Privacy Policy

Last updated: July 20, 2026.

Fillsy ("we," "us") provides a cancellation-recovery service for Square Appointments merchants ("merchants," "you," if you're a merchant). This policy explains what personal information we collect, why, and how it's handled — both for merchants who connect their Square account, and for merchants' clients who may receive a text message through the service.

Information we collect

From merchants, via Square OAuth: business and location details, appointment/booking data, and catalog pricing needed to detect cancellations, compute the Revenue Opportunity Report, and generate offers. We request the minimum OAuth scopes needed for whichever mode you connect in (read-only report mode, or full install).

From a merchant's clients, via the merchant's Square account: name, phone number, and booking history, used only to determine who may be offered a cancelled slot and to send that offer by SMS.

Directly from you, on certain public pages: if you claim a publicly-listed discounted slot, we collect the name and phone number you enter to complete the booking (passed to Square to create or match your customer record with that merchant). If you join a merchant's priority-list waitlist for openings, we collect the phone number you provide. If you use the free revenue-estimate calculator, it works anonymously by default — nothing identifying is collected unless you choose to leave a phone number and business name for us to follow up.

How we use it

• Detect cancelled appointment slots and determine whether a real dollar recovery opportunity exists.
• Identify which clients may lawfully be offered a slot, and send that one SMS offer.
• Process a claimed offer: rebook the slot on the merchant's Square calendar and, where a discount applies, process payment through Square.
• Generate the Revenue Opportunity Report and merchant-facing dashboard.
• Operate, maintain, and improve the service — including using aggregated or de-identified data (never data that identifies a specific client) for analysis.

We do not use this data to build advertising profiles, and we do not sell personal information.

SMS messaging & consent

We only send SMS offers where we have a lawful basis to do so — either an existing business relationship with the merchant (e.g. a recent booking or purchase) or express consent captured through the claim flow. This follows Canada's CASL and, for US numbers, the TCPA. Every message identifies the merchant and explains how to stop receiving messages. Reply STOP at any time and you will not receive another message from that merchant through this service — we honor opt-outs immediately and permanently, and the record of that request is never used for anything other than suppressing future messages.

Sharing

We share data only as needed to run the service: with Square, Inc. (the platform of record for bookings, payments, and customer records) and with our SMS delivery provider, solely to send the messages described above. We do not sell personal information, and we do not share it with third parties for their own marketing purposes. We may disclose information if required by law.

Cookies & similar technologies

We use two first-party cookies, both strictly functional: one keeps a merchant signed into their dashboard, one keeps an admin signed into internal tools. Neither is used for advertising or cross-site tracking, and we don't use any third-party analytics or tracking pixels. The revenue-estimate calculator also uses your browser's own session storage (not a cookie — never sent to us automatically) to remember your inputs if you navigate back to the page; if you later choose to leave contact info, that in-progress estimate is linked to it.

Data retention

We retain booking and offer data for as long as a merchant's account is active, plus a limited period afterward for accounting, dispute-handling, and compliance evidence (e.g. proof of consent for a sent message). A merchant may request deletion of their account data at any time via the contact below, subject to records we're legally required to retain. Phone numbers left through a priority-list waitlist or the revenue-estimate calculator are retained until deletion is requested via the contact below — we don't currently auto-expire these on a fixed schedule.

Security

Access to merchant and client data is limited to what the service needs to operate, and OAuth tokens and other credentials are stored encrypted at rest. No system is perfectly secure, but we treat this data with the same care we'd want applied to our own.

Your rights

If you're a merchant's client and want to know what data we hold about you, correct it, or have it deleted, contact us at the email below — we'll also point you to the merchant, who is the primary data controller for their own client relationships under Square's own terms.

Canadian privacy law (PIPEDA)

We're a Canada-first service and handle personal information consistent with the Personal Information Protection and Electronic Documents Act (PIPEDA): we collect only what's needed to operate, maintain, and improve the service, and you have the right to access, correct, or request deletion of your information as described under "Your rights" above. If you have an unresolved privacy concern after contacting us, you may escalate it to the Office of the Privacy Commissioner of Canada.

Children's privacy

This service is directed at businesses, not children. We do not knowingly collect information from anyone under 13.

Changes to this policy

If this policy changes materially, we'll update the date above and, where required, notify merchants directly.

Contact

Questions about this policy, or a request to access/delete your data: hello@fillsyapp.com.