Privacy Policy

The operator of the service and the data controller for the data described in this policy is TFJ, Tjaša Fidler Jasnič s.p., Mokrška ulica 51F, 1000 Ljubljana, Slovenia (registration no. 8492174000, tax no. 63256452; contact: info@tibobooking.com) (“we”, “us”). Send privacy questions and requests to the contact address above.

Two roles apply. For the personal data of a shop's customers (booking details, chats with the shop's assistant, and the appointment messages sent for the shop) the shop is the controller and we act as its processor, as set out in section 8 of our Terms of Service. For the personal data of shop owners and their staff who use Tibo (account, settings, owner assistant), and for running and securing the service, we are the controller.

Booking details you enter: your name, email address and/or phone number, and the service, staff member, date and time you choose.

If you message TIBO, the AI assistant on a shop's page: the messages you send and TIBO's replies, a running summary of longer conversations, the temporary state of a booking being arranged, and any specific fact or preference (such as a preferred staff member) you or the shop ask it to remember for next time. A random identifier is stored in your browser so the conversation can continue (see section 7).

Text messages (SMS): the phone number you gave when booking, so appointment messages can be sent to it, and — if you opt out — a record of that number so we do not text it again (section 4).

Shop owners: account email and login credentials (handled by our authentication provider), the shop profile (shop and company name, contact email and phone, address, website), services, prices, staff names and photos, opening hours, notes an owner writes about a customer, the owner's own conversations with the assistant, escalated support cases (a customer's name, email, phone and recent messages), messages an owner sends us through Settings, and data export or deletion requests. Shop and staff photos are stored in a publicly readable storage bucket, so anyone with the link can view them.

If a shop owner connects Google Calendar: see section 6.

AI usage records: which model was used, token counts and cost per request. These do not contain the message text.

Technical data needed to run the service safely: your IP address, which is used for short-term rate limiting to prevent spam and held in server memory rather than saved to our database, and the request logs that our hosting provider generates.

To create and manage your appointment and let the shop contact you about it: performance of the booking you request (contract), carried out for the shop.

To send confirmations, reminders, cancellation and reschedule notices by email and, where available, SMS: performance of the booking (contract).

To let TIBO answer customers' questions and arrange bookings, and to keep conversation history, summaries and remembered preferences so a returning customer gets a more personal experience: the shop's legitimate interest in handling customer enquiries efficiently and, where the chat is used to make a booking, performance of that booking.

To provide shop owners with their account, dashboard, owner assistant and any Google Calendar connection they choose: performance of our contract with the shop owner.

To keep the service secure and prevent abuse (rate limiting, access controls): our legitimate interest.

We do not use personal data for advertising, we do not sell it, and we do not use it to build advertising profiles.

A shop can have appointment text messages sent to its customers through Tibo: booking confirmations, cancellations, reschedules and reminders. They are sent on the shop's behalf. SMS is sent only when the shop's plan includes it and SMS sending is enabled for the service, so we cannot promise that any particular shop's customers receive SMS; where an email address was given, the same notices also go by email.

Each message names the shop and the appointment time and contains a link to manage the booking and a link to opt out. The sender shown on your phone is “TiboBooking”. It is a one-way sender: you cannot reply to it, and replying STOP does not work.

To opt out, open the opt-out link in any message and confirm. Your number is then added to a suppression list and Tibo will not send further SMS to it, for any shop. We keep that record for as long as needed to honour the opt-out.

We send only these transactional appointment messages. We do not send marketing SMS.

Twilio delivers the messages and therefore processes the phone number and message text as our processor. When a customer's conversation is escalated to the shop, the shop is notified first by email, which includes the customer's contact details and recent messages. If that email cannot be sent, an alert SMS can instead be sent to the shop's published business phone number; it can include the customer's name (or phone or email) and a short reason.

TIBO is an AI assistant. It answers customers on a shop's public page and helps shop owners in their dashboard. To generate a reply, the message and the context needed to answer it are sent to Anthropic: the conversation so far (a limited number of recent messages plus a running summary), the shop's own information (services, prices, staff, hours, policies), any remembered facts about the customer, and the results of actions TIBO takes, such as availability or a customer's bookings. For shop owners it can also include business data such as bookings, customers and analytics, and, for owners who have connected Google Calendar, event details and free/busy times when the owner asks TIBO about their schedule.

We store the resulting data in our database: conversation transcripts and summaries, task state, and “memories” (short facts or preferences about a customer such as a preferred staff member). Section 10 explains how long.

Anthropic is a US-based provider and acts as our processor. Sending data to it is a transfer outside the EEA (section 9).

AI replies can be wrong, so check the confirmation you receive for your booking.

A shop owner can optionally connect a Google Calendar. Nothing from Google is accessed unless the owner connects it, and the owner can disconnect it at any time in Settings, which revokes the access at Google and deletes the tokens we hold.

Scopes requested (Calendar only): https://www.googleapis.com/auth/calendar.events, https://www.googleapis.com/auth/calendar.freebusy and https://www.googleapis.com/auth/calendar.calendarlist.readonly.

What we do with it, only to provide this feature to that owner: we create, move and delete events that mirror bookings and read events and free/busy times so availability matches the calendar. Booking confirmation, rescheduling and cancellation emails to customers are sent through our email provider (section 8), not through any Google account.

What we store: the connected Google address, the scopes granted and the access and refresh tokens, which are encrypted at rest (AES-256-GCM). We do not keep a copy of the calendar. Event details are fetched when the owner asks or when availability is checked and, to generate the assistant's answer, may be sent to Anthropic (section 5); the assistant's replies, which may quote or summarise them, are stored with the conversation.

We do not currently offer a Gmail integration and request no Gmail access. A few shop owners connected Gmail before we withdrew it; those connections are inactive: we call no Gmail API with them and read no email. Their encrypted tokens stay stored until the owner disconnects Gmail (at any time in Settings, which revokes the access at Google and deletes the tokens) or deletes the account.

Tibo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In line with that, we use Google user data only to provide and improve the user-facing feature described above; we do not use it for advertising, do not sell it, and do not use it to develop, improve or train generalized AI or machine-learning models. It is transferred only to our processors as described in this policy, as needed to provide the features, for security, or to comply with law. Our staff do not read it, except with the owner's consent, where needed for security or to investigate abuse, or where the law requires.

We use only strictly necessary and functional storage. There are no advertising, analytics or third-party tracking cookies.

Cookies: “locale” (your chosen language, one year); “cookie_consent” (your choice on the cookie notice, one year); login session cookies with names starting “sb-”, set by our authentication provider Supabase for shop owners after login; “active_shop_id” (which shop an owner is managing, one year); and “tibo_oauth_nonce” (a short-lived security token, five minutes, only while an owner connects Google Calendar).

Browser local storage: on a shop's public page, a random customer identifier and a conversation identifier so TIBO can continue your conversation, and your light/dark theme choice.

The shop you book with, so it can prepare for and honour your appointment.

Providers that process data on behalf of the shop and of us as sub-processors: Vercel (hosting; runs the application and therefore handles booking data while serving each request); Supabase (database, file storage and owner login); Resend (transactional email (booking confirmations, reminders, cancellations and alerts to shop owners)); Twilio (SMS delivery); Anthropic (AI model provider that generates TIBO's replies); Google (Google Calendar, only for shops that connect it). The same list appears in section 8 of our Terms of Service.

Our processors act under contract and may not use your data for their own purposes. We do not sell your personal data.

Anthropic and Twilio are US-based providers, Twilio is used through its global endpoint without an EU-only option, Google operates globally, and Vercel and Resend may also process data outside the EEA. Where data goes outside the EEA we intend to rely on appropriate safeguards.

Booking records: the customer's name, email and phone number on an appointment are replaced with anonymised placeholders 12 months after the appointment ends, by a job that runs daily. The date, service and staff of the visit remain so shops keep their statistics. This applies to bookings only.

Chat transcripts and summaries, the state of bookings in progress, support cases (including names, contact details and recent messages), shop owners' notes about customers, AI usage records, and the SMS opt-out list: there is currently no automatic deletion. They are kept while the shop's account is active and are deleted when the shop's deletion request is carried out, or earlier on request.

AI memories about a customer: a memory is removed after 12 months with no activity, by a scheduled job.

Shop owner account data (login, shop profile, services, staff, hours, photos): kept while the account exists and deleted when the owner's deletion request is carried out.

Google connections: the tokens are deleted when the owner disconnects.

We know several of these data types ought to have fixed deletion periods and we intend to add them.

You can ask to access, correct, delete, restrict or export your personal data and object to certain processing, and you may complain to your supervisory authority — in Slovenia, the Information Commissioner (Informacijski pooblaščenec).

Customers: you can ask the shop you booked with, or contact us using the details in section 1, and we will assist the shop in handling your request. Shop owners: use the data export and deletion requests in Settings. Each request is logged and handled by us manually; there is no automated export or deletion yet. The GDPR deadline for responding is one month.

Access to the database is restricted to our server using secret keys that are never exposed to your browser, row-level security is enabled on the tables, traffic is encrypted in transit, and Google access tokens are encrypted at rest. No system is perfectly secure, but we take reasonable measures to protect your data.

We may update this policy; the date at the top shows the latest revision. For questions or requests, use the contact details in section 1.