What data we hold and what we do with it.

This is a translation; the Romanian version prevails. The original is at nuvio.ro/privacy-policy.

1. Who we are and what our role is

Nuvio is operated by DOT KODA DEV SRL. We have two roles, depending on who you are:

• If you have a professional account (the Nuvio app, the web version or pro.nuvio.ro) or an account in the Nuvio app for clients, we are the controller of your account data.
• The client data a professional keeps in Nuvio (client records, notes, appointments) belongs to the professional: they are the controller, and we process it on their behalf, only to provide them with the service.

2. What data we collect

2.1 Professionals

• The account: name, email address, phone number, password (stored only in encrypted form) and verification codes.
• The public profile: name, title, photos, services and prices, locations and their addresses, working hours, contact number and booking link. These are visible to anyone who opens your booking page or looks you up in the app for clients.
• Activity: appointments, clients (name, phone, notes), promotions, takings and expenses, including the photos of receipts you choose to upload.
• The calendar: if you connect it, the busy slots from Google Calendar or from your phone's calendar (see section 6).
• The subscription: the plan, the period, the payment history and the billing details. Card details never reach us: they are processed directly by Stripe or Apple.

2.2 Clients who book on the web (nuvio.ro)

• Your name, phone number and its verification (a code you send on WhatsApp or receive by SMS), the bookings you make, and a key saved in your browser so you don't have to verify your number every time you book.

2.3 The Nuvio app for clients (iPhone and Android)

• The account: you sign in with your phone number and a code received by SMS or sent by you on WhatsApp. We keep your name and phone number, so we can show you your appointments and so the professionals you visit can recognise you. We don't ask for your email address.
• Appointments and notifications: your appointments and the history of messages about them (confirmations, reminders, changes, cancellations, requests accepted or declined), however they were sent.
• Push notifications: an identifier for your phone (a notification token), only if you allow notifications. We delete it when you sign out.
• The waiting list: the days, professionals and services for which you asked to be told when a slot opens up.
• Offers: if you agree to receive offers from a particular professional, we keep your consent, which you can withdraw at any time.
• Location: only while the app is open and only if you allow it, to show you nearby professionals and offers and how far away they are. We don't keep a history of your locations.
• The calendar: the app adds an appointment to your calendar only when you tap “Calendar”. It doesn't read any other events.
• Usage statistics: which screens and steps you use (for example a search or a booking you started), linked only to the account's internal identifier, without your name or phone number. You can turn them off in Profile → “Usage statistics”.

2.4 Data collected automatically

• Technical data: IP address, device type, operating system, app version, access logs and error logs.
• On the website: strictly necessary cookies and, only if you accept them in the cookie banner, statistics cookies and advertising measurement cookies.

3. Why we use the data and on what legal basis

• To make the service work (contract): appointments, the booking page, notifications about appointments, the subscription.
• To keep the service secure and improve it (legitimate interest): preventing abuse (for example the limit on searches by phone number), troubleshooting, usage statistics that you can turn off.
• With your consent: statistics and advertising cookies on the website, push notifications, location, offers from professionals.
• Legal obligations: invoicing and accounting records.

4. What messages we send

• In the app for clients: a push notification and an in-app message for every change to your appointments (new appointment, change, cancellation, request accepted or declined), for reminders and for a slot you were waiting for that has opened up. Actions you take yourself don't trigger a notification.
• On WhatsApp: only if the professional is on the Premium plan: reminders before an appointment, confirmation of the appointments they add and of accepted requests. If you have the app, you get the push notification first, and the WhatsApp message is sent only if you don't open it in time.
• By email: we don't send emails to clients. We may send professionals emails about their account and subscription.
• We don't send advertising and we don't sell anyone's data.

5. Who we share the data with

We use providers that process the data only for their service and only on our instructions:

• Supabase: hosting of the application and the database, in the European Union (Frankfurt).
• Meta Platforms (WhatsApp Business): WhatsApp messages and phone number verification.
• Google: SMS verification codes (Firebase), address search on the map (Google Maps) and, if you connect it, Google Calendar.
• Expo, Apple and Google: delivery of push notifications.
• OpenAI: reading the photo of a receipt, only when the professional chooses to send it.
• Stripe and Apple: subscription payments. Oblio: issuing invoices.
• SendGrid: emails to professionals.
• PostHog: usage statistics from the apps and the website, with data stored in the European Union.
• Google Ads and Meta: measuring advertising on the website, only if you accept these cookies.
• Public authorities, only when the law requires us to.

Some of these providers may process data outside the European Economic Area. In those cases the transfer is based on the European Commission's standard contractual clauses or on the EU–US Data Privacy Framework.

6. The connected calendar

• If a professional connects their Google Calendar, Nuvio reads the events from the calendars they choose (time, title and description) and keeps them as busy slots, so they can't be booked and so the professional can see them in their Nuvio diary. Nuvio writes its own appointments to a separate calendar called “Nuvio”. This data is visible only to the professional, not to clients, and we don't use it for any other purpose.
• The use of data received through Google APIs complies with the Google API Services User Data Policy, including the “Limited Use” requirements.
• You can disconnect the calendar at any time from the app. When you disconnect it, we delete the slots taken from it.

7. How long we keep the data

• For as long as you have an account. When you delete your account, we delete its data straight away.
• If you delete your account in the app for clients, your appointments stay in the diaries of the professionals you visited (they are part of their records too), but they are no longer linked to your account.
• If a professional deletes their account, we also delete their client data and appointments.
• We keep invoices for as long as accounting law requires.

8. Security

• Data travels encrypted (TLS) and is stored encrypted, in the European Union. We use technical and organisational measures to limit access to it, and we review them regularly.

9. Your rights

• You can ask for access to your data, for it to be corrected, deleted or restricted, you can object to its processing and you can ask for data portability.
• You can withdraw any consent you have given (notifications, location, offers, cookies) at any time, without affecting what was done before.
• For the data in your record with a professional, you can contact them or us, and we will pass your request on to them.
• Write to us at office@dotkoda.com. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (dataprotection.ro).

You can delete your account at any time from the app or on request, following the steps at nuvio.ro/en/delete-account.

10. Minimum age

Nuvio is not intended for people under 18.

11. Changes to this policy

We publish any change here and update the date above. For important changes we will also let you know in the app.

12. Contact

Email: office@dotkoda.com
Postal address: Str. Uzinei nr. 13, Timișoara, Romania