Privacy

Vezto (vezto.app) is operated by Phoka Labs, which is the data controller for Vezto accounts, the platform itself, consent records, and the market insights described below. Privacy contact: [email protected].

The business you book with (the salon, studio, clinic, or other business on the page) decides how it uses its own customer file and booking data. For that data the business is the controller and Vezto processes it on the business’s behalf, under the data processing terms in our Terms of use. Ask that business first about a booking, a photo they took, or a note in your file there.

Account: name, email, password (stored as a hash), sign-in provider, and session cookies so you stay logged in. If you add a profile photo, we store that avatar.

Birthdate: every account gives one, to confirm the person is 16 or older. The businesses you book with can see it in their customer list. You can correct it in Account.

Bookings: the service or class, time, business, staff, prices and payment status, addresses you give for a home or travel visit, and messages or confirmations needed to run that booking. If a credit pack is shared, the buyer and the people it is shared with see each other’s names on that pack, and the business sees who used it. Family members a buyer adds by name (for example children) are kept in that business’s customer file, with an email or phone only if the buyer gives one.

Business-held customer files: a business can add walk-in customers, contact details, notes, and a photo. Walk-in photos are stored for that business and shown only to that business’s team in their admin tools — not on the public page and not to other businesses. Vezto does not collect health information.

Sign-in providers: if you continue with Google, Microsoft, or Facebook, we receive the profile those services share (typically name, email, and a picture). Some older accounts used a phone or WhatsApp stand-in instead of email.

Region check: when you open vezto.app we look up which country your internet (IP) address belongs to, only to block access from countries where Vezto is not offered (see the Terms of use). The lookup uses a copy of the DB-IP country database kept on our server; we do not send your address to DB-IP and we do not store the result. IP Geolocation by DB-IP (https://db-ip.com), licensed CC BY 4.0.

Admin assistant: on plans that include Veztito (not Freemium), business admins can use an Anthropic-powered assistant in their dashboard. It can read that business’s agenda, customers, services, and team data, and it can take actions the admin confirms (for example book or cancel). It does not see other businesses. Conversation history is stored for that business’s admin use.

Calendar sync: a team member can connect their own Google Calendar (by signing in with Google and allowing calendar access) or iCloud calendar (with an Apple ID and an app-specific password — never their main Apple password). Vezto then writes that member’s bookings and classes into the calendar they pick (service, time, customer name, phone, email, notes, and location) and reads back only the start and end times of events in the calendars they tick, so those times show as busy. Event titles, descriptions and attendees from those calendars are not stored, and Vezto uses calendar data only to run this sync. The Google access token or app-specific password is stored encrypted; disconnecting deletes it, revokes Google access, and removes the future events Vezto created. Vezto’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Maps and addresses: we use Google Places (and a public geocoder as fallback) to suggest addresses, place a business on a map, estimate travel when a service comes to you, and show a business’s public Google rating and reviews on its page. Your browser may also share a location if you tap “near me”.

Email: we send one-time codes, password-reset links, booking and confirmation mail, and similar product messages. We do not send free SMS login codes. A business may message you on WhatsApp or SMS only if that channel is configured for notifications — that is not a free public SMS service.

Messages and requests: what you write in contact forms, Pioneer access requests, support tickets, and in-app messages, with the contact details you give.

Consent records: what you agreed to or declined (Terms and Privacy notice, market insights, family members you added, and cookie choices), which version, when, and the browser it came from — so we can prove and respect your choices.

Mobile app: if you use the Vezto app, the push-notification token, device name, app version, and language of your device.

To run your account, keep you signed in, take and manage bookings, passes, payments, calendar sync, messages, and the emails the product needs — because it is necessary to provide the service you asked for (performance of a contract, GDPR Art. 6(1)(b)).

To keep invoices, payment and accounting records — because the law requires it (legal obligation, Art. 6(1)(c)).

To keep Vezto secure, prevent fraud and abuse, check the region a visit comes from, fix problems, and produce aggregated statistics about how the product is used — because we have a legitimate interest in running a safe, working service (Art. 6(1)(f)). You can object to this; write to us.

Market insights — only with your consent (Art. 6(1)(a)). If you opt in (when you sign up, or later in Account → Privacy & data), Vezto uses your booking activity — which kinds of businesses, services and classes you book, when, where (business area), how you pay — to understand demand and market trends, and to show businesses anonymised, aggregated insights (for example “Pilates demand in this area is up 20%”). For this analysis your name and contact details are removed and replaced by a one-way code; insights shown to businesses only cover groups large enough that nobody can be identified. We never sell your data or share it with advertisers for this. Saying no changes nothing else, and you can withdraw at any time in Account → Privacy & data; withdrawal stops future use.

To act on what you choose to share: family members you add to a pack, contact forms and requests — so we can do what you asked.

Strictly necessary cookies, set without asking because the site cannot work without them: the signed-in session cookie, short-lived cookies while you complete Google or other sign-in, a language cookie, and the cookie that remembers your cookie choice.

No advertising cookies. The ads on some free business pages are Vezto’s own: another business on Vezto nearby, or Vezto itself. Every visitor sees the same kind of ad, it uses no cookies and no personal data, and we only count how many times each ad is shown and clicked per day.

Analytics — only with your consent (Art. 6(1)(a) and the ePrivacy rules). If you press “Accept” in our cookie banner, Vezto records the pages you open, the site that sent you, your device type, browser and country, under a random id, kept for 13 months. It is Vezto’s own analytics: no third party receives it, and it is not linked to your account or IP address. The banner asks once; “Reject” is as easy as “Accept”, the choice is kept for 6 months and logged in our consent records, and you can change it any time with “Cookie settings” in the footer or in Account → Privacy & data.

We do not use third-party analytics or tracking cookies. Map tiles come from OpenStreetMap, whose servers receive your IP address to deliver them.

The business you book with, and the team members they allow, see the booking and customer data for that business — including walk-in photos they uploaded.

Businesses may see anonymised, aggregated market insights built from people who opted in — never names, contact details or individual bookings of other businesses’ customers.

Service providers who process data for us under contract: database and file hosting, email delivery, payments (Stripe, PayPal, MB Way where used), Google (sign-in, Places, maps, and Google Calendar when a team member connects it), Microsoft or Facebook if you use those sign-in buttons, Apple iCloud when a team member connects their calendar, Anthropic for the admin assistant, Expo for mobile push notifications, and OpenStreetMap map tiles.

Some of these providers are outside the European Economic Area (for example in the United States). Those transfers rely on an EU adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses.

We do not sell personal data. We do not put walk-in photos or another business’s customer file on the public directory.

Account data stays while the account is open; we delete or anonymise it within 90 days after you close it, except what we must keep longer.

Bookings and payment records stay as long as the business and the platform need them to show history and credits, and invoices and accounting records for the period the law requires (in Portugal, generally 10 years).

Market-insight data is used only while your consent lasts; after you withdraw it is no longer included in new analysis.

Consent records are kept while the consent applies and for up to 5 years afterwards, to be able to prove it.

Walk-in photos stay with that business’s file until the business removes them or a valid deletion request is carried out. Admin assistant history is kept for that business’s dashboard until it is cleared or the business is removed.

You can ask to access, correct, or erase your personal data, restrict or object to its use, and receive a copy in a portable format. Where we rely on consent you can withdraw it at any time, without affecting what was done before.

Write to [email protected]. We answer within one month (extendable by two months for complex requests) and may ask you to confirm your identity. Some records (for example a completed payment) may have to be kept.

For a booking, a walk-in photo, or notes a business made, you can also go to that business directly — they hold the customer relationship.

You can complain to a data-protection authority — in Portugal the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt) — or the authority where you live or work.

You must be at least 16 to create a Vezto account. A parent or guardian can add a child to a pack they bought (Family sharing) by name; they confirm they are allowed to, and the child’s name is then kept in that business’s customer file. A business that books minors is responsible for collecting a parent or guardian’s details.

We update this notice when the product or the law changes. The date at the top is the latest version. If a change affects what you agreed to, we ask you again when you next sign in.