token.
How long we keep it
Business accounts: while the account is active and 30 days after it closes, then deleted, except what the law requires us to keep. Client information: as the business decides, and deleted with the business account. Security logs: up to 12 months. Backups are overwritten on their normal schedule.
Security
Information is encrypted in transit and at rest. Access inside Belcome is limited by role, and changes to client files leave an audit trail that can only be added to. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.
Your choices and rights
Depending on where you live, you may have the right to know, access, correct or delete your personal information, and not to be treated differently for using these rights. Business users can update most details in the app. To make a request, write to info@designmastersolutions.com. If you are a client of a business, contact that business first; we will help it answer you.
Regional information
This section adds what the law of your region requires. It applies to the information Belcome handles as a controller: business accounts and their team members' sign-in details, the website, and the optional contact profile used to prefill bookings. If you are a client of a salon, spa or studio, that business is the controller of your booking information and Belcome processes it on its behalf under our Data Processing Agreement; please contact the business first, and we will help it answer you.
Where your information is stored
Belcome stores information in the United States, with Amazon Web Services in the us-east-1 region (Northern Virginia). Our service providers listed in "Who helps us" also process information in the United States. We protect transfers out of your country as described for your region below. Information stored in the United States may be accessible to United States courts and authorities under United States law.
European Union and European Economic Area
Who is responsible. Design Master Solutions LLC, info@designmastersolutions.com, is the controller. We are not established in the European Union. We will appoint a representative under Article 27 of the GDPR, and publish its name and contact details here, before we serve the first health business (such as a med spa, wellness or skincare business) established in the European Union or the European Economic Area; you will then be able to contact the representative instead of us on any matter about your information.
Data protection officer. We have not appointed a data protection officer under Article 37 of the GDPR. Write to info@designmastersolutions.com on any data protection matter.
Why we use your information, and the legal basis
| Information | Purpose | Legal basis (GDPR Article 6(1)) |
|---|---|---|
| Account, business and team sign-in details | To create and run the account and provide the Service | (b) contract |
| Subscription billing and invoices | To bill and to keep tax and accounting records | (b) contract and (c) legal obligation |
| Security logs, device and request data | To keep the Service secure and prevent abuse | (f) legitimate interests: security of the Service and of our users |
| Support conversations | To answer you | (b) contract or (f) legitimate interests |
| Service emails about the account and important changes | To tell you what you need to know about the Service | (b) contract |
| Product news to business users | To tell business users about Belcome features | (f) legitimate interests, with an unsubscribe link in every email; or (a) consent where the law requires it |
| Contact profile that prefills bookings | To recognise you on other Belcome booking pages after you confirm a code | (a) consent, which you can withdraw with "Not you? Clear" or by writing to us |
| Website early access form | To contact you about Belcome | (a) consent |
| Optional analytics on public pages | To measure visits, clicks on sign-up links and completed sign-ups | (a) consent; you can withdraw it in Cookie settings |
Giving account details is necessary to use the Service; without them we cannot create the account. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
Transfers. We transfer your information to the United States under the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914). You can ask us for a copy at info@designmastersolutions.com.
Your rights. You can ask to access, correct or delete your information, to restrict or object to its use (including at any time to processing based on legitimate interests and to direct marketing), and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting earlier use. We answer within one month. You can also complain to the data protection authority of the country where you live or work or where you think the law was broken (in Ireland, the Data Protection Commission, www.dataprotection.ie; in Portugal, the CNPD, www.cnpd.pt; in Spain, the AEPD, www.aepd.es).
How long we keep it. As described in "How long we keep it" above.
United Kingdom
Everything in the European Union section applies, with these changes. The law is the UK GDPR and the Data Protection Act 2018. We will appoint a representative under Article 27 of the UK GDPR, and publish its name and contact details here, before we serve the first health business established in the United Kingdom. We transfer your information to the United States under the European Commission standard contractual clauses with the International Data Transfer Addendum issued by the Information Commissioner. You can complain to us first and we will acknowledge your complaint within 30 days, and you can complain to the Information Commissioner's Office, www.ico.org.uk.
Brazil
The law is the Lei Geral de Proteção de Dados (Law 13.709/2018, "LGPD").
- Controller and contact. Design Master Solutions LLC, info@designmastersolutions.com. Our person in charge of data protection ("encarregado") is Alan de Bortolo, info@designmastersolutions.com.
- Legal bases (LGPD Article 7). Performance of the contract (V) for the account and the Service; legal or regulatory obligation (II) for billing records; legitimate interest (IX) for security and product news to business users; consent (I) for the contact profile, the website form and optional website analytics.
- International transfer. Your information goes to the United States. For our own account data, the transfer is necessary to perform the contract (LGPD Article 33, IX). For a Brazilian business's client data, Belcome is the business's processor ("operador") and the transfer is covered by the ANPD standard contractual clauses (Resolution CD/ANPD No. 19/2024) in our Data Processing Agreement.
- Your rights (LGPD Article 18). Confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or unlawful data, portability, information about whom we share it with and about the option not to consent, deletion of data processed on consent, withdrawal of consent and objection. Write to info@designmastersolutions.com. You may petition the Autoridade Nacional de Proteção de Dados (ANPD), www.gov.br/anpd.
Canada
The law is the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, substantially similar provincial law. Belcome is not offered in Québec at this time.
- Accountability. Our privacy officer is Alan de Bortolo, info@designmastersolutions.com.
- Consent and purposes. We use your information for the purposes in "How we use it" and with your consent, which may be implied for the operation of the Service; you can withdraw it, subject to legal and contractual limits.
- Processing outside Canada. Your information is processed in the United States by us and our service providers and may be accessible to courts, law enforcement and national security authorities there. Our contracts require providers to protect it.
- Access and correction. You can ask to see and correct your information; we answer within 30 days. You can complain to the Office of the Privacy Commissioner of Canada, www.priv.gc.ca.
Australia
We follow the Australian Privacy Principles in the Privacy Act 1988.
- Overseas disclosure (APP 8). We are likely to disclose personal information to recipients in the United States (our own systems and the service providers listed above).
- Access and correction (APP 12 and 13). Write to info@designmastersolutions.com; we answer within 30 days.
- Complaints. Write to us first; if you are not satisfied with our answer within 30 days, you can complain to the Office of the Australian Information Commissioner, www.oaic.gov.au.
- Data breaches. We follow the Notifiable Data Breaches scheme.
- Automated decisions. We do not use computer programs to make decisions that could significantly affect your rights or interests.
New Zealand
The law is the Privacy Act 2020 and its Information Privacy Principles.
- Overseas disclosure (IPP 12). Your information is stored and processed in the United States by us and our service providers, under contracts that require comparable safeguards.
- Access and correction (IPP 6 and 7). Write to info@designmastersolutions.com; we answer within 20 working days.
- Complaints and breaches. You can complain to the Office of the Privacy Commissioner, www.privacy.org.nz. We notify serious privacy breaches as the Act requires.
Cookies and similar technologies
The Belcome website uses necessary storage for security and bot protection with Cloudflare Turnstile. It also uses Cloudflare Web Analytics to measure traffic without optional analytics cookies. Google Analytics is an optional service on www.belcome.app: it loads only after you choose “Allow analytics” in the cookie notice. It measures visits to public pages, clicks on links to sign up and, when you then create an account, that a sign-up happened and its method (email, Google or Apple). It does not receive registration form values, booking details or health information. You can reject analytics or change your choice at any time using “Cookie settings” in the footer. The choice is saved in your browser. The Belcome-controlled booking pages do not load this website's Google Analytics tag. A business may add its own Google Analytics or Meta Pixel tag to its booking page; that business is responsible for it. For businesses in the European Union, the European Economic Area, the United Kingdom, Switzerland and Brazil, those tags load only after the visitor agrees on the booking page, and the visitor can say no.
Children
The Service is not directed to children under 13, and we do not knowingly collect their information.
Changes
We publish each new version of this policy with a new date and tell account owners about important changes.
Contact
Design Master Solutions LLC, info@designmastersolutions.com.