1. General position
Bokko is an appointment booking and business management platform. The platform does not use large language models (LLMs) or other artificial intelligence systems trained on personal data to profile guests or businesses, predict their behaviour, or make decisions about them.
The platform uses automated processing in two areas: (1) the rule-based no-show restriction that a business can enable (Section 2), and (2) checking images uploaded to the public booking page with machine image recognition (Section 3).
2. Automated decisions
Automatic no-show restriction
If the business expressly enables it, the system automatically restricts online appointment requests at that business for a guest whose number of no-shows, recorded manually by the business's staff, reaches the threshold set by the business (between 1 and 20; default: 3). The decision is based on a simple, pre-defined rule — not on artificial intelligence or scoring — and uses no other data (such as payment or cancellation history) and no data recorded at other businesses.
- The restriction applies only at that business; the guest can still arrange an appointment with the business directly.
- An automatic restriction ends by itself after 12 months, and the business can lift it immediately at any time.
- On the booking page the guest receives a neutral message and the business's contact details; the guest can ask the business for a review, and the business can lift the restriction by human decision.
- The business, as controller, decides whether to enable the function, the threshold and lifting the restriction; Bokko executes it as processor.
Details: Privacy Policy and Guest Terms of Use, Section 7.
Other rule-based processes
- Subscription states (trial, grace period, pausing booking) are managed by rules based on pre-defined contractual deadlines, under the Service Agreement.
- The timing of notifications and reminders is based on the business's settings.
- Abuse prevention (rate limiting, bot filtering) serves security; it does not rate guests and does not restrict booking beyond filtering technical abuse.
3. Image recognition and other tools
Image moderation (Google Cloud Vision SafeSearch)
Images uploaded by a business as the header image or into the gallery of the public booking page are checked on upload with Google Cloud Vision SafeSearch. The service assigns a likelihood rating to the image; if the image is likely to depict explicit nudity or violence, the system does not display it, notifies the business on the dashboard and records the measure in the image moderation log for 12 months. The analysis takes place at Google's EU processing endpoint without storing the image. Other content categories (for example "racy" images) do not lead to an automatic measure. Logos and staff profile photos are not checked this way. If the check cannot be performed because of a technical error, the image is displayed. Bokko requests only this content rating from the Vision service; it performs no facial recognition or identification. In case of a wrongful classification, the business may request a review at support@bokko.app within the deadline set out in Section 16(g) of the Terms of Service.
Infrastructure services
Infrastructure services used by Bokko (for example Google Cloud and reCAPTCHA Enterprise bot filtering, Sentry error logging) may use machine learning components in their own operation for security and error handling. They do not operate on the content of guest profiles and make no decisions about data subjects.
Internal development tools
Bokko may use AI-based assistants in its internal development processes (coding, documentation, testing). These processes have no access to the live personal data of guests or businesses.
4. Introducing new functions
If Bokko introduces a new function that applies artificial intelligence to personal data or makes automated decisions about data subjects, it will:
- update the Privacy Policy and the sub-processor list in advance;
- inform subscribers under the notification procedure of the Service Agreement and the DPA;
- carry out, or assist the business with, a data protection impact assessment where required by the GDPR.
5. Data subject rights
Under Article 22 GDPR, the data subject has the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects them. A guest affected by the automatic no-show restriction can request human review from the business and express their point of view, and the business can lift the restriction at any time; a business affected by a wrongful image classification can request a review from Bokko.
For other data subject rights (access, erasure, rectification, portability), see the Privacy Policy and the Incident Response and Data Subject Requests page.
6. Contact
Questions about automated processing can be sent to support@bokko.app.