Privacy Policy

This Privacy Policy explains how MiniLARGE Inc. (“we”, “us”), the owner and operator of ML Booking (mlbooking.ca), collects, uses, and shares information when you use mlbooking.ca, our booking widgets, and related services. MiniLARGE Inc.’s company website is www.minilarge.ca.

MiniLARGE Inc. is a Canadian corporation operating online from Ontario, Canada. We handle personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and other Canadian privacy laws that apply, including Quebec’s Act respecting the protection of personal information in the private sector where it applies. If you are outside Canada, local laws may also give you rights, which we will honour where they apply to us.

Related documents: Terms of Service and Terms of Use.

1. Who is responsible

When you create a Business or Staff account, or browse our marketing site, MiniLARGE is the organization that determines why that account and site information is collected.

When a Client books with a Business, the Business decides why Client booking details are collected (to schedule and fulfill the appointment). MiniLARGE processes those details as a service provider to that Business so the booking, calendar, email, optional SMS, and optional card payment can work. The Business is responsible for telling its Clients how it uses their information and for using the Service in a way that complies with privacy law.

Our Privacy Officer can be reached at the contact details in Section 19.

2. Information we collect

Depending on how you use the Service, we may collect:

• Account details for businesses and staff (name, email, phone, password, business address)
• Booking details (customer name, email, phone, appointment time, services, notes)
• Technical data such as IP address, browser type, and widget usage needed to operate the Service

We may also collect, where you choose to provide it or where the Service generates it:

• Business profile information (logo, hours, service names and prices, policies, custom domain and email settings)
• Staff schedules, exceptions, and login activity
• Payment-related records for ML Booking subscriptions (plan, add-ons, billing email, Stripe customer or subscription identifiers, and payment status). We do not store full payment-card numbers for subscriptions; Stripe does
• If a Business connects Square or Stripe for Client booking payments: connected-account identifiers, charge and refund status, and amounts needed to apply our platform fee. Card details for those charges are handled by Square or Stripe, not stored by us as a full card number
• Email and SMS delivery logs (to, time, template, success or failure)
• Support messages you send us
• Approximate location derived from IP address, used for security and localization (for example, time zone defaults)

We do not require OHIP numbers, social insurance numbers, or clinical health records, and the Service is not designed as an electronic medical record. Please do not enter that kind of information in notes fields.

3. How we use information

We use this information to operate booking accounts, create and manage appointments, send transactional email and SMS (confirmations, reminders, updates), provide support, and improve the Service.

Identified purposes also include: authenticating users; preventing fraud and abuse; billing Platform Fees; applying the flat paid-booking fee; measuring marketing pages (where analytics is installed); identifying a Business as a customer of ML Booking using the business name and logo it submits, as described in the Terms of Service; complying with law; and establishing, exercising, or defending legal claims. We do not use a Client’s or Staff member’s personal name or photo for that customer list without a separate consent. We do not use personal information for purposes that are not identified, except with new consent or as permitted by law.

4. Consent

We collect, use, and disclose personal information with consent, except where PIPEDA or another law allows or requires collection without consent (for example, to investigate a breach of agreement, to collect a debt, or as required by a court).

Consent may be express (a checkbox, an account signup, or an email request) or implied where the purpose is obvious (for example, using an email address to send a booking confirmation you requested). You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. If you withdraw consent for a purpose that is required to run the Service, we may need to close the account or stop a feature (for example, SMS).

SMS consent is collected only as described in Section 5. A Business must not send marketing SMS through the Service.

5. Text messaging and mobile information

If you provide a mobile number and give consent by checking the SMS opt-in box, we and/or the business you booked with may send transactional appointment texts. You can opt out by replying STOP. Reply HELP for help. Message frequency varies. Message and data rates may apply.

6. Cookies and analytics

We use cookies and similar technologies that are required to keep you signed in, maintain security, and remember settings. Our marketing and public pages may use Google Analytics or a similar measurement tag if we (or a Business, on its own booking pages) have configured it. Those tools may set their own cookies and receive technical data such as IP address, device type, pages viewed, and referring URL.

You can block or delete cookies in your browser. If you do, some account features may not work. Google’s tools are also subject to Google’s privacy policy. We do not use the Service to drop unrelated advertising pixels unless a Business adds its own permitted measurement code on pages it controls.

We may store campaign parameters (such as UTM values) so that a later signup or purchase can be attributed to a marketing visit. That is used to understand our own advertising, not to sell your information.

7. Service providers

We use vendors that help us run the Service, such as hosting and, when SMS is enabled, a messaging provider (Twilio or Telnyx) solely to deliver the texts you consented to. Those providers may process phone numbers only to send those messages. They are not given opt-in data for their own marketing.

If a business collects a card payment at booking, the charge is processed by Square or Stripe on that business’s account. Those providers receive the payment details needed to complete the charge. MiniLARGE Inc. receives a flat platform fee on paid bookings only.

Other providers we may use include: infrastructure and hosting vendors; Stripe for ML Booking subscription billing; email delivery or SMTP services (including a Business’s own SMTP if Whitelabel is configured); and Google, if Analytics is installed. Each provider may process information only to provide its service to us or to the Business, under contracts or terms that limit use where we can obtain them.

8. Storage and transfers outside Canada

Personal information may be stored or processed in Canada, the United States, and other countries where we or our providers operate (including Twilio, Telnyx, Stripe, Square, and Google). When information is outside Canada, it may be subject to the laws of that country, including lawful access by courts or governments there.

By using the Service, you consent to this processing. If you are a Business, you are responsible for telling your Clients that their booking information may be processed in other countries through ML Booking and its providers.

9. Sharing

We share booking information with the business you booked with so they can fulfill the appointment. We do not sell personal information. We may disclose information if required by law.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We may also share information: with service providers as described above; with professional advisers under confidentiality; with a buyer as described in Section 17; or with authorities if we believe in good faith that disclosure is required to comply with law, a warrant, or a binding request, or to protect the safety of a person, the public, or the Service. We may share aggregated or de-identified information that cannot reasonably identify you.

10. Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including access controls, encrypted connections (HTTPS) on our Sites, password hashing, and restricted staff access. No method of transmission or storage is completely secure. You are responsible for the security of your own passwords and devices, and a Business is responsible for how its Staff use the account.

11. Retention

We keep account and booking records as long as needed to provide the Service and meet legal obligations. You may request deletion of your information by contacting us, subject to records a business must keep.

Typical examples: we keep an active account while it is open; we may keep booking and billing records after closure for tax, accounting, dispute, and legal-limitation periods; we keep security logs for a shorter operational period; and we may keep a record of SMS opt-out so we do not text a number that asked us to stop. Backup copies may persist for a limited time after deletion from live systems.

12. Your choices and rights

You may update account details in your dashboard, opt out of SMS with STOP, and email [email protected] to ask access, correction, or deletion questions.

Subject to exceptions in PIPEDA and other applicable law, you may also: withdraw consent; ask how we use and disclose your information; challenge our compliance; and, if you are in Quebec, exercise additional rights of access, correction, and withdrawal that Quebec law provides. We will respond within the time the law requires. We may need to verify your identity. We may refuse a request where the law allows (for example, information that would reveal another person’s personal information, or records we must keep).

If you are a Client of a Business, please contact that Business first about your appointment details. We can help where we are able, and we may need the Business’s confirmation before changing or deleting records it is required to keep.

We do not sell personal information. If a US state privacy law applies to you, you may contact us to exercise any access, deletion, or appeal right that law gives you against us. We will not discriminate against you for exercising a privacy right.

13. Business customers

If you are a Business, you must: collect only the Client information you need; give Clients a privacy notice that covers your use of ML Booking; not use Client information from the Service for unrelated marketing unless you have a lawful basis; and not attempt to export or use SMS opt-in data except to honour consent and opt-out for transactional appointment texts.

You are responsible for Staff access and for any tracking code you add to your own booking pages. Do not paste scripts that collect personal information in a way your notice does not describe.

14. Electronic messages (CASL)

Transactional messages about an account or a booking you requested are sent as part of that transaction. If we send commercial electronic messages, we intend to do so only with consent or another CASL exception, and those messages will include identification and an unsubscribe mechanism. Unsubscribing from marketing does not stop transactional booking or account messages.

15. Breach notification

If we have reasonable grounds to believe that a breach of security safeguards has occurred that creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as PIPEDA requires, and we will notify other regulators where other law requires it.

16. Children

The Service is not directed to children under 13, and we do not knowingly collect their information.

A parent or guardian, or a Business that lawfully serves minors, may enter a minor’s booking details. That person is responsible for having authority to do so. If you believe we have collected a child’s information inappropriately, contact us and we will delete it where we can.

17. Business transfers

If MiniLARGE Inc. is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction, under commitments that are at least as protective as this Policy, where reasonably possible. We may also share information with our professional advisers for that purpose.

18. Changes

We may update this Policy. The date at the top will change when we do.

If a change is material, we will also try to notify Business accounts by email or a notice in the Service. Continued use after the effective date means you accept the updated Policy, except where the law requires a new consent.

19. Contact and complaints

Privacy Officer
MiniLARGE Inc.
Product: ML Booking (mlbooking.ca)
Ontario, Canada
Company website: www.minilarge.ca
Email: [email protected]
Phone: +1 (613) 416-8830
Hours: Mon - Fri | 9am - 5pm EST

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada. Residents of Quebec may also contact the Commission d’accès à l’information du Québec. Residents of other provinces may have a provincial commissioner as well.