Privacy Policy

1. Who we are

GettingNext ("GettingNext", "we", "us") operates gettingnext.com, an online appointment booking platform that lets service businesses ("Businesses") publish a booking page and manage appointments, and lets their clients ("Customers") book those appointments.

Questions or requests about this policy: support@gettingnext.com.

2. Our two roles

When you are a Business with a GettingNext account, we act as the data controller of your account information (we decide how and why it is processed).

When you are a Customerbooking an appointment with a Business, that Business is the data controller of your booking information, and GettingNext processes it on the Business's behalf as a data processor(in the language of Jamaica's Data Protection Act, 2020). If you want to access, correct, or delete booking data, you may contact the Business directly or contact us and we will assist.

3. What we collect

From Businesses:

• Account details — name, email address, and sign-in credentials, handled by our authentication provider (we never see or store your password).
• Business profile — business name, type, logo, services, prices, availability, timezone, and booking-page settings.
• Optional notification details — a phone number if you enable WhatsApp/SMS alerts.

From Customers:

• Booking details — your name, email address, the service, date, and time you book, and any optional cancellation reason you provide.
• A copy of your name and email may be stored in your own browser (localStorage) purely to pre-fill the form next time; it never leaves your device for that purpose.

From all visitors:

• Usage analytics — pages visited, interactions, approximate location (from IP), device and browser type, collected via PostHog. Session replays mask everything you type.
• Technical logs — IP addresses and request metadata, used for security (e.g. rate limiting) and troubleshooting.

4. Why we use it

• To provide the service — creating and managing appointments, sending booking confirmations, reminders, cancellation and reschedule notices (performance of a contract).
• To secure the service — preventing abuse, fraud, and double bookings (legitimate interests).
• To improve the service — understanding how the product is used through analytics (legitimate interests).
• To communicate — service announcements and support responses. We do not send marketing emails to Customers, and we do not sell personal data to anyone.

5. Who we share it with

We share personal data only with the service providers that make the platform work, each bound by their own data protection commitments:

• Supabase — database hosting (appointment and account records).
• Clerk — sign-in and account authentication for Businesses.
• Resend — transactional email delivery (confirmations, reminders).
• Vercel — application hosting.
• PostHog — product analytics and session replay (inputs masked).
• Stripe — payment processing, if and when a Business enables payments. Card details go directly to Stripe; we never see or store card numbers.
• Twilio — WhatsApp/SMS notification delivery, if a Business enables it.

We may also disclose information where required by law or to protect the rights, safety, or property of GettingNext, our users, or the public.

6. International transfers

Our service providers store data primarily on cloud infrastructure in the United States. Wherever your data is processed, it receives the protections described in this policy.

7. How long we keep it

Booking records are retained for up to 18 months after the appointment date, after which we anonymize them: names and email addresses are removed and only non-identifying statistics (e.g. number of bookings per month) are kept. Business account data is kept for as long as the account is active and deleted within a reasonable period after account closure, except where the law requires longer retention.

8. Your rights (Jamaica Data Protection Act, 2020)

If you are in Jamaica, the DPA gives you rights including:

• to access the personal data held about you;
• to have inaccurate data corrected, blocked, erased, or destroyed;
• to prevent processing likely to cause you damage or distress;
• to prevent your data being used for direct marketing;
• to not be subject to purely automated decisions that significantly affect you.

To exercise any of these, email support@gettingnext.com. If you are a Customer, we may refer your request to the Business you booked with (the data controller) and will assist them in responding. You also have the right to complain to Jamaica's Office of the Information Commissioner (oic.gov.jm).

9. Visitors from the United States and elsewhere

Regardless of where you live, we honor requests to access, correct, or delete your personal data, subject to legal retention requirements. Contact us at the address above and we will respond within a reasonable time.

10. Security

Data is encrypted in transit, access to production systems is restricted, and we scan our codebase for accidentally committed credentials. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify affected users and regulators as required by law.

11. Children

GettingNext is not directed at children. Business accounts require you to be at least 18. We do not knowingly collect personal data from children under 13; if you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced on this page with an updated date, and — for significant changes affecting Businesses — by email.