Vizitino

Privacy policy

Draft. This text must be reviewed by a lawyer before it is published.

1. Who we are

Vizitino is an online booking platform for businesses that work by appointment. It is operated by Слободенюк Андрій Віталійович, м. Бердичів, вул. Крупської, буд. 20 ("we", "us"). For any privacy question, write to contact@vizitino.com.

This policy explains how we process personal data of:

  • clients who book appointments with a business (a salon, clinic or studio) through Vizitino, and
  • business users who use Vizitino to run their business.

2. Clients: the business is responsible for your booking data

When you book through a business's Vizitino page or chat, that business is the controller of your data. It decides why and how the data is used. We process the data on the business's behalf as a processor, under a data processing agreement (Article 28 GDPR). For questions about your booking data, contact the business directly. We help the business answer such requests.

Data we process for bookings:

  • name, phone number and email address;
  • your optional message to the business;
  • the booked service, specialist, date and time, language and booking status (for example cancelled or not attended);
  • technical data such as your IP address, used briefly for security and protection against abuse.

Purposes: to make and manage your booking, send the confirmation and reminders, let you cancel online, and protect the service against misuse.

Legal basis: the steps needed to provide the service you request from the business (Article 6(1)(b) GDPR) and the business's legitimate interest in organising its appointments and in security (Article 6(1)(f) GDPR).

How long: the business decides how long it keeps client records. AI chat conversations are deleted automatically after 90 days.

3. Business users: we are responsible for your account data

Data: your name, email address, password (stored only as a secure hash), two-step verification data (encrypted), your business details and billing contact, and records of important actions in your account (audit log).

Purposes: to provide and secure the service, support you, invoice the subscription and meet legal obligations.

Legal basis: our contract with you (Article 6(1)(b) GDPR), legal obligations such as accounting (Article 6(1)(c) GDPR) and our legitimate interest in security and improving the service (Article 6(1)(f) GDPR).

How long: while your account exists, and afterwards only as long as accounting or other laws require.

4. AI booking assistant

If a business turns on the AI assistant, the messages you write in the chat are processed by our AI provider (Anthropic) to generate answers and, only after you clearly confirm, to create a booking. The assistant uses only the business's real services, prices and free times. Conversations are stored for the business to review and are deleted after 90 days.

5. Google Calendar (business users)

If a business connects its Google Calendar, Vizitino reads the list of its calendars and the time and title of events in the calendar the business selects. We use this only to show the business its existing appointments and to prevent double bookings. We do not read event descriptions, guests or attachments. Only if the business turns on “Add new bookings to this calendar” does Vizitino ask Google for permission to create events, and then it adds an event for each Vizitino booking (service, client's name and phone) and removes it when the booking is cancelled or moved. Vizitino never changes or deletes any other events, and never invites guests. The business can disconnect at any time, after which we delete the stored copy of the events.

A business can also connect a calendar by pasting its private calendar address (iCal), or subscribe its own calendar app (Google, Apple, Outlook) to a private Vizitino address with its bookings. In the first case we read only the time and title of events, as above. In the second case the business's calendar provider downloads the business's bookings, including client names and contact details, from that address; the business decides whether to do this and can replace the address at any time.

Vizitino's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising, or use it to train AI models.

6. Where data is stored and who helps us

All data is stored in the European Union (data centres in Frankfurt, Germany). We use carefully selected service providers (sub-processors) who are bound by data protection agreements:

  • Render (hosting and database, EU region);
  • Cloudflare (network security and fast delivery of pages);
  • Resend (sending emails);
  • Sentry (error monitoring, EU region; no personal data is sent);
  • Better Stack (uptime monitoring);
  • Google (only if a business connects Google Calendar);
  • Anthropic (only if a business turns on the AI assistant).

If a provider processes data outside the European Economic Area, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

7. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. If processing is based on your consent, you may withdraw it at any time. For booking data, contact the business first; you can also write to us at contact@vizitino.com.

You also have the right to lodge a complaint with a data protection supervisory authority, for example in Finland the Data Protection Ombudsman (tietosuoja.fi), in Poland UODO (uodo.gov.pl), in Germany the authority of your federal state, or in Ukraine the Ukrainian Parliament Commissioner for Human Rights.

8. Security

We protect data with encryption in transit, encrypted storage of sensitive tokens, two-step verification that every user can turn on, strict separation of each business's data at database level, encrypted daily backups and logging of access to personal data.

9. Cookies

We use only cookies that are necessary for the service to work (signing in and remembering your language). We do not use advertising or tracking cookies. See the cookie policy.

10. Changes

We may update this policy. We will publish the new version on this page and inform business users of important changes in advance.