Privacy Policy

Zivaro is a booking platform for appointment-based businesses — barbershops, salons, spas, studios and other service providers. Businesses use Zivaro to publish a booking page, manage their calendar, team, services and customers, and (on paid plans) subscribe through our payment provider.

In this policy, “you” is the business account holder unless we say otherwise. For the personal data of your customers that you manage in Zivaro, you are the data controller and Zivaro is your processor: we process that data only on your behalf, to run your booking service. Questions about this policy go to support@zivaro.app.

We process three kinds of personal data:

• Account data — your name, email address and password (stored hashed by our authentication provider, never in plain text), plus your sign-in history needed to keep accounts secure.
• Business data — your business profile (name, category, address, phone), services, team members and their working hours, availability and time off, appointments, and customer records you manage.
• Booking data from your customers — the name, email address, phone number and any notes a customer leaves when booking, together with the appointment details. This is the data you control; we process it so the booking exists, shows in your calendar, and can be managed by you.
• Billing data — your plan, subscription status and billing history. Card numbers are handled entirely by Stripe (see below); Zivaro never sees or stores full card numbers.

We process personal data to provide the service you signed up for: creating and securing your account, publishing your booking page, calculating availability, preventing double bookings, showing your calendar and customer directory, and running subscriptions and payments. We also process the minimum needed to keep the platform secure, prevent abuse, provide support when you contact us, and meet legal obligations such as tax and accounting record-keeping.

We do not sell personal data, and we do not use your data or your customers' data for advertising.

We use a small number of specialist providers, each processing only what its job requires:

• Supabase — database and user authentication. Your data is stored in the European Union (Frankfurt, Germany).
• Vercel — application hosting and content delivery, serving the Zivaro app and website.
• Stripe — subscription payments and the customer billing portal. Stripe processes card payments under its own PCI DSS compliance; card data goes directly to Stripe.

Zivaro uses only strictly necessary cookies: the ones that keep you signed in to your dashboard and protect your session. We do not set advertising cookies and we do not run third-party ad trackers. If that ever changes, we will update this policy and ask for consent where the law requires it.

We keep account and business data while your account is active, so your booking page, calendar and history work as expected. When you close your account or ask us to delete your data, we delete or anonymise it within 30 days, except for records we are legally required to keep (for example billing records held by Stripe for tax purposes) and short-lived backups, which roll off on their normal cycle. Your customers' booking data is deleted on the same basis — ask us, and we will act on your instruction as your processor.

Under the GDPR you have the right to access your personal data, have it corrected, have it deleted, receive a copy in a portable format, restrict or object to certain processing, and withdraw consent where processing is based on it. To exercise any of these, email support@zivaro.app from the address on your account; we respond within one month. You also have the right to complain to your national data protection authority.

If you are a customer of a business that uses Zivaro, please contact that business first — they are the controller of your booking data. We support them in answering your request and will act on their instruction.

All traffic to Zivaro runs over HTTPS. Access to data is controlled per business: our database enforces row-level security so one business can never read another's records, passwords are stored hashed by our authentication provider, and our team's access to production systems is limited to what support and operations require. No system is perfectly secure, but we design Zivaro so that a single failure cannot expose another business's data.

Zivaro is a business tool. It is not directed at children under 16, and we do not knowingly collect account data from them. Customers' booking details are provided by the customer to the business at the time of booking.

When we change this policy we will update this page and the date below. For material changes we will also announce the change in the dashboard before it takes effect.

Zivaro — privacy and support: support@zivaro.app. We read every message.