Bookli

Problem

“The season starts in a spreadsheet. So do the problems.” Organisers of camps, sailing schools and riding centres collected sign-ups by e-mail and in spreadsheets, and the more advanced ones used systems written years ago, with security holes.

Discovery before code

Before writing a single line I analysed two large booking applications (a sailing school’s and a riding centre’s) and researched what the market needed. I kept what worked in the organisers’ daily practice and fixed the security gaps.

Solution

• For parents: sign-up without an account in 4 steps, a form in 9 languages, embeddable on a subdomain, a custom domain or in an iframe.
• For organisers: server-enforced capacity limits, season cloning, multiple brands and branches, instalments, reminders, automatic cancellation of unpaid bookings, refunds, PDF contracts, qualification forms, QR-code e-mails.
• Regulatory: export to the national tourism fund portal (TFG), staff vetting, holiday camp registration, versioned consents.
• Integrations: REST API v1 with OpenAPI docs, scoped keys, HMAC-SHA256-signed webhooks with three delivery attempts, company lookup from the national registry by tax ID.

Security and GDPR

Personal and health data is encrypted and each company’s data is isolated. Roles limit access: accounting never sees health data or national ID numbers, staff never see amounts. Data is anonymised automatically after the retention period. Servers are in the EEA and the app has no trackers or Google Analytics.

Business model

Three plans: Mini PLN 59, Midi PLN 239 and Maxi PLN 359 per month (net), with two months free on annual billing. Activation after a demo. In progress: online payments and cancellation insurance.