Privacy Policy

1. Who is responsible for which data

• We are responsible for your BookTime account, sign-in, bookings made through the catalog, favourites, diary, notifications and reviews.
• Client records that a salon or professional keeps in BookTime Business (visit history, notes, medical card, documents, photos of work) belong to that business. The business decides what to record and how long to keep it. We store and process this data on its behalf. To change or delete such a record, contact the business. If it does not respond, write to us and we will help.

2. What data we receive

• Account: phone number (Armenian, +374) and name. Optional: profile photo, gender, date of birth, district, language.
• Sign in with Google or Apple: the account identifier, the email address (if the provider shares it) and your name. You still confirm your phone number with a code once. For Sign in with Apple we keep an encrypted Apple token so that we can revoke access when you delete your account.
• Sign-in codes: we store only a hash of the code, the phone number and the IP address. They are deleted after one day.
• Session: a random key in a cookie. Our database keeps only its hash, the IP address and the device type. A session lasts 60 days and is extended while you use the service. The sign-in log (method, IP address, device) is kept for one year to protect your account.
• Bookings and activity: bookings and their history, waitlist, favourites, diary, ratings and reviews, orders (for example repairs or dry cleaning), gift certificates, memberships, loyalty cards, messages to a business.
• Business staff: name, phone, login and password hash, permissions, and the log of actions in the business account (with IP address and device).
• Client records in a business account: name, phone, email, date of birth, gender, notes, tags, visits and payments the business recorded. For clinics, also a medical card. Plus documents and photos the business uploads.
• Notifications: the device push token (Firebase Cloud Messaging; on iPhone via Apple Push Notification service). If you connect our Telegram bot @booktime_am_bot, we store the chat ID, phone number and Telegram language.
• Photos and files: photos are re-encoded and EXIF data, including location, is removed. Photos of businesses, professionals and their work are public. Client documents are private: only business staff with permission to view clients can open them.
• Location: only if you allow it in your browser or the app. We use it to show nearby places and do not store it.

We do not read your phone contacts, we do not receive bank card data and we do not use advertising identifiers.

3. Why we use data

• To let you sign in, book, reschedule or cancel and see your bookings. This is performance of our contract with you (the Terms of Use).
• To send sign-in codes, confirmations and booking reminders.
• To let a business keep its calendar, client base and orders, on the business’s behalf.
• To protect accounts and the service from hacking, abuse and fraud: code limits, the sign-in log, the action log.
• To find and fix errors and understand which pages help people book. For this we use only anonymous statistics (see below).
• To comply with the law.

You give consent to data processing when you first sign in. You can withdraw it by deleting your account or writing to us.

4. Who receives data

We do not sell data and do not share it with advertisers. Data goes only to those the service cannot work without:

• The business you book with: your name, phone, chosen services, time and booking comment. Businesses you have not booked with do not see your data.
• Delivery of codes and messages: Telegram (Telegram Gateway for sign-in codes; the bot for reminders), Meta (WhatsApp Business, for sign-in codes if Telegram could not deliver). They receive the phone number and the message text.
• Sign-in and notifications: Google (Sign in with Google, Firebase Cloud Messaging) and Apple (Sign in with Apple, iPhone push notifications).
• Hosting: Railway (servers and database in the EU, the Netherlands) and Vercel (website delivery).
• Error monitoring: Sentry (EU data storage). User data, cookies, headers and request bodies are removed before a report is sent.
• Visit statistics: Vercel Web Analytics and PostHog (EU data storage). Names, phone numbers and search text are never sent, and IP addresses are not stored.
• Salon counters (Meta Pixel, Google Analytics): only on the booking page of a salon that added them, and only after your consent (see the cookies section).
• Public authorities, only on a lawful request.

5. Where and for how long data is stored

• Our server, database and uploaded files are hosted in a data centre in the European Union (the Netherlands).
• The database is backed up every night. Backups are kept for 14 days and then deleted.
• Account data is kept while the account exists. After deletion it is erased or anonymised (see “Account deletion”), and it disappears from backups within the next 14 days.
• Sign-in codes are kept for one day, the sign-in log for one year. Closed sessions are removed after 30–90 days.
• Bookings and client records in a business’s base are kept while the business uses BookTime. When a business leaves, it receives an export, and 90 days later its client base is anonymised.

6. Cookies and browser storage

• Session cookie (httpOnly), to keep you signed in.
• Preference cookies: language, theme, business menu layout.
• Browser storage (localStorage): screen preferences and a random ID for anonymous statistics. The ID only groups the steps of one visit and is not linked to your name or phone.

We set no advertising or third-party tracking cookies of our own. If your browser sends Do Not Track or Global Privacy Control, no statistics are collected at all.

The exception is a salon’s own counters. A salon can add Meta Pixel and Google Analytics to its booking page (booktime.am/b/…). They load only if you tap “Allow” in the prompt on that salon’s page; without your consent, with Do Not Track or Global Privacy Control on, or inside the BookTime apps, nothing is loaded. The counters receive only booking steps (page opened, service chosen, time chosen, booking created) — never your name, phone number or service names. Meta and Google receive this data and process it under their own terms for the salon. Your choice is kept in browser storage separately for each salon; to change your mind, clear the site data for booktime.am in your browser.

7. Your rights

• Find out what data we hold about you and get a copy.
• Correct your data. You can change your name and photo in your profile.
• Delete your account in the app or on the website, and withdraw consent.
• Ask us to temporarily block processing. In the business account, use “Request a data block” under “Personal account → Privacy”.
• Unsubscribe from a business’s news in your profile. Reminders about your bookings are always sent while the booking is active.
• Complain to the authorised body for personal data protection of the Republic of Armenia.

Write to info@booktime.am from the phone number linked to your account, or include that number in your message. We may ask you to confirm the number with a code. We reply within 30 days. Business owners can export their client base themselves in the business account.

8. Account deletion

BookTime app and website: “Profile” → “Delete account”. BookTime Business app: “Settings” → “Personal account” → “Account management” → “Delete my account”.

The account is deleted 25 days after the request. The delay lets you change your mind and lets a business transfer ownership. You can cancel in the business account, or in the client app by writing to us. We then erase your name, phone, photo, gender, date of birth, favourites, diary, Google and Apple links, push tokens and sessions. We revoke Sign in with Apple and anonymise waitlist entries. Bookings and client records at businesses stay with those businesses, no longer linked to your account. Ratings stay in a professional’s score without your name.

Step-by-step instructions are on the “Account deletion” page.

9. How we protect data

• The website, apps and server communicate only over HTTPS.
• Sign-in codes, passwords and session keys are stored only as hashes, and Apple tokens are encrypted.
• Business staff see only what the owner allows: client phone numbers, base export, documents.
• Important actions in the business account are logged. Only responsible people have access to the servers.

10. Children

The service has no age restrictions: teenagers can book on their own. You can create an account from age 13. A child under 13 is booked by a parent from the parent’s own account. If you learn that a child under 13 created an account, write to us and we will delete it.

11. Changes to this policy

If we change what data we process or why, we will update this page and the date at the top, and we will warn you in the app in advance about important changes.

12. Contacts

AI Switch LLC (tax ID 01098805), 10 Kocharyan St, Apt 4, Yerevan 0056, Armenia. Email for data questions: info@booktime.am.