AzatTime Privacy Policy

Version 2 · Updated …

1. General provisions

1.1. AzatTime ("we", "the platform") is an online service on which customers find businesses and book appointments, and businesses manage services, staff, schedules and bookings, through the website and the mobile app.

1.2. The operator of personal data is AzatTime, Yerevan, support@azattime.com.

1.3. We process personal data under the Law of the Republic of Armenia "On Protection of Personal Data" and other applicable law.

1.4. By creating an account or using the platform you confirm that you have read this policy. Where the law requires your consent, we ask for it separately.

2. Whose data we process

  • Customers who have an account.
  • People a business booked for without an account. A business can create an appointment for someone who is not registered. The business gives us that person's details.
  • Business owners and staff who hold an account, including people invited by email to join a business as staff.
  • Visitors to the website and app.
  • People who send a business enquiry through our "register your business" form.
  • Platform administrators (our own team).

3. Legal bases

Your consent (marketing, optional cookies, the AI assistant); performing the contract with you (account, bookings, subscriptions); legal obligations (for example accounting records); and our legitimate interest in the security, fair use and improvement of the platform, as far as the law allows.

4. What data we collect

4.1. Account. Full name, email, phone number, password (stored only as a one-way hash), role (customer, business), language, time zone, profile photo if you add one, the date you registered, and the date your email was verified. Your sign-in sessions are stored as hashed tokens with their dates.

4.2. Sign-in with Google or Facebook. If you use it, we receive from them your name and email, and the fact that the account is linked. We never receive your Google or Facebook password.

4.3. Bookings. The business, location, service, staff member, date and time, price and duration at the time of booking, status and its history (requested, confirmed, cancelled, rescheduled, completed, no-show), who made each change, and your time zone. A business may add a note and photos to a completed visit for its own records.

4.4. The customer list kept by a business. When a booking is confirmed, the business receives a record in its own customer list with the name, phone, email and photo from your account, and may add its own notes. For a person booked without an account it holds what the business typed. That record belongs to the business's own service relationship with you.

4.5. Business and staff. Business name, address, photos, services, prices, working hours, staff names and roles, staff invitations (email address and the invitation link), subscription plan, period dates and payment records entered by our administrators.

4.6. Reviews. A customer can review a business, and a business can review a customer, after a completed visit. A review holds the stars or tags, an optional short comment, the date and the author's name. A business's review of a customer shows only the customer's first name and the initial of the surname.

4.7. Favorites. The businesses you save. Only you can see your list. A business sees only how many people saved it, never who. When you remove a favorite it is deleted.

4.8. AI assistant. If you accept the AI notice: your messages, the assistant's answers, the suggestions it makes and your confirmations.

4.9. Marketing choices. Your marketing consent (off until you turn it on), when and where you gave or withdrew it, the version of the wording you saw, and an end date. Registration and booking may also record how you reached us (the source, campaign or referral code in the link), to measure our marketing.

4.10. Business enquiry form. Name, phone, email (optional), business name, city, type of business, message, language and the source of the visit.

4.11. Emails. For every email we send: the address, the template, the status (sent, failed, bounced) and the time. One-time links are removed from our records once the email is final. We keep a list of addresses that bounced or complained so that we do not mail them again.

4.12. Technical data. Your IP address is used in server memory to limit repeated requests and sign-in attempts, and is passed to Google reCAPTCHA when a sign-in check is shown; it is not saved on your account. Cookies: section 9. [Confirm what hosting, server and error logs keep, and for how long.]

4.13. Administrator actions. Whenever one of our administrators changes an account, plan, payment or setting, or opens an AI conversation, we record who, when, what and why. This log cannot be edited or deleted.

5. Why we use data

  1. Create your account, verify your email, keep it secure and sign you in.
  2. Let you search, book, cancel and reschedule, and let businesses run their calendar, customers and staff.
  3. Send service emails: email verification, password reset and "password changed", booking confirmations, reminders and approvals, account and business status. You cannot opt out of these while you hold an account.
  4. Show in-app notifications.
  5. Run subscriptions for businesses and record payments.
  6. Prevent fraud and abuse, limit repeated attempts, protect the platform, and investigate complaints.
  7. Moderate reviews.
  8. Measure and improve the platform, using aggregated figures.
  9. Meet legal obligations.
  10. Send marketing, only within your consent (section 6).

6. Marketing

6.1. We send marketing only if you agreed. There is no pre-ticked box and registering or booking does not count as consent.

6.2. Each marketing message says who sends it, why you receive it and has an unsubscribe link that works without signing in. A business you booked with can send offers only if you agreed to offers from it.

6.3. Consent has a stated purpose, kind of message and end date. After the end date we send nothing until you renew.

6.4. Service emails (section 5.3) are not marketing and are not affected by your choice.

6.5. [Marketing is currently email only.]

7. AI assistant

7.1. The assistant is optional and starts only after you accept the AI notice, for the current version of the notice. If the notice changes, we ask again.

7.2. Your messages are processed by [OpenAI / Anthropic], which is our AI provider and acts on our instructions. We send only what is needed to answer: your messages, your full name, dates and times of bookings, and non-personal catalog data (businesses, services, free times). We never send your phone, email, notes or photos.

7.3. The assistant cannot change anything on its own. A booking is created, cancelled or rescheduled only when you press Confirm, and the business's own rules still apply.

7.4. Conversations are stored in our system. Administrators with the separate "read AI chats" permission can open them (for example for support or abuse review). Each opening is recorded in the administrator log.

7.5. You can withdraw consent at any time; the assistant then stops processing new messages. [Retention period for conversations.]

8. Who receives your data

  • The business you book with: your name, phone, email, photo and booking details. Customers' contact details are visible only to the business they booked.
  • Our processors, which act on our instructions: hosting, email delivery ([Amazon SES / Postmark]), the AI provider (section 7), and Google reCAPTCHA when a sign-in check is shown.
  • Google or Facebook, if you sign in with them (they get the fact of the sign-in).
  • Public pages: a business's public profile, services, prices and reviews are visible to everyone.
  • Authorities, when the law requires.

We do not sell personal data. Where data leaves Armenia, this is done as the law allows, with contractual safeguards. Servers: [country/region].

9. Cookies and similar technologies

9.1. Always on: keeping you signed in, remembering your language and time zone, security, and remembering your cookie choice.

9.2. Optional (only with your consent): analytics and marketing. [Currently none are enabled / list them.] You can change your choice at any time in Cookie settings.

9.3. The Help Centre counts, without identifying you, how often each answer is opened and marked helpful. A search that finds nothing is kept as a short phrase with a daily count, with no account or address, and is deleted after 90 days.

10. Retention and deletion

  • Account: while it exists. An account whose email is never verified is removed after 7 days.
  • Sessions: until they expire or you sign out.
  • Booking history: [period], then deleted or anonymized. A business keeps its own customer list until it deletes the record, subject to our terms.
  • Reviews: when a customer account is closed, the review stays and shows "Former customer".
  • Payment records and the administrator log: kept without change [period required by law]; they are never edited.
  • Marketing consent history: only as long as needed to prove consent [period].
  • Favorites: until you remove them or the business disappears from the platform.
  • Emails: delivery records for [period].
  • A business that is locked for non-payment keeps its data untouched and hidden from search; it returns when payment is recorded.
  • To delete your account write to [privacy email] [or: use Settings]. We delete or anonymize your data unless the law requires us to keep part of it.

11. Security

Encrypted connections; passwords stored only as hashes; one-time links stored hashed or sealed and expiring; sign-in attempt limits and a CAPTCHA check after repeated failures; two-step sign-in for administrators; role-based access for our team; an immutable log of administrator actions; a separate database for each service. No system is perfectly secure. If a breach affects your data we will notify you and the competent authority as the law requires.

12. Your rights

You may ask for access to your data, correction, deletion, restriction or objection to processing, withdraw any consent (marketing, cookies, AI), and ask who received your data. Write to [privacy email]; we answer within the time the law sets. You can also complain to the Personal Data Protection Agency of the Ministry of Justice of Armenia. Withdrawing a consent does not affect earlier lawful processing; deletion may end your access to services and is not possible where the law requires us to keep data.

13. Children

The platform is for people aged [18] and over, or younger with a parent's or guardian's permission. We do not send marketing to anyone under [age]. If we learn that we hold a child's data without permission, we delete it.

14. Changes and validity

We publish changes here with a new date; for material changes we notify you by email or in the app. The policy applies from its publication; earlier versions stop applying when a new one takes effect.

15. Contact

AzatTime, Yerevan, support@azattime.com