Privacy Policy

Last Updated: September 2026

1. Introduction

Welcome to Clienteria. We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website or use our services.

2. Information We Collect

We may collect, use, store and transfer different kinds of personal data about you:

  • Identity Data: includes name, last name, username or similar identifier.
  • Contact Data: includes email address and telephone number.
  • Technical Data: includes IP address, login data, browser type and version, time zone setting and location.
  • Profile Data: includes your username and password, your appointments, booking history, interests, preferences, and feedback.
  • Usage Data: includes information about how you use our website and services, such as pages visited, features used, and in-app events (product analytics).
  • Google Authentication Data: includes your Google account ID, email address, name, and profile picture received when you sign in with Google or connect your Google Calendar.
  • Calendar Data: includes Google Calendar event details, calendar IDs, external calendar information, and synchronization tokens when you use Google Calendar integration.
  • Crash and Error Data: includes crash and error reports that the mobile app sends automatically to PostHog for diagnostics: stack traces, error messages, and device and user identifiers. Reports are stored within the European Union.
  • Contact Import Data: includes names and phone numbers of the contacts you explicitly select when using the contact import feature; they are transmitted to our server to create client cards. Your address book is never collected automatically or in its entirety — only the entries you manually pick are processed.

3. How We Use Your Information

We use your personal data only when the law allows us to:

  • When we need to perform the contract we are about to enter into or have entered into with you.
  • When it is necessary for our legitimate interests and your rights do not override those interests.
  • When we need to comply with a legal or regulatory obligation.

3a. Data Controllers

Clienteria stores personal data of clients (name, contact details, booking history, notes) on behalf of its users. Where a client books with a Specialist or a Studio, both the Specialist and the Studio may access the client's records within the scope of the Service's permission settings, and each acts as a data controller for the data they process. Clienteria acts as a processor for such data.

3b. Data Shared Between Studio and Specialist

When a Specialist joins a Studio, client records created in the Studio's context become accessible to both the Specialist and the Studio. When the Specialist leaves, access to records existing at the time of leaving is not withdrawn retroactively: both parties retain access, and new client records are no longer shared between them. Clients may request the correction or deletion of their data from either party.

3c. Invite Data

When a Studio invites a Specialist, we process the invite code, the Specialist's name and email (if provided by the Studio), and the fact of the invite's use. This data is used solely to administer the invitation and is deleted or anonymised when the invite expires or is revoked.

4. Third-Party Data Sharing

We share data with the following third parties for service synchronization and product analytics:

  • Google (Authentication & Calendar): For signing in with your Google account, bidirectionally syncing appointments with Google Calendar, importing events from your external Google calendars, and adding appointment events to your clients' Google calendars. We request access to your basic profile, email, and calendar data. See section 4a for details.
  • Telegram: For authentication and notification delivery.
  • Resend: For delivering email notifications and transactional messages.
  • PostHog (Product Analytics): For product analytics: understanding how the website and mobile app are used, measuring feature adoption, and recording session replays of web pages. Session replays capture clicks, scrolling, and page navigation; any text typed into input fields is automatically masked and never recorded. The mobile app also automatically sends crash and error reports to PostHog for diagnostics: stack traces, error messages, and device and user identifiers. We also use PostHog Revenue Analytics, which receives billing metadata (subscription events) from our payment provider Paddle. PostHog acts as a data processor and stores data within the European Union. See section 5 for details on cookies and analytics storage.

4a. Google Integration Details

When you use Google integration features, the following data practices apply:

  • Google Sign-In: When you sign in with Google, we receive your Google account ID, email address, name, and profile picture. This data is used to create or link your Clienteria account. We do not receive your Google password.
  • Google Calendar Sync (Specialists): When you connect Google Calendar, we create a dedicated "Clienteria" calendar in your Google account. Appointments are synced bidirectionally: changes made in Clienteria appear in Google Calendar and vice versa. Synced events may include appointment title, client name, phone number, participants, time, and color.
  • External Calendar Sync: You may choose to import events from your other Google Calendars. This requires read-only access to your calendars. Imported events appear as read-only time blocks in Clienteria and help prevent scheduling conflicts. We do not modify or share your external calendar data.
  • Client Calendar Sync: When enabled by a specialist, appointment details may be added to clients' Google Calendars. Shared information includes specialist name, appointment time, and custom description templates configured by the specialist.
  • Data We Store: We store Google OAuth tokens, calendar IDs, event IDs, webhook identifiers, and sync tokens to maintain the connection. Tokens are refreshed automatically and stored securely in our database.
  • Disconnecting Google: You can disconnect Google Calendar at any time from your settings. Upon disconnection, we delete stored OAuth tokens and calendar IDs. Events already in your Google Calendar are not automatically removed.

4b. Google User Data Sharing, Transfer, and Disclosure

When you use Google Sign-In or Google Calendar integration, we collect limited Google user data as described in Sections 2 and 4a. Below is a clear disclosure of with whom we share, transfer, or disclose this Google user data:

  • We Do Not Sell Google User Data: We do not sell, rent, or trade any Google user data (including Google account information, email, profile data, or calendar data) to any third party for advertising, marketing, or any other commercial purpose.
  • Third Parties Receiving Google User Data: Google user data is shared only with the following third parties, strictly as necessary to provide our appointment scheduling service:
  • Google LLC: When you authenticate via Google Sign-In or connect Google Calendar, data is exchanged directly with Google APIs. This includes your Google account ID, email, name, and calendar event data. Google processes this data according to Google's own Privacy Policy.
  • Cloud Hosting Provider: We store Google OAuth tokens, calendar IDs, and sync data in our secure database hosted on a cloud infrastructure provider. The hosting provider has no access to decrypted Google user data and processes it solely as a data processor under our instructions.
  • Parties That Do NOT Receive Google User Data: We do not share Google user data with Telegram (used only for notifications and authentication via phone), Resend (used only for email delivery), or any other analytics, advertising, or tracking services. Google user data is never disclosed to other Clienteria users beyond what is necessary for appointment scheduling (e.g., your name may be visible to the specialist you book with).
  • Data Transfer: Google user data is processed and stored on our secure servers. When interacting with Google APIs, data is transmitted to Google LLC, which may process it in various jurisdictions according to Google's data processing terms and your Google account settings.
  • Legal Disclosure: We may disclose Google user data if required by applicable law, regulation, legal process, or governmental request. In such cases, we will disclose only the minimum data necessary to comply with the legal obligation.

5. Cookies

We use essential cookies to maintain your session and authentication — these are necessary for the Service to function and cannot be disabled. We also use analytics storage (cookies and local storage) through PostHog to understand how the Service is used: page views, feature interactions, and session recordings. Analytics data is processed on the basis of our legitimate interest in improving the Service; it is never used for advertising and is not sold to third parties. You may object to analytics processing at any time by contacting us at the address below, and you can block or delete analytics storage through your browser settings.

6. Data Security

We use HTTPS encryption, secure authentication tokens stored in HTTP-only cookies, and industry-standard database security measures to protect your information. All data is stored securely and access is restricted to authorized personnel only.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, or as required by applicable law. Account data is retained for up to 3 years after your last activity. Appointment history is retained for up to 5 years for tax and regulatory compliance. When data is no longer needed, it is securely deleted or anonymized within 30 days.

8. Your Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to access, correction, erasure, restriction, data portability, objection to processing, and withdrawal of consent. You may exercise these rights by contacting us at the address below.

9. Data Deletion

To request deletion of your data, please email us at: [email protected]

10. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes to how we use your Google user data, we will notify you by email or by displaying a prominent notice in our application before the changes take effect. We encourage you to review this policy periodically.

11. Governing Law

These privacy practices are governed by the laws of Ukraine, including the Law of Ukraine 'On Personal Data Protection'. For users in the European Union, GDPR rights also apply. We commit to respecting applicable data protection laws in all jurisdictions where we operate.

12. Contact Us

If you have any questions about this privacy policy or wish to exercise your data protection rights, please contact us: [email protected]