Privacy Policy

1. Who is responsible for your data

It depends on what you are doing on TimeNow.

• When you book with a business, that business is responsible for your booking data — it is the controller, in GDPR terms. It decides what it collects and how long it keeps it. We store and process that data on its behalf, as its processor, under our Data Processing Agreement. Each business publishes its own privacy notice on its booking page.
• For everything TimeNow decides itself, we are the controller: TimeNow accounts, both for businesses and their teams and for Clients using the TimeNow app or client portal; billing and invoices for businesses; keeping the platform secure; statistics about how the platform is used; our own marketing; and demo and contact requests.

Questions about a booking, or a request to see or delete what a business holds about you, are best sent to that business. If you send them to us instead, we pass them on within 5 business days.

2. What data we process

Business accounts

• Name, email address, phone number and profile photo of the account owner and team members.
• Company details, roles and permissions, settings, and sign-in records.
• Subscription and billing details, and the invoices we issue.
• Social accounts a business connects to publish its posts — a Facebook Page and the Instagram professional account linked to it, or a LinkedIn Page: their name, username and picture, and the access tokens that let us publish. The tokens are kept encrypted in our secrets manager, never in our database. We do not read the Page's followers, comments or messages, nor the profile of the person who connects it beyond what the login needs.

Your TimeNow account (app and client portal)

• Email address and phone number, each confirmed with a one-time code, your name and profile photo.
• Whether your name and photo are shown to other participants in a class — your choice.
• The devices you register for push notifications.
• Your bookings, memberships and vouchers at the businesses you use, so you can see them in one place.
• AI assistants you connect to your account, such as ChatGPT or Claude, and what you allow them to access.

Bookings you make with a business

When you book, we collect on the business's behalf your name, email address, phone number, city where the business asks for it, the service, date and time, your notes, payments, and — if the business uses it — your WhatsApp conversation with its booking assistant. The business is the controller of this data (section 1); the full list is in Annex I of the DPA.

Marketing choices when you book. The booking form has two optional boxes, both unticked. One lets the business send you its offers by email, SMS or WhatsApp; we record that choice on the business's behalf. The other lets TimeNow send you its offers and those of other businesses on TimeNow, by the same channels; for that one TimeNow is the controller, and we keep your name, email address, phone number and a record of when, where and in which wording you agreed. Booking does not depend on either. You can withdraw each choice separately, at any time: with the unsubscribe link in every offer, in your TimeNow account or app, by telling the business (for its offers) or by writing to us. Withdrawing one does not change the other.

Feedback after a visit, where the business asks for it: an overall rating, optional ratings of the service or class and of the team members who served you, the aspects you select and an optional comment. Feedback goes only to that business and is never published. You can hide your name: the business then sees your answers without your name or the time you sent them. We still record which booking the feedback belongs to, so you are not asked twice about the same visit and so we can act on erasure requests.

Demo and contact requests

• Name, email address, phone number, company, your message, and whether you want our marketing emails.

Data collected automatically

• Technical data: IP address, browser and device details, cookies, and security logs.
• Website analytics (PostHog, Google Tag Manager and Google Analytics), only if you accept them in the cookie banner.
• Advertising measurement, only if you accept it in the cookie banner: OpenAI's ad click and browser identifiers, and whether a visit from one of our ads led to a business signing up for a trial.
• TimeNow app usage events, linked to a pseudonymised identifier rather than your name, email address or phone number.

Data from other services

• If you sign in with Google: your name and email address.
• From payment processors: whether a payment succeeded, the amount and an order reference. Card details stay with the processor and never reach us.
• From Meta, when a business uses WhatsApp: your phone number, profile name and the messages you exchange with that business.

3. Why we use it, and on what legal basis

• Running your account and the platform — creating and securing accounts, signing you in, sending service messages: performance of a contract (Article 6(1)(b) GDPR).
• Billing and accounting for business subscriptions: legal obligation (Article 6(1)(c) GDPR).
• Security and abuse prevention — logs, rate limits, bot checks and fraud prevention: our legitimate interest (Article 6(1)(f) GDPR).
• Website analytics: your consent (Article 6(1)(a) GDPR and Article 4(5) of Law no. 506/2004), given in the cookie banner and withdrawable at any time from the same place.
• Advertising measurement — knowing whether our ads lead to signups: your consent, given in the cookie banner and withdrawable at any time from the same place.
• App analytics: our legitimate interest in improving the TimeNow app, using a pseudonymised identifier only. You can turn it off at any time in the app: Profile → "Send analytics".
• TimeNow marketing — news about TimeNow and offers from businesses on TimeNow, by email, SMS or WhatsApp: your consent, asked for separately and never as a condition of booking or signing up. You can withdraw it with the unsubscribe link in every message, in your TimeNow account or app, or by writing to us.
• Answering demo and contact requests: steps you asked for before a contract (Article 6(1)(b) GDPR) and our legitimate interest in replying.
• Legal claims: our legitimate interest in establishing, exercising or defending them.

For booking data, the legal basis is the business's. Our DPA lets us use that data only to provide our service to the business.

4. Who receives your data

We do not sell personal data.

• Businesses you book with receive your booking details and what you choose to share with them from your TimeNow account.
• AI assistants you connect. If you connect ChatGPT, Claude or another assistant to your TimeNow account, we send it the information you ask it to retrieve. That service then processes it under its own privacy policy.
• Payment processors a business uses, such as Netopia or Stripe, receive what is needed to take your payment.
• Social networks a business connects. When a business connects its Facebook Page, Instagram account or LinkedIn Page, we send Meta or LinkedIn the posts the business approves — the text and the image — when it publishes them or at the time it schedules. Meta and LinkedIn then process them under their own privacy policies.
• Public authorities, when the law requires it.

Service providers that process data for us, under contracts that bind them to our instructions and to protect it:

• Hetzner Online (Germany): servers and database, in Finland.
• Cloudflare (United States): network delivery, encryption in transit, protection against attacks, bot checks on sign-up, and storage of backups and files in the EU.
• Resend (United States): sending emails.
• web2sms (Romania): sending sign-in codes by SMS.
• Expo (650 Industries, United States): push notifications to the TimeNow app.
• PostHog (United States, data hosted in the EU): analytics and quality monitoring, with pseudonymised identifiers.
• Google (Ireland): Google Tag Manager and Google Analytics on our website, only with your consent, and Google Sign-In if you use it.
• OpenAI (Ireland, processing in the United States): the language model behind the WhatsApp booking assistant, for businesses that turn it on; and, only with your consent, measuring our ads on its platform.
• Meta (Ireland): WhatsApp messages.
• StartCo (Romania): issuing our invoices to businesses and submitting them to ANAF through e-Factura.

The providers that process booking data on behalf of businesses are listed, with their locations, in Annex III of the DPA.

5. Transfers outside the EU

We keep data mainly in the European Union. Some providers process it in the United States: Cloudflare, Resend, Expo, OpenAI and Meta. We transfer data only to recipients certified under the EU-US Data Privacy Framework, or under the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914). You can ask us for a copy of the safeguards that apply.

6. How long we keep data

• Business accounts: while the account is active. After it is closed, the business's data is deleted within 90 days, as set out in the DPA; invoices and accounting records are kept for as long as accounting and tax law requires.
• Your TimeNow account: until you delete it in the app. Deleting it removes your account and removes your name, email address and phone number from your client records at the businesses you used. Your past bookings stay with those businesses, without those details. Deleting it also withdraws your consent to offers from TimeNow and from those businesses. So that a business's offers do not restart if you book with it again, we keep only a coded form of your email address and phone number, which cannot be turned back into them.
• Booking data: as long as the business decides. Ask the business.
• Feedback: as long as the booking it belongs to exists in the business's account, unless you ask for it to be deleted.
• Connected social accounts: until the business disconnects them or closes its account; disconnecting deletes the access tokens. LinkedIn ends a connection after one year at most, after which the business connects again.
• Demo and contact requests: as long as we need them to handle your request and any follow-up.
• Marketing consent: until you withdraw it. We then keep a record of your opt-out, so we do not contact you again. If you tell us why you unsubscribed, which is always optional, we keep your answer with that record; a business sees only how many clients gave each reason, never who gave it or what they wrote.
• Security logs and database backups: up to 30 days.

7. Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it;
• rectification of inaccurate or incomplete data;
• erasure, where there is no longer a reason to keep the data;
• restriction of processing in the cases the GDPR provides;
• portability — receive your data in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interest, and at any time to marketing;
• withdraw consent at any time, without affecting processing done before;
• not be subject to a decision based solely on automated processing with legal or similarly significant effects, to the extent Article 22 GDPR applies;
• complain to ANSPDCP, the Romanian data protection authority, or go to court.

To exercise them, write to contact@timenow.ro. We may ask for information to confirm your identity. We answer within one month; for complex requests that can be extended by two more months, and we will tell you if it is. Exercising your rights is free, unless a request is manifestly unfounded or excessive. For booking data, we pass your request to the business, which is responsible for answering it (section 1).

8. Security

We protect data with the measures described in Annex II of the DPA: hosting in the EU, encryption in transit, separation between businesses, role-based access, sign-in with one-time codes, a dedicated secrets manager and pseudonymisation. No system is completely secure; if a breach is likely to put your rights at high risk, you will be told, as the GDPR requires.

9. The WhatsApp booking assistant

A business can turn on an assistant that answers your WhatsApp messages and books for you. It is software, not a person, and runs on a language model from OpenAI. It receives your conversation and the business information it needs to answer; OpenAI does not use data sent through its API to train its models. To monitor quality, conversations are also recorded in PostHog with your phone number replaced by an encrypted token.

The assistant does not make decisions with legal or similarly significant effects on you (Article 22 GDPR): it can do only what you could do yourself on the business's booking page, and the business remains responsible for its bookings.

10. Children

TimeNow accounts are for people aged 16 or over. Bookings for a child should be made by a parent or legal guardian. If you believe a child has given us personal data, write to us and we will delete it.

11. Google API Services — Limited Use

Where the platform accesses Google user data, through the Google Calendar integration or Google Sign-In, our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Changes to this policy

We publish every change on this page, with its date. When a change significantly affects how we use your data, we will also tell account holders by email before it applies.