Privacy Policy

Boona ("we," "our," or "us") operates the Boona website (https://boona.app) and mobile applications. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our salon booking platform.

When you visit our website and use our services, you trust us with your personal information. We take your privacy very seriously. In this privacy notice, we describe our privacy policy. We seek to explain to you in the clearest way possible what information we collect, how we use it and what rights you have in relation to it.

Boona (boona.app) is developed, owned and operated by Boona App S.L., a company registered in Spain, NIF B60494408, registered office: Urb. El Saladillo, Edificio Altair, Oficina 101, 29688 Estepona, Málaga, Spain. Contact: contact@boona.app.

• Salons using Boona: for account, subscription and billing data, Boona App S.L. is the controller.
• Clients of salons: for the data a salon keeps about its own clients — names, phone numbers, appointments, notes — the salon is the controller, and Boona App S.L. processes it on the salon's behalf as a processor.

Where data is processed. Boona App S.L. is registered in Spain, in the European Union. Salons registered in an EU or EEA country keep their data on servers inside the EU: the regional server in Sweden, with the central systems in Germany. Accounts registered in Russia or Belarus are stored on a server in Belarus, outside the European Economic Area. Where personal data of people in the European Economic Area is transferred outside it, the transfer relies on the European Commission's Standard Contractual Clauses or another safeguard permitted by law.

To have your data deleted, see how to delete your data.

When a salon that uses Boona turns on WhatsApp notifications, Boona sends that salon's clients transactional messages — appointment confirmations, reminders, changes and cancellations — through the WhatsApp Business Platform operated by Meta Platforms Ireland Ltd and WhatsApp Ireland Ltd. Each salon connects its own WhatsApp Business number.

• Data shared: the recipient's phone number and name, and the details of the appointment the message is about.
• Meta's role: Meta acts as a processor and service provider for delivering these messages. (WhatsApp Business Policy)
• Consent: a client receives WhatsApp messages only after giving the salon their phone number and agreeing to be contacted on WhatsApp.
• Stopping messages: reply STOP to any message, or ask the salon, and no further WhatsApp messages will be sent.

We collect personal information that you voluntarily provide to us when registering at the Services, expressing an interest in obtaining information about us or our products and services, when participating in activities on the Services or otherwise contacting us.

Personal Information You Provide

• Account Information: Name, email address, phone number when you register
• Appointment Data: Service preferences, booking history, salon selections, and appointment notes
• Communication Data: Messages exchanged with salons through our platform

Automatically Collected Information

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: App interactions, features used, and access times
• Push Notification Tokens: Firebase Cloud Messaging (FCM) tokens to send appointment reminders
• Location Data: Approximate location (when permitted) to show nearby salons

We use the collected information to:

• Facilitate appointment booking between you and beauty salons
• Send appointment confirmations and reminders via push notifications
• Enable salons to contact you regarding your bookings
• Improve our platform and develop new features
• Provide customer support
• Detect and prevent fraud or abuse

We share your information only in the following circumstances:

• With Salons: When you book an appointment, the salon receives your name, contact information, and appointment details to provide their services
• Service Providers: Third-party companies that help us operate our platform (hosting, analytics, push notifications). Emails are delivered through Amazon Web Services (Amazon SES, Frankfurt, Germany), with Resend as a backup.
• Legal Requirements: When required by law or to protect our rights
• Support conversations: When you write to us through the Help window or by e-mail, your messages reach our team in Telegram, and Claude, an AI assistant by Anthropic, helps us draft answers — a person reviews every reply before it is sent. Message texts are deleted 24 months after the conversation is closed; copies in Telegram are deleted on request.

We do not sell your personal information to third parties for advertising purposes.

We retain your personal information for as long as your account is active or as needed to provide services. Appointment history is retained for your convenience and salon operational needs. You may request deletion of your data at any time (see Section 9).

We implement appropriate technical and organizational measures to protect your information:

While we strive to protect your information, no method of transmission over the internet is 100% secure.

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update inaccurate or incomplete data
• Deletion: Request erasure of your personal data
• Portability: Receive your data in a structured, machine-readable format
• Opt-out: Disable push notifications in your device settings

To exercise these rights, contact us at privacy@boona.app.

"We believe that data privacy is a fundamental human right. Regardless of where you operate your salon, we strive to provide the same high level of protection for all our users."

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

A master (a specialist working in a salon) can connect their own Google Calendar to Boona. This section explains what Boona does with the Google user data it receives when they do.

• What Boona accesses. Boona creates one calendar of its own in the master's Google account, named after the salon, and adds, changes and deletes the salon's appointments only in that calendar. It reads only the free/busy times of the calendars the master chooses, never the titles, descriptions, attendees or locations of their events. If the master chooses calendars other than their main one, Boona also reads the list of their calendars' names. It reads the Google account's e-mail address and ID to recognise the account.
• Why. To show the master's appointments in their own calendar, and to stop clients booking them online at times when they are busy.
• Who sees it. Busy times appear to the salon's staff as "Busy" in the salon's journal, without any details. Nothing from the master's calendar is shared with clients.
• Storage and security. The access Google grants is stored encrypted on Boona's servers in the European Union (Germany). Busy times are kept only while they are in the future and are deleted within a day after they end.
• Deletion. When the master or the salon disconnects the calendar, Boona deletes the calendar it created from the master's account, revokes the access and deletes everything it kept about the connection. Access can also be revoked at any time at myaccount.google.com/permissions.
• No other use. Boona does not use Google user data for advertising, does not sell it, and does not use it to train AI or machine-learning models. People at Boona read it only with the master's consent for support, for security, or where the law requires it.

Boona's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Calendar links. A master can also turn on a personal calendar link: a subscription address for Apple Calendar, Outlook and other apps. Anyone who has the link can see the master's appointments, so it is kept secret, and the master can replace it at any time, which stops the old one from working. A master can also give Boona the link of another calendar of theirs (for example iCloud, Outlook or Yandex); Boona reads it only for busy times, stores it encrypted and deletes it when the master removes it.

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email. The "Effective Date" at the top indicates when this policy was last revised.

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: privacy@boona.app
• Website: https://boona.app