Privacy Policy

1. Who we are

SharelyApp is operated by Alexteh Solution SRL, M. Lermontov 8, apt. 1, Balti, Moldova (IDNO 1009602004114, D-U-N-S 535205387) (“we”, “us”). We are responsible for the personal data described in this policy, except where we say we act on behalf of an owner.

For anything about privacy or your data, write to [email protected].

2. What this policy covers

This policy explains how we handle personal data when you use the SharelyApp apps for iPhone and Android, the SharelyApp web app, the booking pages and booking widgets, our integrations, and this website. It applies to:

Owners: people who use SharelyApp to take and manage their own appointments;
Customers: people who book, or ask to book, an appointment through a booking page;
Contacts: people whose details an owner adds to an appointment by hand;
Visitors to this website and anyone who contacts us.

It doesn’t cover how an owner runs their own business outside SharelyApp, or third-party services such as Google, Apple or the AI chat apps an owner connects, which have their own policies.

3. Our role: controller and processor

We are the controller of owners’ account data, customers’ sign-in accounts and profiles, billing records, website and support data, and the data we use to keep SharelyApp secure.
Each owner is the controller of the data in their work profiles about their customers and contacts: appointments, requests, customer lists and the messages sent about them. We are their processor and handle that data only on their instructions, under our Data Processing Terms.
If you booked with a business and want to know how it uses your details, or want them changed or removed from its records, contact the business. We will help where we can.

4. The data we collect

Owners

Account: email address, phone number, profile photo, language, and your sign-in methods: the email code, passkeys (we keep only the public key and device-generated identifiers, never your fingerprint or face data) and the account IDs of Google, Apple or Facebook if you sign in with them.
Work profiles: business name, line of work, description, logo, country, time zone, currency, languages, business phone and email, address, website and social links, and which of these you choose to show publicly.
Scheduling: services with photos, durations and prices, working hours, time off, approval settings, appointments and requests, and settings for notifications, reminders and messages.
Customers and contacts you manage: the names, phone numbers and emails you enter or that customers give when booking, appointment details and notes, can’t-attend notices, and whether you trust or block a customer.
Billing: your plan and trial status, App Store transaction and product identifiers, an anonymous account token that links purchases to your account, your text message credit balance and usage, and the country of your store account. We never receive your card details.
Integrations: Google Calendar connection details and access tokens, your private calendar link, and the AI chat apps you connect with the permissions you gave them.
AI assistant: the instructions you type and the drafts produced.
Messages: records of emails and text messages sent for your work profiles, their delivery status and credits used.

Customers

Account: your sign-in email, or your Google account ID, name, email and profile photo if you sign in with Google; your name, phone number, language and email preferences.
Bookings: the services and times you request or book, the business you book with, their status, and any can’t-attend notice you send.
Messages: records of the emails and text messages sent to you about your appointments.

Everyone

Technical data: IP address, device and browser type, app version, language, and timestamps, used for security, rate limits and fixing errors. We keep request logs limited to operational details.
Support: what you write to us and our replies.

5. Where the data comes from

From you, when you sign up, fill in your profile, book, or contact us.
From owners, when they add you to an appointment or their customer list.
From sign-in providers, when you choose to sign in with them: Google gives us your account ID, name, email (and whether Google verified it) and profile photo; Apple gives us an account ID and your name and email, or a private relay address if you choose to hide it; Facebook, where offered, gives us your Facebook user ID, name, email and profile photo.
From Apple, when you buy a subscription or credits: signed transaction details, without your payment details.
From your phone, only when you choose a contact to fill in an appointment: we use the name, phone and email you pick, and never upload your address book.
Automatically, from your device and browser when you use the Service.

6. How we use data, and our legal bases

Purpose	Legal basis
Creating your account, signing you in and keeping you signed in	Performing our contract with you
Providing the scheduling features: booking pages, availability, requests, appointments, customer lists, working hours, notifications and calendar sync	Performing our contract with you; for customer data, the owner’s instructions
Letting customers book, and sending them sign-in codes and emails about the status of their booking	Performing our contract with the customer
Sending the reminders and notices an owner chooses to send	The owner’s instructions, on the owner’s legal basis
Billing, free trials and text message credits, including keeping pseudonymous records that limit repeated free trials	Performing our contract; our legitimate interest in preventing abuse; our legal obligations for accounting records
AI features you choose to use	Performing our contract with you, at your request
Security, preventing fraud, spam and abuse, rate limits and honouring opt-outs	Our legitimate interest in a safe Service; legal obligations
Support and service messages, such as security notices or changes to our terms	Performing our contract; our legitimate interest
Understanding and fixing errors and improving the Service	Our legitimate interest, using the minimum data needed
Complying with the law and responding to lawful requests	Legal obligation

We don’t use personal data for advertising, we don’t sell it, and we never market to the customers of businesses that use SharelyApp. If we tell owners about new SharelyApp features, we do so only as the law allows, and you can unsubscribe at any time.

7. What is public on a booking page

An owner’s booking page can be seen by anyone with its address. It shows the business name, logo, line of work, description, services with photos and prices, available times, languages and the website and social links the owner adds.

The owner’s address, phone number and email appear only if the owner switches each one on. An owner’s personal account details are never shown. Customers’ details are never shown on a booking page.

8. AI features

When an owner uses the AI assistant, we send OpenAI the owner’s instructions and the details the draft needs: the business name, languages, services, prices, reminder texts and working hours. We don’t send customer, contact or appointment data. We ask OpenAI not to store our requests for later use, and under its API terms such data is not used to train its models. Instructions and drafts are stored encrypted in our systems and never written to our logs.

When an owner connects an AI chat app such as ChatGPT or Claude, that app can read, and if the owner allows it change, the owner’s SharelyApp data, including appointments and customer details, when the owner asks it to. That data then goes to the chat app’s provider under the owner’s own agreement with them. Owners can see and disconnect their connected chat apps at any time in SharelyApp.

Owners and customers: when a customer books, the owner sees the customer’s name, phone number, email and their appointments with that owner. Customers see the owner’s booking page and their own appointments.
Service providers that help us run SharelyApp, listed below. They may use the data only to provide their service to us, under contracts that protect it.
Services you connect, such as Google Calendar, a calendar app using your private link, or an AI chat app. We send them what you asked us to.
Authorities and others, where the law requires it, or where it is necessary to protect the rights, safety or property of our users, the public or us.
A buyer or successor, if SharelyApp is reorganised, merged or sold, under this policy.

Provider	What for	Data	Location
Cloud infrastructure provider	Runs our servers, databases, file storage and backups	All data described in the Privacy Policy	Available on request
Cloudflare	Delivers our website and booking pages, DNS and protection against attacks	IP address, browser and request details	Global network
Amazon Web Services (Amazon SES)	Sends emails: sign-in codes, booking emails and reminders	Email address, the email’s content	Frankfurt, Germany (EU)
sms.md	Sends text messages to Moldovan numbers and phone verification codes	Phone number, the message’s content	Moldova
Twilio	Sends text messages to numbers outside Moldova, where that is enabled	Phone number, the message’s content	United States
OpenAI	Generates AI drafts and suggestions when you use the assistant	Business name, languages, services, prices, working hours and your instructions. No customer or appointment data	United States
Google	Sign in with Google; Google Calendar export if you connect it	Name, email, Google account ID, profile photo; the appointments you export	United States and others
Apple	App Store subscriptions and purchases; Sign in with Apple when it is offered	Purchase and transaction identifiers; name and email (or a private relay address)	United States and others
Meta	Facebook Login, where it is offered	Name, email, Facebook user ID, profile photo	United States and others

10. International transfers

We are based in the Republic of Moldova, and some of our providers process data in other countries, including the United States. When personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on safeguards the law recognises, such as the European Commission’s Standard Contractual Clauses or, for certified U.S. providers, the EU-U.S. Data Privacy Framework.

11. How long we keep data

Owner accounts and work profiles: until you delete them. Deletion takes effect immediately; service photos are removed by a cleanup process within minutes.
Customer accounts: until the customer asks us to delete them.
Appointments and customer lists: until the owner deletes them, the work profile or the account.
Records of sent emails and text messages: for a limited period after sending, to confirm delivery, handle complaints and prevent abuse. The recipient is stored encrypted.
Opt-outs and undeliverable addresses or numbers: for as long as needed to keep respecting them.
Billing records: for as long as needed for accounting, tax and refund handling, and as the law requires. After an account is deleted we keep only purchase identifiers, quantities and dates, without your email, phone or business data.
Free trial records: keyed, pseudonymous records of verified emails, phone numbers and sign-in accounts, for a limited period after a trial starts or an account is deleted, so the same person can’t repeat free trials.
Security and audit logs: for a limited period, holding account or business IDs rather than names or contact details.
Backups: deleted data can remain in encrypted backups until they expire in the normal backup cycle.

12. How we protect data

All connections to SharelyApp are encrypted in transit.
Names, emails, phone numbers, addresses, appointment titles and notes, social links and sign-in provider IDs are encrypted in our database with a separate key.
No passwords: sign-in uses one-time codes, passkeys or trusted providers, and sensitive actions such as deleting an account require a recent sign-in.
On phones, your sign-in token is kept in the system’s secure storage, and saved appointments are stored in protected app storage that is not included in device backups.
Access to production systems is limited to the people who need it.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires. To report a security issue, write to [email protected].

13. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you and get a copy of it;
correct data that is wrong or incomplete;
delete your data;
restrict or object to how we use it, including where we rely on legitimate interests;
receive data you gave us in a portable format;
withdraw consent at any time, where we rely on it;
complain to a data protection authority, such as the National Center for Personal Data Protection of the Republic of Moldova or the authority where you live or work.

Most data you can see, change or delete yourself in the app. For anything else, write to [email protected]. We may ask you to confirm your identity, and we reply within one month. For data an owner keeps about you as their customer, we will pass your request to the owner or help them answer it.

14. Your choices

Owners choose which contact details appear on their booking page, and can hide the page entirely.
Owners choose which reminders, notices and notifications are sent, and can turn them off. Emails about the status of a booking are always sent to the customer.
Customers can unsubscribe from reminder emails using the link in each email. To stop text messages, ask the business; in the United States and Canada you can also reply STOP.
You can remove passkeys, disconnect Google Calendar, turn off your calendar link and disconnect AI chat apps at any time in the app.
You can delete your account at any time. See Data Deletion.

15. Google, Apple and Facebook sign-in

If you sign in with Google, we ask only for your basic profile: account ID, name, email and profile photo. If you connect Google Calendar, we ask only for permission to create a calendar and manage the events in it; we can’t see your other calendars or events.

SharelyApp’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data we receive from Apple or Facebook sign-in is used only to sign you in, keep your account secure and contact you about your account. It is never used for advertising.

You can disconnect a sign-in provider in the app, or delete your account to delete the data we received from it. See Data Deletion. You can also remove SharelyApp’s access in your Google, Apple or Facebook account settings.

16. Automated decisions

SharelyApp works out available booking times from an owner’s settings, and automatically checks whether a new account can start a free trial. Neither has legal or similarly significant effects: you can still use SharelyApp without a trial, and you can contact us if you think a trial was refused by mistake.

17. Children

SharelyApp is not intended for children. Owners must be adults, and customers must be at least 16, or older where local law requires it. If you think a child has given us personal data, contact [email protected] and we will delete it.

18. Changes to this policy

We will update this policy as SharelyApp changes and post the new version here with a new date. If a change is significant, we will also tell owners in the app or by email.

19. Contact

Alexteh Solution SRL, M. Lermontov 8, apt. 1, Balti, Moldova (IDNO 1009602004114, D-U-N-S 535205387). Email: [email protected]. Our full company details are on the About page. You can write to us in English, Romanian or Russian.