Privacy Policy

Last updated: July 2026

This Privacy Policy explains how HoldKit ("HoldKit," "we," "us") collects, uses, shares, and protects information when you visit myholdkit.com (our "Site") and use the HoldKit booking platform at app.myholdkit.com (the "Platform").

Information we collect

• Account information — your name, business name, email address, and login credentials when you create an account.
• Billing information — your subscription plan and payment details. Card numbers are entered directly with our payment processor (Stripe) and are not stored on HoldKit's servers.
• Booking data — reservations, availability settings, inventory, customer records, and form responses that you or your customers create.
• Messages you send us — if you contact us or submit the setup-request form, we receive your name, email, and message.
• Usage and device information — technical data such as browser type, device, pages visited, referring page, and approximate location, used to keep the service secure and to improve it.
• Cookies — see "Cookies and analytics" below.

Cookies and analytics

Our Platform uses a strictly necessary cookie to keep you signed in. Our Site uses Google Analytics (Google Analytics 4) to understand, in aggregate, how visitors use our pages. Google Analytics sets cookies and collects information such as your device, pages viewed, and a truncated IP address. We do not use this data to identify you individually.

You can opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on or by blocking cookies in your browser. For how Google processes this data, see the Google Privacy Policy.

Some browsers send a "Do Not Track" (DNT) signal; because there is no common industry standard for responding to DNT, our Site does not currently respond to it, but you can limit tracking using the cookie and analytics controls described above.

Google Fonts

Our Site loads typefaces from Google Fonts to display our branding. When your browser requests these fonts, Google receives your IP address in order to deliver them. Google states that it does not use Google Fonts requests to identify or profile users.

Region detection

HoldKit is currently offered to businesses in the United States. To enforce this, our Site and Platform check your approximate country from your IP address using a third-party geolocation service (GeoJS). We use it only to determine availability and do not store the result beyond your current session.

Signing in with Google

If you choose to sign in or create your account with Google, we receive basic profile information from your Google Account — your name, email address, profile picture, and a Google account identifier. We use this only to create and secure your HoldKit account. We never receive your Google password.

Google Calendar

If you connect Google Calendar (an optional feature), you grant HoldKit permission to view and manage events on the calendar you select, so that your HoldKit bookings appear on and stay in sync with your Google Calendar. We store an encrypted access token to provide this feature and use that access only to create, update, and remove your booking events. You can disconnect Google Calendar at any time from Settings, which revokes our access.

HoldKit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to develop, improve, or train generalized AI/ML models, and we do not let humans read it except with your consent, for security, to comply with law, or as part of operations you have asked us to perform.

Payments

Subscription payments to HoldKit are processed by Stripe. When you use the Payments & Deposits module to collect money from your own customers, those payments run through your connected Stripe account and settle directly to you — HoldKit never holds your funds. Stripe processes card data under its own privacy policy.

How we use information

• To provide and operate the Platform, your booking pages, and connected features.
• To process subscriptions and send service messages (confirmations, reminders, account notices).
• To respond to support and setup requests.
• To measure and improve our Site and Platform.
• To maintain security, prevent abuse, and comply with legal obligations.

Your customers' data

When your customers book through HoldKit, the information they submit belongs to your business, and you are the controller of that data. We process it on your behalf to deliver the service. We do not sell it or use it for advertising. You are responsible for obtaining any consent your business is legally required to collect from your own customers.

Service providers we share data with

We do not sell personal information. We share data only with the providers needed to run HoldKit, each under their own terms:

• Stripe — subscription and customer-payment processing.
• Google — Analytics and Google Fonts on our Site, and Sign-In and Calendar (only if you use those features).
• Email and SMS delivery — to send confirmations, reminders, and notices.
• Hosting — to operate the Platform and store your data.

We may also disclose information where required by law or to protect our rights and users.

International transfers

Some of our providers (including Google and Stripe) are based in the United States, so your information may be processed there. Where required, such transfers rely on appropriate safeguards, such as Standard Contractual Clauses.

Data retention and your rights

We retain account and booking data while your account is active, and for a limited period afterward as needed for legal, security, and backup purposes. Depending on where you live, you may have rights to access, correct, export, or delete your information, to object to or restrict certain processing, and to opt out of analytics. To exercise any of these, email hello@myholdkit.com.

California privacy rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you additional rights. In the last 12 months we have collected the following categories of personal information, as described above: identifiers (such as name, email address, and IP address), commercial information (such as your subscription plan and billing history), and internet or other electronic network activity (such as pages visited and device information). We do not sell or share personal information as defined by the CPRA, and we have not done so in the preceding 12 months.

You have the right to know the personal information we collect about you and how we use it, the right to request that we delete it, and the right to correct inaccurate personal information. We will never discriminate against you for exercising these rights. To submit a request, email hello@myholdkit.com with the subject "Privacy request" — we will verify your identity (for example, by confirming you control the email address on the account) and respond within the time required by law. If we deny your request, you may appeal by replying to our decision, and we will review your appeal and respond with the outcome and the reasons for it.

Security

We use industry-standard measures — encrypted connections (HTTPS), encryption of sensitive tokens at rest, access controls, and audit logging — to protect the information stored in HoldKit. No system is perfectly secure, but we work to protect your data and to notify you of material incidents where required.

Children

HoldKit is a tool for businesses and is not directed to children. We do not knowingly collect personal information from children under 13 (or the minimum age in your country).

Changes to this policy

We may update this Privacy Policy from time to time. If a change is material, we will update the "Last updated" date and notify account owners by email.

Contact

Questions about this policy, or want to exercise a privacy right? Email hello@myholdkit.com.

HoldKit is operated by MakeAndUpdate LLC, 1442 Pottstown Pike, Unit #3197, West Chester, PA 19380.