Privacy Policy
Last updated: August 29, 2026
1. Who we are
[COMPANY NAME], a company registered in Bulgaria under company number [NUMBER], with registered address [ADDRESS], operates the [PLATFORM NAME] platform ("we", "us", "the platform").
We are the data controller for the personal data described in this policy.
For any questions about your data, or to exercise any of the rights described below, contact us at [CONTACT EMAIL].
2. What data we collect
When you create an account
- Email address
- Password (stored only as a cryptographic hash — we never see or store your actual password)
- Display name
- Your role (client or practitioner)
- Language and display preferences
If you are a practitioner, additionally
- Profile information you choose to provide: biography, headline, location, profile photo, cover image, username
- The practices and topics you offer
- Your timezone and working hours
- Services you list: name, description, duration, price, how sessions are delivered
- For in-person or telephone services: the address or phone number you provide (shown only to clients who have a confirmed booking with you)
- Your Stripe account identifier, so payments can be routed to you
When you book a session
- Which service, with which practitioner, at what time
- A record of the service as agreed at the time of booking (name, price, duration, delivery method) — kept so that later changes by the practitioner don't alter what was agreed with you
- Booking status and any cancellation, including who cancelled and any note they added
When you pay
- The amount, currency, and references identifying the transaction with our payment provider
- We never receive or store your card details. These are handled entirely by Stripe.
When you leave a review
- Your rating and any text you write
- Reviews are shown publicly, and to the practitioner, without your name — identified only as a verified user
When you or your practitioner attach a document to a session
Some practitioners offer file exchange for their services. Where they do, you and the practitioner can each attach one document to a booking — a PDF, Word file or text file.
- We do not inspect the contents. Whatever you upload is yours; we store it and make it available to the other party to that booking, and to nobody else.
- Only the two of you can see it. Access is enforced at the database level. Files are stored privately and served through links that expire after one minute.
- Files are deleted permanently 14 days after the session ends. Both of you are warned a few days beforehand.
- A record of the exchange remains after the file is gone — that a document was attached, by whom, when, its name and size. Not its contents. This is so either of you can later see that something was exchanged.
Share only what the session actually needs. Please don't upload anything you wouldn't want stored, and remember the file is deleted after 14 days.
When you contact us
- Your name, email address, the category of your enquiry and your message. This is sent to us by email and is not stored in our database.
Automatically
- Technical information necessary to operate and secure the service, including your IP address for rate limiting and abuse prevention
- Essential cookies (see section 8)
Planned but not yet in use: video sessions held on the platform. When introduced, we will record who joined a session and when, in order to establish whether a session took place — this is used for refunds where one party did not attend. We will update this policy before that feature launches.
3. Why we use your data, and on what basis
| What for | Why | Legal basis |
|---|---|---|
| Creating and running your account | To give you access to the service | Performance of a contract |
| Showing practitioner profiles publicly | So clients can find and choose a practitioner | Performance of a contract; legitimate interest in operating a marketplace |
| Taking bookings and payments | To deliver the service you asked for | Performance of a contract |
| Sending booking confirmations, reminders and cancellation notices | So sessions actually happen | Performance of a contract |
| Publishing reviews | To help clients make informed choices | Legitimate interest |
| Rate limiting, abuse prevention, security | To keep the platform working and safe | Legitimate interest |
| Keeping records of transactions | Required by tax and accounting law | Legal obligation |
| Sending marketing emails | Only if you have asked to receive them | Consent |
| Analytics (planned, not yet in use) | To understand how the platform is used | Consent |
For the lawyer: the legal bases above are our understanding, not a settled legal position. Please confirm or correct — particularly around publishing practitioner profiles and reviews.
4. Who we share your data with
We do not sell your data. We share it only with the service providers we need to operate:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Frankfurt, Germany) |
| Vercel | Website hosting | EU (Frankfurt, Germany) |
| Stripe | Payment processing and payouts to practitioners | EU / international |
| Resend | Sending transactional email | US |
| Upstash | Rate limiting (IP addresses only) | EU |
| LiveKit (planned) | Video sessions | [CONFIRM] |
A note about Stripe. Stripe acts as a separate data controller for the identity and banking information it collects from practitioners in order to make payouts. That information goes to Stripe directly and we do not hold it. Stripe retains it under its own obligations, and deleting your account with us does not remove it from Stripe.
Between users. When you book a session, the practitioner sees your name and the details of that booking. If the session is in person or by telephone, you receive the address or phone number the practitioner has provided. Reviews are shown publicly without your name.
5. International transfers
Our database is hosted in the EU. Some providers listed above operate outside the EU. Where that is the case, transfers are made under the safeguards those providers have in place — [LAWYER: confirm mechanism, likely Standard Contractual Clauses].
6. How long we keep your data
| Data | Kept for |
|---|---|
| Your account and profile | As long as your account is open |
| Bookings | Retained after account deletion, in anonymised form, so the other party's records remain complete |
| Payment and transaction records | As required by Bulgarian tax and accounting law — [LAWYER: confirm period] |
| Reviews | Retained indefinitely, without your name |
| Documents attached to a session | Deleted permanently 14 days after the session ends |
| The record that a document was exchanged | Retained after the file is deleted — filename, size, who and when; never the contents |
| Contact form messages | In our email, deleted when no longer needed |
7. Your rights
You can:
- Access your data — download everything we hold about you, including any documents you've attached to sessions, from your account settings
- Correct it — edit your profile at any time
- Delete your account — from your settings. See below for what this means in practice.
- Withdraw consent — turn off marketing emails at any time, in settings
- Object or restrict — contact us
- Complain — to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), or the authority in your country of residence
What deleting your account actually does. Your login is disabled and your personal details are removed from your profile. Any documents you attached to sessions are deleted, though the record that a document was exchanged remains — its name, size and date, no longer linked to you — so the other party keeps a complete record of their own history. Past bookings remain, but with your name replaced — this is so the practitioner or client you dealt with keeps a complete record of their own history. Reviews remain, as they never carried your name. Transaction records are kept where tax law requires it, no longer linked to your identity.
You cannot delete your account while you have upcoming bookings. Cancel or complete them first.
8. Cookies
We use only what is necessary to make the site work: keeping you logged in, remembering your language, and remembering whether you prefer the light or dark theme. These do not require your consent.
We do not currently use analytics or advertising cookies. If we introduce them, we will ask for your consent first, and you will be able to decline without losing access to anything.
You can change your cookie choices at any time from the link in the footer.
9. Children
The platform is not intended for anyone under 18, and we do not knowingly collect data from children.
10. Changes
If we change this policy we will update the date at the top. For anything significant, we will tell you directly.