Privacy Policy

Last updated: August 2026

This Privacy Policy describes how Iveno ("we", "us", "our") collects, uses, and protects personal data when you use our appointment booking platform at iveno.io and related services (the "Service").

1. Data controller

Iveno is the data controller for account and platform data. Contact: legal@iveno.io.

When a business uses Iveno to accept bookings, that business is the data controller for its customers' booking data. Iveno processes that data on the business's behalf as a data processor.

2. Information we collect

Business account data: When you register, we collect your business name, email address, password (stored as a cryptographic hash), timezone, currency, and optional booking page slug.

Booking data: When end customers book appointments through a business's booking page, we collect the information they provide, typically name, phone number, email address, selected service, appointment time, and payment details processed via Stripe.

Usage and technical data: We collect server logs including IP address, browser type, request timestamps, and session identifiers necessary to operate and secure the Service.

3. How we use your information

• To provide, maintain, and improve the Service
• To process bookings, payments, and send transactional emails (confirmations, reminders, verification, password reset)
• To authenticate admin users and maintain session security
• To respond to support requests and legal obligations
• To detect and prevent fraud, abuse, and security incidents

We do not sell personal data to third parties.

4. Third-party processors

We use the following subprocessors to deliver the Service:

• Stripe: payment processing. Stripe's privacy policy applies to payment card data handled by Stripe.
• Resend: transactional email delivery (confirmations, reminders, account emails).
• Hosting infrastructure: our servers and database providers that store application data.

Each subprocessor is bound by data processing agreements appropriate to their role.

5. Data retention

Account data is retained while your subscription is active and for a reasonable period afterward to comply with legal obligations and resolve disputes. Booking records are retained according to the business's account settings and applicable law. Session tokens expire automatically; password reset and email verification tokens expire within 24 hours and 1 hour respectively.

6. Security

We implement technical and organizational measures including encrypted connections (TLS), password hashing (scrypt), hashed session tokens, tenant isolation via row-level database security, and access controls. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security.

7. Your rights (GDPR and other jurisdictions)

If you are located in the European Economic Area or UK, you have rights under the GDPR / UK GDPR with respect to your personal data. Depending on your jurisdiction, similar rights may apply elsewhere. These include the right to:

• Access: obtain a copy of the personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your personal data ("right to be forgotten")
• Restriction: limit how we process your data in certain circumstances
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests, including profiling
• Withdraw consent: where processing is based on consent, at any time, without affecting prior lawful processing
• Lodge a complaint: with your local data protection supervisory authority

Business account holders may exercise these rights by contacting us at legal@iveno.io; we respond within the timeframe required by applicable law. End customers should contact the business they booked with for requests relating to their booking data; that business is the data controller for it, and we will assist businesses in fulfilling such requests.

8. International transfers

Data may be processed in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers.

9. Children

The Service is not directed at children under 16. We do not knowingly collect data from children.

10. Changes

We may update this policy from time to time. Material changes will be communicated via email or a notice on the Service. Continued use after changes constitutes acceptance.

11. Contact

Questions about this Privacy Policy: legal@iveno.io