Everything you save - documents, customers, bookings - is hosted in the EU. Your data is used to run your account and nothing else; it is never used to train AI models, ours or anyone's.
Card payments, deposits and your customers' card details are handled entirely by Stripe under your own Stripe account. FullDiary never sees or stores a card number. Bank details you print on invoices are stored with your business and shown only where you put them.
Your customers' records, visit notes and form answers can be read by you and the staff you invite, and by nobody outside your business: every record is locked to your business in the database. You are the data controller for that information and we are your processor, which means we act on your instructions, use it for nothing else, and delete it when you do. Health and consent forms show the customer their purpose and a retention line, take a typed-name agreement with the time and device kept as evidence, leave the system only as a PDF you request, and are never sent to an AI service.
Documents and statements uploaded without an account, to try a tool, are deleted automatically after 24 hours. The privacy policy has the full detail, in plain English.