How We Look After Your Data

Where BookASquare Runs

• Website: hosted on Vercel.
• Application server (the API): Amazon Web Services, in Singapore.
• Database and file storage: Supabase (Postgres), currently hosted in Singapore.

Every connection to BookASquare uses HTTPS.

Organizer Accounts

Organizers sign in through Supabase Auth. Every request from the organizer dashboard is checked by our server against your membership and your role before anything is shown or changed. Owners, Admins, Finance, Event Managers, Check-In Staff and Viewers each see and do only what their role allows.

One organization can never see another's events, orders or settings. If someone asks for data that isn't theirs, the answer is "not found", so they can't even tell whether it exists.

Buyer Orders

Buyers don't sign in to book. Each booking is saved to a free account under the buyer's email, created at checkout; the buyer sets a password from a one-time emailed link, and the password is held by our authentication provider, never by us in readable form. Order pages are marked so search engines don't index them, and they aren't cached.

Buyers see their orders only when signed in to their own account. QR codes work like tickets, so buyers should keep them private.

Payments And Payment Proofs

We never handle card numbers. Card payments are made on Stripe's secure form straight into the organizer's own Stripe account; organizers' Stripe keys are stored encrypted. Bank transfers and payment-app payments go directly from buyer to organizer. None of that money passes through BookASquare.

The screenshots and PDFs buyers upload as proof of payment are stored privately. Only the organizer's team members who handle payments can open them, through links that expire after a few minutes.

Keeping A Record

Sensitive organizer actions, like verifying a payment, accepting or declining a booking, issuing a refund or changing team roles, are recorded in an audit log with who did it and when.

Certifications

We don't hold security certifications, and we won't claim any we don't have. If your organization needs specific answers, email us and we'll tell you exactly how things work.

Personal Data

How we collect, use and protect personal data is explained in our Privacy Policy, including where data is stored and how to ask for a copy or a correction.

Reporting A Problem

Found something that looks like a security issue? Please email support@bookasquare.com with what you found and how to reproduce it. Please don't access other people's data or disrupt the service while testing. We'll reply, keep you updated, and fix confirmed issues as a priority.