Privacy Policy

What data we collect

• Contact details from the onboarding form: name, phone/email/Telegram, city, business type.
• Telegram bot token — only if you connect a Telegram channel (encrypted AES-256-GCM, key not in the DB).
• Bookings: client name, optional phone/email, service, time; chatId — if the client came via Telegram.
• Owner and team accounts: name, email or phone, Google profile — if you sign in with Google.
• Technical: IP, User-Agent on form submission (anti-spam and audit log); visits to business pages and the dashboard (IP, User-Agent, page, time) — for security and statistics, kept for up to 90 days.

How we use it

• Contact details — to reach you about launch.
• Token — to run your Telegram channel; row-level DB encryption.
• Bookings — so the master sees the schedule and the client gets a reminder.

Who we share with

We do not sell data or use it for ads. Data is processed only by providers the service cannot work without: infrastructure (server, DNS and network protection), Google sign-in, and — if enabled for your business — email, SMS and online payment providers.

How long we keep it

While your subscription is active. Technical visit data — up to 90 days. After the subscription is closed, data is deleted at your request.

Cookies and local storage

• We use only strictly necessary cookies — sign-in and account protection do not work without them. There are no advertising, analytics or third-party tracking cookies, so no separate consent is required.
• Business cabinet (sambooka.app): __Host-sambooka.session — sign-in session, up to 30 days, extended while you work; revoked on the server when you sign out.
• Sign-in service cookies (authjs.csrf-token, authjs.callback-url, authjs.state, authjs.pkce.code_verifier, authjs.nonce) — protection against request forgery and secure Google sign-in; they live for minutes or until the browser is closed.
• __Host-sambooka.glink — only while linking Google to an account, 10 minutes.
• Business pages: __Host-sambooka.client — so a client sees their bookings (“My bookings”) without signing in again, up to 90 days; works only on that business’s site.
• Browser local storage (not cookies): sign-in screen language, theme, calendar view, selected business — separately for each account; saved sign-in profiles — only if you ticked “Remember on this device”; a technical tab identifier for internal navigation statistics without personal data.
• To manage: sign out or clear the site’s cookies and data in your browser; a saved profile is removed with “Remove from this device” on the sign-in screen.

Your rights

Delete data, get a copy, opt out of processing — message [email protected]; requests are handled manually.