Reservly Data Deletion Policy

Last updated: October 9, 2026

The short version

• You have the right to ask Reservly to delete the personal information we hold about you.
• The simplest path is in your dashboard: Settings → Subscription → Account & Data → Delete Account. If you do not have a Reservly account (for example, you are an end-user customer of a business that uses Reservly), you can use the no-account form at reservly.io/data-request, or email support@reservly.io with subject line "Data Deletion Request". To have every business on Reservly erase or export your data at once, use Customer Data Erase & Export (GDPR).
• We complete eligible requests within 30 days of receipt.
• Some data is retained for legal, fraud-prevention, or accounting reasons — we explain which categories below and the legal basis for retaining each.

This page describes the policy and procedure. The right itself comes from GDPR Article 17 (right to erasure), CCPA / CPRA § 1798.105 (right to delete), and similar provisions in other applicable privacy laws.

1. Who this page is for

This page applies to anyone whose personal information Reservly processes, including:

• Business owners — the people who subscribe to Reservly and operate booking pages.
• Team members — staff invited to a business owner's Reservly workspace.
• End-user customers — people who book a service, event, or rental through a business's Reservly-hosted booking page.

For end-user customers, two parties may hold your data: the business you booked with (as Controller under GDPR / "Business" under CCPA) and Reservly (as Processor / Service Provider acting on the business's behalf). This page describes Reservly's deletion procedure; the business may have an independent procedure under its own privacy policy. See our Data Processing Agreement for the Controller-Processor split.

2. How to submit a deletion request

Five paths. Pick whichever is easiest.

2.1 Self-service — dashboard (business owners only)

If you have a Reservly account, log in and go to Settings → Subscription → Account & Data → Delete Account. You confirm inside the dialog: type your business name and re-enter your password. Deletion is scheduled the moment you confirm — there is no second confirmation email to wait for. Your public booking page goes offline immediately, and a 30-day grace period begins during which you can cancel the deletion — from the link in the email we send you, or from that same place in Settings. After 30 days, the deletion proceeds on the timeline described in § 4.

Only the business owner can close a Reservly account. If you are a team member and want your own personal details removed, ask the owner to remove you from the workspace, or use the request form at reservly.io/data-request — we handle those by hand.

2.2 Self-service page (end-user customers)

If you are an end-user customer who booked through a Reservly-hosted booking page, you can request deletion directly at reservly.io/{business-slug}/data-deletion (replace {business-slug} with the business's booking-page address — for example, the same address you used to book). Enter the email address you used at booking time and we'll email you a secure confirmation link. The link is valid for 24 hours — following it confirms your request and we act on it straight away. Nothing is recorded until you follow the link, so if yours expires just ask for another one. While a link is still live we will not send a second one for the same request.

If you don't know the business's booking-page address, use the form in § 2.4 or the email path in § 2.3 instead.

2.3 Email

Email support@reservly.io with subject line "Data Deletion Request". Include:

• The email address you used at booking time or to create your account.
• If you are requesting deletion of a specific booking, the booking ID (visible in the confirmation email) or the date and business name.
• If you are requesting deletion as an authorised agent acting on someone else's behalf, attach written permission signed by that person (or an equivalent power-of-attorney instrument).

We confirm receipt within 10 business days and complete eligible requests on the timeline described in § 4.

2.4 Self-service form — anyone, no account needed

Go to reservly.io/data-request, choose "Delete the personal data you hold about me", and give us the email address we would know you by. You do not need an account and you do not need a booking number. We email you a confirmation, check that you are the person the data belongs to, and then act.

2.5 Self-service page — every business at once (end-user customers)

Go to reservly.io/data-rights and enter the email address you booked with. We email you one link, valid for 24 hours; opening it shows which businesses on Reservly hold data for that address. One button emails you everything in one ZIP file (a folder per business); the other asks every listed business to erase it. The erasure runs the moment you press the button, cannot be undone, and reaches every listed business — a business under a legal hold is named on the page and erased when the hold lifts. Each business then sends you its own confirmation.

3. What gets deleted

What happens next depends on who you are and which of the paths above you used.

If you are a business owner closing your account (§ 2.1): after the 30-day grace period, your bookings and all other business data are permanently deleted from Reservly's production database within the deletion window (§ 4), along with your business record. This does not include your login credentials — your email address and hashed password remain in our authentication system after your business data is deleted, so you are not blocked from creating a new Reservly account later. If you also want your login credentials removed, say so explicitly in your request and we will delete them as a separate step.

If you are an end-user customer requesting deletion of your own data (§ 2.2, § 2.3, or § 2.4): your name, email, phone number, any notes or form answers you submitted, and your consent records are replaced with anonymous placeholders across your bookings with the business your request covers, within the deletion window (§ 4). The underlying booking itself — its date, time, service, party size, and price — is retained (not deleted) so the business can keep accurate operational and financial records; it can no longer be linked back to you. A request made through a business's booking page (§ 2.2) covers one business at a time: if you booked with more than one business through Reservly, send one for each, or use the all-businesses page (§ 2.5) once. A request made by email (§ 2.3) or through the form (§ 2.4) is handled by a person — tell us you booked with more than one business and we will cover them together.

In both cases, we also delete your marketing-consent records linked to your email or phone number.

Support correspondence with Reservly is deleted as well. If you are a business owner closing your account, your tickets and our replies are deleted together with your business record — you do not have to ask. If you wrote to us from an address we could not link to an account, tell us that address and we will delete that correspondence by hand.

One record we keep on purpose: if you have ever unsubscribed, bounced, or replied STOP, we keep that suppression record and we do not delete it when you ask for erasure. It holds only the address or number and the fact that you opted out; it is used only to stop sends, never to make one. Deleting it would let us start messaging you again, which is the opposite of what you asked for. This is the same record described in our Privacy Policy § 11.

Backups containing your data are retained for up to 7 days after deletion or anonymisation completes (per § 5.1 below) and are then automatically rotated out.

4. Timeline

For most requests submitted via the self-service or token-link paths, deletion completes within 24 hours of confirmation. The longer windows above are the outer limits required by GDPR Article 12(3) and applicable state laws.

5. What is retained, and why

A small amount of data may be retained after a deletion request. Each retained category has a specific legal basis.

5.1 Encrypted backups

Reservly's production database is backed up daily. Backups containing your data persist for up to 7 days after deletion completes, then are automatically rotated out. Restoring from a backup during this window would not re-create your account — the next backup cycle replaces the older snapshots without your data. Legal basis: GDPR Article 17(3)(b) (compliance with legal obligation — disaster-recovery and security requirements under Article 32) and equivalent state-law provisions.

5.2 De-identified booking records

After your identifiers are overwritten with anonymous placeholders, the booking row itself remains: its date, time, service, party size, and price, so the business keeps accurate operational and financial records. It cannot be linked back to you, and the overwrite is permanent — there is no way to reverse it. We also use these de-identified records to understand how the service is used. Legal basis: GDPR Article 17(3)(b) (legitimate interest in service operation); CCPA / CPRA § 1798.105(d)(7) (debugging and service improvement).

5.3 Audit log and fraud-prevention records

Reservly maintains an internal audit_log of administrative actions (sign-ins, permission changes, account deletions themselves, billing actions, security events). Entries cannot be edited once written, and they hold only operational metadata — a timestamp, who acted, what action, and which record — never your name, email address, phone number, IP address, or booking details. If you ask us to remove your login credentials as well (§ 3), the audit entries tied to that login are removed with them. Legal basis: GDPR Article 17(3)(b) (legitimate interest in fraud prevention and security under Article 32); CCPA / CPRA § 1798.105(d)(2) (detect security incidents, protect against malicious or fraudulent activity).

5.4 Records the business legitimately needs

If you are an end-user customer of a business that uses Reservly, the business may have its own legitimate basis to retain a booking record after you request deletion from Reservly — for example, tax law (typical retention 5–10 years depending on jurisdiction), consumer-rights compliance (for cancellation-window disputes), or an active dispute or chargeback related to your booking. Reservly's deletion procedure is separate from the business's procedure. If a business retains your data after you request deletion from Reservly, you should address that retention with the business directly under the business's own privacy policy. Reservly does not currently operate a separate mechanism to notify the business of your deletion request — anonymising your data in Reservly's systems is itself the action Reservly takes; if you also want the business itself to stop using data it retains independently (for example, in its own records outside Reservly), you will need to contact that business directly. Legal basis: GDPR Article 17(3)(b) and (e) (compliance with legal obligation; establishment, exercise, or defence of legal claims).

5.5 Records Reservly itself must retain

A small set of records related to Reservly's own subscription billing is retained beyond the deletion window because tax and accounting law requires it: the invoice records Paddle returns to us (transaction id, invoice number, amount, tax, currency and billing period) and the record of each Email top-up charged (the month, the pack number, its Paddle transaction reference and whether the charge succeeded). They identify the business by its Paddle identifiers, not a person, an email address or a card; Paddle, as Merchant of Record, holds the invoices themselves. Legal basis: GDPR Article 17(3)(e); CCPA / CPRA § 1798.105(d)(4) (comply with a legal obligation).

5.6 Records under a legal hold

If your records are covered by a legal hold — an active dispute, a regulator's request, or litigation where the law requires the records to be preserved — we will refuse the deletion and tell you so, rather than erase evidence we are obliged to keep. If that happens you can appeal, as described in § 8. Once the hold lifts, your request proceeds. Legal basis: GDPR Article 17(3)(e) (establishment, exercise, or defence of legal claims).

6. Verification

Reservly may need to verify that a deletion request genuinely comes from you (or from someone you have authorised) before we act on it. Typical verification is low-friction: confirming an email on file, or matching a booking to the request.

We will not ask for government-issued ID for a routine deletion request. If a request appears to have been submitted by someone other than the data subject (for example, a request that does not match account-level details), we will reject the request and notify the email on file before taking action.

7. Free of charge — and exceptions

Deletion requests are free of charge.

GDPR Article 12(5) and CCPA / CPRA § 1798.130(c) permit Reservly to charge a reasonable fee, or to refuse to act on a request, where requests are manifestly unfounded or excessive — in particular because of their repetitive character. Reservly's policy is to honour the first request from any data subject without further questions and to apply the unfounded-or-excessive carve-out only against demonstrable abuse (e.g., automated request submission). The carve-out has not been invoked in Reservly's operating history.

8. Appeals

If Reservly denies a deletion request, you may appeal the denial.

• EU / EEA / UK / Switzerland: Lodge a complaint with your supervisory authority (for the UK, the Information Commissioner's Office, ico.org.uk/make-a-complaint).
• US states with a statutory appeal right (including Texas, Colorado, Virginia, Connecticut, and others as state laws evolve): Reply to our denial email with subject line beginning "Appeal" — or, if we refused on screen rather than by email (for example a legal hold under § 5.6), email support@reservly.io with subject line beginning "Appeal". We respond within the time the state law provides, typically 45–60 days.
• Other regions: Contact your jurisdiction's data-protection regulator. Our Privacy Policy § 9 has the regulator contact details.

9. Related rights

This page covers the right to deletion. Other rights — access, correction, portability, restriction, and objection — are described in our Privacy Policy § 9. The opt-out of sale or sharing is on the Do Not Sell or Share page. Reservly's role-and-responsibility split for business-customer data is in our Data Processing Agreement.

10. Contact

Reservly c/o Northwestern Registered Agent Services 30 N Gould St Ste N Sheridan, WY 82801 United States

Email: support@reservly.io Subject line for deletion requests: Data Deletion Request Subject line for authorised-agent requests: Data Deletion — Agent Request Privacy Officer: Stjepan Luburic, Founder — support@reservly.io (subject line Privacy Officer)

This page works together with our Privacy Policy, Terms of Service, Data Processing Agreement, Do Not Sell or Share, and Cookie Policy.