Privacy Policy

Visitzee gives salons, studios, clinics and other appointment-based businesses an online booking page and a dashboard. This policy explains how we handle personal data for two groups of people: business owners and their team who use Visitzee, and customers who book a business through its Visitzee page.

For customers, the business you book with decides why and how your details are used, and Visitzee handles them on the business's behalf to run the booking service. For business owners, Visitzee is responsible for the data of your account.

From business owners and team:

• Your name, email address and a password (stored only as a one-way hash, never in readable form)
• Business details you enter: business name, address, phone, WhatsApp, email, website, Instagram handle, logo, description and map link
• Your services and prices, team members' names, working hours and time off
• Sign-in information such as when you signed in and the browser you used, so you can stay signed in and we can protect your account

From customers who book:

• Your name and phone number, and your email address if you choose to give one
• The service, time and team member you booked, and the booking's status
• A record that you agreed to this policy when you booked: the time you ticked the box and which version of the policy it was

When you book, you are given a private link to view or cancel that booking. We keep only a one-way fingerprint of the link, so it can't be recovered from our records. Anyone who has the link can view and cancel that booking, so keep it to yourself.

Businesses can also keep their own private notes about a customer, such as preferences or allergies. Those notes are the business's, and the business is responsible for what it records.

If you join a waitlist for a fully booked day, we keep your name, phone number and email (if you give one) and the day you want, only until that day has passed. They are used to tell you if a time opens up, and the business can see them.

If you leave a review, we keep your rating and comment together with your first name and the first letter of your last name. These are shown publicly on the business's booking page; the business can hide a review. If your details are deleted, your name is removed from your review.

If you give an email address when you book, it is used only to send you that booking's confirmation, a reminder the day before, and a note if the business moves or cancels it. Replies go to the business. You can leave it empty.

Technical data: we count requests by network address to stop abuse such as automated booking spam. These counts are stored in a hashed form that does not reveal the address. We do not use advertising or analytics trackers.

• To create and run your account and the booking page
• To let a customer book, and to show the business who booked and when
• To keep the service secure and prevent abuse
• To contact you about your account or the service (we will only send operational messages, not marketing, unless you ask for it)

We do not sell personal data, and we do not use it for advertising.

Anyone can try Visitzee in a temporary demo business without signing up. It is filled with made-up sample data, belongs only to that visitor, and is deleted automatically after about 3 hours along with everything entered into it. Please don't enter real customers' details in a demo.

We use one essential cookie to keep business owners signed in. It is not used for tracking and is not sent to booking pages. Your browser's local storage remembers small choices such as light or dark mode and whether the sidebar is collapsed. Customers booking a business are not tracked with cookies.

When you book, you tick a box to agree to this policy and to the business using your name and phone number to manage that appointment. We record when you ticked it and which version of the policy you agreed to. Booking isn't possible without it, because the business can't run your appointment without your name and number.

You can withdraw your consent at any time by asking the business, or us, to delete your details (see “Your choices and rights”). Withdrawing doesn't affect what was done before, and a booking that already happened stays in the business's records without your name or number.

We use a small number of providers (data processors) to run Visitzee. Each handles data only to provide its service to us:

• Vercel: hosts the website and application, and stores businesses' gallery photos (Vercel Blob). Our servers run in Singapore
• Neon: hosts the database, in Singapore (AWS ap-southeast-1)
• Resend: sends our emails, such as password resets, email confirmation and booking alerts to the business. It receives the recipient's email address and the message. Based in the United States
• Razorpay: processes the payment when a business pays for a paid plan. Card and UPI details go straight to Razorpay and never reach our servers; we keep only the amount, the date and Razorpay's reference. Based in India
• Browser push services (Google, Apple, Mozilla): deliver booking alerts to a phone or computer, only if the business turns them on

This means some personal data is stored and processed outside India. We will update this page before adding another provider that receives personal data.

• Customers: a customer's name, phone number and the business's notes are kept for 24 months after their last visit, then removed automatically. The business can choose 12, 24, 36 or 60 months, or keep them until it removes them itself. The booking stays as an anonymous record so the business's history still adds up
• Businesses: an account and everything in it is kept while the business is active. A business can delete it all at any time from Settings; it is removed from our live systems straight away
• Waitlist: until the day you waited for has passed
• Plan payments (amount, date, reference): kept with the business's account, and removed with it
• Demo businesses: deleted after about 3 hours
• Sign-in sessions and one-time links (password reset, email confirmation, invitations): deleted when they expire
• Abuse-protection counters: hashed, and deleted within 2 days
• Activity log (sign-ins, password changes, settings, data requests): 2 years. It records which device type signed in, never customer details
• Backups: overwritten on a rolling basis, and used only to restore the service

We may keep something longer only where the law requires it or to resolve a dispute.

You have the right to know what personal data we hold about you and to get a copy, to have it corrected or completed, to have it erased, to withdraw consent, and to raise a complaint about how it is handled.

• Business owners: Settings → Data & privacy lets you download everything in your account (JSON or CSV), choose how long inactive customers are kept, and delete the whole business with its customers, bookings and photos. Most of your details can be edited in Settings
• Customers: ask the business you booked with to correct or delete your details, or write to us and we will pass the request on. A business can delete a customer's details from that customer's page and can download a copy for you

To make a request, email support@visitzee.in. We aim to reply within 30 days. If you aren't satisfied with our reply, you can complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

Passwords are hashed, sessions can be ended at any time, connections are encrypted, and each business can only reach its own data. Customers' names, phone numbers, emails and the business's private notes are also encrypted before they are stored (AES-256-GCM), with the key kept outside the database, so a copy of the database alone doesn't reveal them. We record when a business downloads its data or removes a customer's details. No online service is perfectly secure, so please use a strong, unique password.

Visitzee is a business tool and is not directed at children. Businesses are responsible for how they handle bookings made for minors.

If we change this policy in a way that matters, we will update the date above and, for business owners, tell you in the dashboard or by email.

Questions about this policy: support@visitzee.in.