Privacy

Last updated · October 3, 2026

Turnexify is operated by AxionLabs. This notice explains what we collect, why we hold it, and who else touches it. It is written to be read, not to be survived.

Two kinds of person, and it matters which you are

A business owner or a member of their team is our customer. We decide what we collect about them and we answer to them directly.

A client of that business is not our customer. Their name, their contact details, their appointments, and the notes kept about them belong to the business that entered them. That business decides what to collect and how long to keep it. We hold those records on its behalf and act on its instructions.

If you are a client of a business that uses Turnexify and you want to see, correct, or delete what is held about you, ask that business. They can see and correct it from their dashboard, and archive it; to erase it for good, they write to us. If you cannot reach them, write to us and we will help you find the right contact.

What we collect

Account details: your name, your email address, and a password that we never store in a readable form.
Business details: the business name, its web address, its location, opening hours, services, prices, and booking policy.
Client records entered by the business: name, contact details, appointment history, and any notes or tags the business chooses to keep.
Bookings: what was booked, with whom, when, at what price, and whether it was kept, moved, or cancelled.
Payment records: amounts, dates, status, and a reference to the transaction at our payment processor. We never see or store full card numbers.
Content you upload: photographs of your work, your logo, and the words on your public page.
Messages we send on your behalf: confirmations, reminders, and whether they were delivered or failed.
Device details for notifications: if you switch on push notifications, the subscription your browser gives us.
Instagram: for a business that connects its Instagram account, what is described under “Instagram”.
Technical records: sign-in times, IP address, browser, and error logs. We keep these to run the service and to investigate abuse.
Messages you send us: if you use the contact form on this site, the name, email address, phone number, type of business, and message you type. We keep them for twelve months so a follow-up has its history, then delete them automatically, or sooner if you ask. Sending the form lets us contact you by email or phone about your message and about Turnexify, including news and offers, until you ask us to stop.

Advertising, and your choices

To see which pages are read and where sign-ups stall, this site and the dashboard use Vercel Web Analytics. It sets no cookies, keeps no id that follows you from one day or one site to the next, and reports only totals: page views, the country, the browser, and steps such as “started sign-up”. Page addresses are trimmed of anything that could point to a record. A business’s own booking site does not load it.

We advertise Turnexify. To measure those ads and show them to people who visited, this marketing site uses advertising pixels from Meta, Google and TikTok. A pixel tells that company that your browser opened a page here and, if you sign up or write to us, that you did; the company can connect this to an account you hold with it and uses it under its own terms. We send no name, email address, phone number or message with it. The dashboard, where businesses work, loads no advertising pixel.

A business on a paid Turnexify plan may add its own Meta, Google or TikTok pixel to its booking site. That business chooses to, is responsible for it, and must tell its clients. Its pixels see the pages a visitor opens and that a booking, an inquiry or a purchase was made. We never send them a client’s name, email address, phone number, notes or payment details, and we do not use any business’s client records to advertise.

Under California law this is “sharing” personal information for cross-context behavioural advertising. You can say no: use “Your privacy choices” at the foot of the page, or turn on Global Privacy Control in your browser, which we honour automatically. Either way, no advertising pixel loads in that browser on that site. Each site keeps its own choice, so set it on each one you visit.

We do not sell personal information for money, and we do not build profiles of you for anyone else.

Why we hold it

To run the service you signed up for: showing your page, taking bookings, sending confirmations, and recording payments.
To keep the service working: backups, error investigation, and preventing abuse.
To bill you for the plan you chose, and to answer you when you write to us.
To meet legal obligations, including keeping records of transactions for the period the law requires.
To advertise Turnexify, as described under “Advertising, and your choices”, unless you opt out.

Cookies

We set as few as the product can work with, and none of our own are for advertising. The advertising pixels described above set their own, unless you opt out.

A session cookie that keeps you signed in. Without it the dashboard cannot know who you are.
Preference cookies that remember your theme, your language, and whether the sidebar is open. They exist so the page renders correctly on the first paint instead of flickering after it loads.
Short-lived cookies that secure connecting Google Calendar, Instagram or Square, and small ones that remember a prompt you dismissed.
On a business’s booking site: a language cookie, and a random visitor id kept in your browser so the business can count visits. It names no one, and the visits are deleted after 180 days.
On this marketing site: none of our own. When our advertising pixels load, Meta, Google and TikTok set their own cookies to recognise your browser.
On a business’s booking site that added its own pixels: the same companies’ cookies, unless you opt out.
A cookie that remembers “Do not sell or share my personal information” when you choose it, for one year, on the site where you chose it.

Who else touches it

We use a small number of companies to run the service. Each one only receives what it needs to do its job, and none of them may use it for their own purposes.

Supabase — the database, sign-in, and file storage. Hosted in the United States.
Stripe — card payments and payouts to your bank, for businesses that connect Stripe. Stripe also bills every business for its Turnexify plan. Stripe handles card details directly; they do not pass through us.
Square — card payments and payouts to your bank, for businesses that connect Square. Square handles card details directly, including in the card form on a business’s booking link; they do not pass through us.
Resend — sending the confirmation and reminder emails.
Twilio — sending text messages, only to people who agreed to receive them.
Vercel — hosting the applications, issuing certificates for custom domains, and cookieless page statistics for this site and the dashboard.
Google: only for a business that connects Google Calendar. Its appointments, including the client’s name and phone, are copied to that calendar.
Apple: only for a team member who connects their iCloud calendar. Their appointments, including the client’s name and phone, are copied to that calendar.
Meta, for Instagram: only for a business that connects its Instagram account. Messages and comments sent to that account reach us through Instagram, and the business’s answers go back the same way, as described under “Instagram”.
Meta, for WhatsApp: only for clients who choose WhatsApp when they book. Their number and their appointment messages go through WhatsApp, as described under “WhatsApp”.
OpenStreetMap and OpenFreeMap: turning a business’s address into a map, and drawing it on its site.
Your browser’s push service: carrying booking alerts to staff who turned them on.
Meta, Google and TikTok, for advertising, and the one exception to the rule above: their pixels on this site, and on booking sites whose business added them, send them the visits and conversions described under “Advertising, and your choices”, and they use that under their own terms. Not if you opt out.

Text messages

Turnexify sends text messages only to people who ask for them, by ticking the text message box on our contact form. Those texts are replies to your request, sign-in codes, and notifications about your Turnexify account. How often depends on what you ask for. Message and data rates may apply.

Reply STOP to any of our texts to stop them, and HELP for help. You can also write to hello@turnexify.com.

A business on Turnexify can also text its own clients, from numbers registered to that business, and only after the client ticks a box on that business’s booking site: one box for appointment texts, and a separate, optional box for offers. Each text starts with the business’s name. Reply STOP to the number that texted you to stop every text from that business, START to receive them again, and HELP for help. Each business’s terms are on its booking site at /sms-terms.

We keep a record of the number you gave, the words you agreed to, and when and where you agreed or stopped.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text message opt-in data and consent are not shared with any third party; the only exception is the text message provider and the carriers that deliver the messages.

Instagram

A business on a paid Turnexify plan can connect its Instagram professional account, so that answers it writes go out to people who message it or comment on its posts. Connecting gives us, through Instagram’s official API, the account’s id, username and profile picture, and an access key. The key is encrypted and kept apart from everything else. We use it only to receive the messages and comments sent to that account and to send the business’s answers.

When someone messages that business on Instagram, comments on its posts, or tags it in a story, Instagram sends us the message or comment, the post it is on, and the id Instagram gives that person for this business. We use the words only to pick which of the business’s answers to send. No AI reads them. The words are deleted as soon as the message is answered, and the record of the message 30 days later. To show the business its numbers, we keep a record of each answer sent and each link tapped, without the words of any message.

If that person taps Instagram’s button to share their email address or phone number, the business receives it and that person becomes one of its clients, with the name on their Instagram profile. From then on it is a client record that belongs to the business, like any other.

We do not use Instagram data for advertising, we do not sell it, and we share it with no one but Meta, which runs Instagram. A business can disconnect at any time from its Instagram screen. Disconnecting, removing Turnexify in Instagram’s settings, or asking Meta to delete your data deletes the connected account, its key, the messages waiting to be answered and the list of people who wrote, at once.

When you book with a business on Turnexify, you can choose to get your appointment messages on WhatsApp by ticking a box under the phone field. Then the business, through Turnexify, sends your confirmation, reminders, changes, receipts and waitlist openings to that number on WhatsApp, from Turnexify’s WhatsApp number or from the business’s own. Each message names the business. Email still brings your confirmation and receipts, and comes instead whenever WhatsApp cannot deliver.

The messages have buttons to confirm, cancel or change your visit. When you tap one or write to us, WhatsApp sends us your number, your WhatsApp profile name and what you tapped or wrote. We use it only to do what you asked and to answer you. No AI reads your words. They are deleted as soon as the message is answered, and the record of the message 30 days later.

Reply STOP to stop WhatsApp messages (on Turnexify’s number, from every business that wrote to you there), and START to receive them again. We keep a record of the number you gave, the words you agreed to, and when you agreed or stopped.

We do not use WhatsApp data for advertising, we do not sell it, and we share it with no one but Meta, which runs WhatsApp and charges for each message sent.

Where it is held

Our systems run in the United States. If you or your clients are elsewhere, using Turnexify means the information described here is transferred to and stored in the United States.

How long we keep it

Business and client records stay for as long as the business keeps its account, and are deleted when the business asks us to delete them or closes the account.

Records of completed transactions are kept longer where tax and accounting law requires it.

Technical logs are kept for a short period and then discarded.

Your rights

You can ask us to show you what we hold about you, correct it, delete it, or hand it to you in a portable form. We will not charge you and we will not treat you differently for asking.

Most of it you can do yourself from the dashboard without writing to anyone. If you want an account deleted entirely, write to us and we will confirm before we act, because deletion is not reversible.

Security

Every business is isolated from every other at the database level, not merely in the application, so one business cannot read another’s records even if the application has a bug. Passwords are hashed. Connections are encrypted in transit. Card numbers never reach our systems.

No system is perfect. If something goes wrong that affects you, we will tell you.

Children

Turnexify is a tool for running a business and is not intended for anyone under 16. We do not knowingly collect information from children. If you believe a child has given us information, write to us and we will remove it.

Changes

When this notice changes, the date at the top changes with it. If a change materially affects what we do with your information, we will tell account holders by email before it takes effect.

Contact

Write to hello@turnexify.com. Turnexify is a product of AxionLabs. Turnexify is built for businesses in the United States.