Privacy Policy

This app ("Rezervito") is provided by MB Fe dev, Vilnius, Lithuania ("we", "us") — the same legal entity behind the sister EU VAT & VIES app. We build Shopify apps for service and appointment businesses. This policy explains what data the app processes, why, and for how long, when a merchant installs it on their Shopify store.

We are a data processor, not a controller, for the personal data of the merchant's customers. The merchant (the store owner) is the controller — they decide why the data is collected and are responsible for their own compliance, including telling their customers about their booking and cancellation policies. See our DPA for the processor terms.

1. What we collect

From the merchant (store owner):

• Shopify shop domain, store settings the app needs to function (services, staff, working hours, booking rules).
• Shopify access token (to call the Admin API on the merchant's behalf).
• Support requests the merchant sends from the app's Contact us page: the message text and the email address to reply to. Any attached files are passed through to our support inbox by email and are not stored by the app.

From the merchant's customers, when they book an appointment:

• Name, email, phone number.
• Appointment details: service, staff member, date/time, any notes the customer or staff enter.
• Payment-related data only in the form of a Shopify order/draft order reference — we do not store card numbers; payment is processed entirely by Shopify's own checkout.
• If the customer signs in, their Shopify customer ID (used to match returning customers, e.g. for the no-show/debt feature).

From a customer who reviews a visit:

• The rating (one to five stars) and an optional comment, tied to the completed booking and its staff member. The merchant decides whether it is shown; if shown, customers see it on the staff member's profile with the reviewer's first name only.

From a customer who asks to hear when a full day frees up (the Waitlist):

• Their email address, the service, staff member and day they asked about, the time of day that suits them, and the storefront language they used. Nothing else: no name, no phone.

From a staff member who connects their own Google Calendar (optional, per staff member; see §6):

• The Google account's email address, and an access key (an OAuth refresh token) that Google issues for the access they allowed. The key is stored encrypted.
• The calendars they chose: the one their bookings are added to and the ones whose busy times block bookings, by id and name.
• From those busy calendars, only the start and end time of events marked Busy. Never an event's title, description, location or guests.

We deliberately do not ask merchants to collect, and the app does not have a dedicated field for: health information, medical history, or other special-category data. The free-text "notes" field is intended for scheduling logistics (e.g. "first visit," "running 10 minutes late"), not client health records. We recommend merchants do not record health, medical, or other sensitive details in the notes field — see also our in-app guidance on this field.

2. Why we process it

• To operate the booking calendar: show availability, create/reschedule/cancel appointments.
• To send booking confirmations and reminders by email, and reminders by SMS when the merchant turns SMS reminders on.
• To email a customer who asked, once, when a time frees up on a day that was full (the Waitlist). The merchant can turn this offer off.
• To show a customer's review of a visit on the staff member's profile in the booking window, once the merchant approves it, with the reviewer's first name only.
• To operate the no-show/deposit feature: track whether a customer owes a deposit or an outstanding balance before their next booking can be confirmed.
• To operate the client-blocking feature: at the merchant's instruction, prevent a specific customer from booking online. This is enforced only within the app's own booking flow — it does not affect the customer's ability to shop or interact with the store outside of booking.
• To add a staff member's bookings to their own Google calendar and keep them up to date, and to stop customers booking the times that staff member is busy in Google Calendar, when they connect it (§6).
• To provide the merchant with their own records (the "Bookings" and "Debts" screens in the app).

We do not sell this data, and we do not use it for advertising.

3. Where it's stored

Data is stored on servers located in the EU via Render (app hosting/database, Frankfurt region) and Cloudflare (DNS/CDN) — the same providers backing the sister project's fedevapps.com hosting. Connections are encrypted in transit (TLS) and data is encrypted at rest. Each time someone at the shop opens one customer's details — in the Shopify admin or the Staff Portal — or exports bookings, Rezervito records who, where and when (no customer data in the record itself), and keeps that record for 12 months.

Honest caveat worth stating rather than glossing over: Render, Inc. and Cloudflare, Inc. are both US-incorporated companies. Storing data in their Frankfurt region keeps it physically in the EU and satisfies the "data residency" expectation most merchants and customers mean when they ask "is my data in Europe," but it does not remove US CLOUD Act jurisdiction over the parent company — in principle, US law enforcement could compel data production from either vendor regardless of physical server location. This is a known, accepted risk (shared with the sister EU VAT project, which runs the same stack) rather than a Rezervito-specific gap — flagging it here so it's a documented decision, not a silent gap someone finds later. If a future merchant or reviewer asks pointed questions about this, the honest answer is "EU-region hosting, US-parent vendor, Standard Contractual Clauses in place" — not "fully EU-sovereign."

SMS reminders, when a merchant turns them on, are sent through Messente Communications OÜ (Estonia). Messente receives the customer's phone number and the reminder text (the shop's name, the service, the staff member and the date and time — not the customer's name or email). Messente states that it stores data in EU data centres.

Google Calendar sync, for a staff member who connects it, exchanges data with Google LLC (US) under Google's own terms and data-transfer safeguards; what goes where is in §6.

4. How long we keep it

• Customer records: a customer's name, email, phone, answers, notes and cancellation messages are kept for 24 months after their last visit (a booking still ahead counts as a visit). After that, they are anonymized automatically: the bookings themselves stay as the merchant's business records (date, service, staff member, status, amounts), with nothing left that identifies the customer.
• Debt records: while a no-show fee is unpaid, the customer's details are kept so the debt can be collected on their next booking; once it is paid or forgiven, the same 24 months apply from that date. The payment itself is recorded as an order in the merchant's Shopify store, which keeps it under the merchant's own accounting obligations.
• Blocked customers: kept while the merchant keeps the block in place, since recognising the customer is what the block does; once the block is lifted, the 24 months apply as above.
• Reviews: kept like the customer's other records, and deleted with them (on a customers/redact request, or when the customer's details are anonymised after 24 months).
• Waitlist requests: deleted as soon as their one email has been sent, or when the day they asked about has passed, whichever comes first. A customers/redact request deletes them at once.
• Google Calendar connections: kept while the staff member stays connected. Busy times are re-read from Google every few minutes and replace the ones held before; only the coming year's are held. Disconnecting, deleting the staff member, uninstalling or a shop/redact request revokes the access key at Google and deletes the connection and its busy times at once.
• Support requests: the message text and reply email are kept until the shop's data is deleted under Shopify's shop/redact process after uninstall.
• If a customer asks the merchant to delete their data, or the merchant uninstalls the app, we process that request per the timelines in Shopify's mandatory customers/redact and shop/redact processes.

5. Sub-processors

We'll update this list as integrations are added — see docs/internal/product/mvp-specification.md §7 and the API spec's v1 section for what's planned but not yet built.

6. Google user data (Google Calendar)

A staff member may connect their own Google account so that their bookings appear in their Google Calendar and their busy times there block bookings. Connecting is optional, and is done by the staff member (or the merchant, with them) through Google's own consent screen.

What the app reads from Google: the account's email address; the list of their calendars, so they can choose; and, from the calendars they chose for busy time, when each event marked Busy starts and ends. Events the app wrote itself are recognised by a private marker and skipped. Titles, descriptions, locations and guests of their own events are not stored.

What the app writes to Google: one event per booking with that staff member, in the calendar they chose, updated or removed when the booking changes. An event holds the service, the customer's name, the shop's address, the number of participants, the answers to the merchant's booking questions, the prepayment, and a link to the booking; the customer's email and phone only when the merchant lets that staff member see customer contact details. Google is told not to send invitations or emails to anyone.

How it is used: only to provide this sync to that staff member and their shop. Rezervito's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular, Google user data is not sold, not used for advertising, not used to train AI or machine-learning models, not transferred to anyone except as needed to provide the sync, to comply with law, or as part of a merger or sale with the same protections, and is not read by people except with the staff member's consent, for security, or where the law requires it.

Customer data in Google: booking details written to a staff member's Google calendar are the merchant's own processing, held in that Google account under Google's terms with its holder. Removing them from Google is the merchant's or the staff member's to do, except the upcoming events the app removes itself on disconnect.

Revoking access: Disconnect Google Calendar in the app (the staff member's page or the Staff Portal) removes the upcoming events the app added (deleting the staff member or uninstalling the app leaves them in Google), revokes the access key at Google and deletes the connection and its busy times. Access can also be removed at any time in the Google account's settings (https://myaccount.google.com/permissions); the next time the app reaches Google, within minutes, it stops writing and reading and deletes the busy times it held; the connection itself is deleted when it is disconnected in the app or the staff member is deleted.

7. Your rights

If you're a customer of one of our merchants and want to know what data is held about you, correct it, or have it deleted, contact the merchant (the store) directly — they are the data controller. If the merchant can't resolve it, you can contact us at privacy@fedevapps.com and we'll assist.

If you're the merchant, you can export your own data from the app's admin screens, or contact us for a full export.

8. Contact

privacy@fedevapps.com — for privacy requests, security concerns, or questions about this policy. A person reads it.

9. Changes to this policy

We'll update the "last updated" date above and, for material changes, notify merchants in-app.