Privacy Policy

Effective 6 October 2026. This is the current version; the date changes when the document does.

Tapenda is a customer-management and booking service for solo and micro service businesses: a hairdresser, a tutor, a trainer, a photographer. It lives next to WhatsApp, which means two very different groups of people have data here — the business that signs up, and the clients of that business who never signed up with us at all. This policy is organised around that difference, because almost every question about our handling of data has a different answer depending on which of the two you are.

1. Who we are, and the two roles we act in

The service is operated by Alexandra Romanov, sole proprietor (Osek Patur), Israel, Herzl 19, Apt 6, Netanya 4243002, Israel (“Tapenda”, “we”, “us”). You can reach us about anything in this document at privacytapenda.app.

For the business that uses Tapenda, we are the controller. When you open an account, we decide what we need in order to run the product for you — your email address, your business settings, the record of what happened in your account — and we are answerable to you for it. This is the ordinary relationship between a person and a service they signed up for.

For that business’s own clients, we are a processor. Names, phone numbers, appointments, notes, photos of work done — that data belongs to the business’s relationship with its clients. The business decides what to collect, why, for how long, and on what legal basis; we hold it and act on instructions given through the product. We do not decide to send a client a message, we do not mine that data for our own purposes, we do not sell it, and we do not use it to train models or to advertise anything to anyone.

One practical consequence, for a client of a business using Tapenda who has found this page: if you want to know what is held about you, to correct it or to have it deleted, the business you booked with is the right address for that request. If you write to us instead, we will not quietly hand your record over or delete it on our own initiative — we will pass the request to that business and help them answer it, and we will tell you we have done so. This policy, and the Terms, bind the business to have a lawful reason for holding your data and to honour your rights.

2. What we collect

Account data (business users — we are controller)

• Identity and contact: the email address you sign in with, your name and business name, optionally a phone number.
• Settings that make the product work: time zone, currency, the language your clients are written in, working hours, your service list and its prices.
• Sign-in records: one-time codes sent by email (stored hashed, short-lived), or, if you use “Sign in with Google”, the email address and account identifier Google returns to us. We never receive your Google password.
• An audit record of actions taken in your account — what changed, when, by which user, from which IP address. It exists so that a dispute about a moved booking or a deleted client has an answer.
• If you turn on browser notifications: the push subscription your browser issues (an endpoint URL and its keys).

Client data (the business’s clients — we are processor)

• Contact details entered or imported by the business, or captured from a WhatsApp conversation: name, phone number in international format, sometimes an email address, a birthday, the language to write to them in.
• Free-text notes written by the business. These are the business’s words, not a field we designed — see the warning about sensitive categories below.
• Bookings: which service, when, for how long, at what price, plus the status of the appointment and a snapshot of the service and contact as they were at the time, so that later edits never rewrite history.
• Messaging records once a WhatsApp number is connected: what was sent or received, when, and whether it was delivered, together with the evidence of the client’s opt-in (the first inbound message) and any opt-out.
• Photos uploaded to a client’s card — typically “before and after” work. Location and camera metadata (EXIF) is stripped on upload; the image itself may of course show a person.

Technical data

• Server logs: IP address, the request made, the response, a timestamp and a request identifier; browser and device information sent by your browser. These are security and debugging records.
• Rate-limiting counters, session records and their expiry.

Payment data

Tapenda is free during early access and takes no payments yet. When paid plans open, they are sold through Paddle, our online reseller and merchant of record. Card and billing details are entered on Paddle’s checkout and held by Paddle under its own privacy notice (paddle.com/legal) — they will not pass through our servers and we will not store them. We will hold what an invoice needs: who paid, how much, for which plan, and when.

What we ask you not to put in

The notes field will accept anything, and that is not permission. Health conditions, medical treatments, religious or political affiliations, information about someone’s sex life or orientation, biometric identifiers, government identity numbers — these are special categories under European law and sensitive personal information under Californian law, and the product is not built to carry the obligations that attach to them. Recording “sensitive scalp, use the mild product” is professional practice. Recording a diagnosis is not, and the Terms prohibit it.

3. Why we process it, and on what legal basis

We do not profile you, we make no automated decisions with legal or similarly significant effects, and we do not use anyone’s data — yours or your clients’ — to train machine learning models.

4. Cookies

This marketing site sets no cookies at all. It loads no analytics, no advertising pixels and no third-party fonts; the typefaces are served from our own domain precisely so that visiting this page does not hand your IP address to anyone else.

The application at https://app.tapenda.app sets two cookies, both strictly necessary:

Because both are strictly necessary for a service you asked for, no consent banner is required and we have not put one up. A banner that asks permission to do nothing trains people to click “accept” without reading, and we would rather keep that habit unlearned. If we ever add analytics or any cookie that is not strictly necessary, a proper consent mechanism — granular, refusable, and asked before anything is set — ships in the same release, and this section will say so.

5. Who else touches the data

We use a small number of companies to run the service. Each processes data on our instructions under a data-processing agreement, and none of them may use it for their own purposes. We do not sell personal data, and we do not share it for advertising.

Browser notifications are delivered through the push service of your own browser vendor (Apple, Google or Mozilla). The payload is encrypted in the browser’s own scheme, so what the push service relays is not readable by it.

Beyond that, we disclose data only where the law requires it — a binding legal request we have satisfied ourselves is valid — or where we have to defend a legal claim. If Tapenda is ever sold or merged, data moves with the service, and this policy continues to apply until we give notice of a new one.

We publish changes to this list here. A business that objects to a new subprocessor can write to us before it starts processing, and terminate if we cannot resolve the objection.

6. Where the data sits, and transfers

The database, the application server and the stored files are in the European Union (Germany). Some of the providers above are established in the United States; where data reaches them, it is transferred under the European Commission’s Standard Contractual Clauses, together with the technical measures described below. Israel — our first pilot market — holds an adequacy decision from the European Commission, so transfers there need no separate mechanism.

7. How it is protected

• Everything travels over TLS. The application refuses plain HTTP.
• Each business’s data is isolated in the database itself — the database refuses a query that reaches across tenants, rather than relying on application code to remember. This is the single most important protection in a product where one server holds many businesses’ client lists.
• Credentials and integration tokens are encrypted with AES-256-GCM under a master key that is not stored in the database they protect.
• Client photos live in a private bucket. They are served only through links that we sign on request and that expire within hours; the bucket refuses anonymous access.
• Sign-in is passwordless — a one-time code by email, or Google — so there is no password of yours for us to lose. Attempts are rate-limited and locked out after repeated failures.
• Backups are encrypted before they leave the server, and the key is held separately from them.
• Every change made in an account is written to an append-only audit record, so an incident can be reconstructed rather than guessed at.

No service is unbreakable, and a policy that claims otherwise is selling something. If a breach affects personal data we hold, we will notify the affected business without undue delay and within the deadlines the applicable law sets — for businesses whose clients’ data is involved, that notice is what lets them meet their own obligations.

8. How long we keep it

9. Deleting data

A single client. Open their card in the app and use Delete. It takes effect immediately: name, phone number, email, notes, birthday, opt-in evidence and photos are erased, and the copies of their name and number stored inside past bookings are overwritten. The appointment history stays, with the person removed from it.

Your whole account, with everything in it. Write to privacytapenda.app from the email address you sign in with, with the word “delete” and your account’s email in the message. We verify that the request comes from the account holder, delete the account and everything belonging to it — clients, bookings, messages, photos, settings, sessions — and confirm in writing. We do this within 30 days and normally within a few working days. There is no self-service delete button for a whole account yet; while there isn’t, this address is the route, and it is monitored.

A client of a business using Tapenda. Ask the business you booked with — they control that record and can delete it in a tap. If you cannot reach them, write to us at privacytapenda.app and we will contact them on your behalf and tell you what happened.

What survives a deletion, and why. Encrypted backups still hold the data until their rotation passes — at most 8 weeks, after which they expire by themselves and are not restored selectively to bring anything back. Our security log keeps the fact that an account existed and was deleted, without its contents and with the identifiers and IP addresses removed. If there is a billing history, tax law requires us to keep the invoices.

10. Your rights

If European or UK law applies to you

You may ask for access to your personal data, correction of it, deletion of it, restriction of processing, a copy in a portable format, and you may object to processing we base on legitimate interests. Where we rely on consent you may withdraw it at any time, without affecting what was done before. Write to privacytapenda.app; we answer within one month and tell you if a complex request needs longer. We do not charge for this.

You also have the right to complain to a supervisory authority — in the EU, the authority of the country you live or work in; in the UK, the Information Commissioner’s Office. We would rather you told us first, but it is your right either way.

Where we act as a processor for a business, we will forward your request to that business and assist them in answering it, as described in section 1.

If you are in California

Under the CCPA as amended by the CPRA, you have the right to know what personal information we have collected about you, the categories of sources and of recipients, and the purposes; to receive a copy of it; to have it corrected; to have it deleted; and not to be discriminated against for exercising any of these rights.

The categories we collect are identifiers (name, email, phone number, IP address); commercial information (appointments and, in future, payment records); internet activity (server logs); and, where a business uploads them, photographs. We collect them from you, from the business you booked with, and from your use of the service. We disclose them for business purposes only to the subprocessors listed in section 5.

We do not sell personal information, and we do not share it for cross-context behavioural advertising — not for money and not for anything else of value. We have never done so. There is therefore no “Do Not Sell or Share My Personal Information” mechanism to offer you, and no financial incentive programme. We do not use or disclose sensitive personal information beyond the purposes permitted by the CCPA — and we ask businesses not to put it here in the first place.

To exercise a right, write to privacytapenda.app. We verify requests against the information we already hold — typically by confirming control of the email address or phone number on the record — and respond within 45 days, extendable once where the law allows. An authorised agent may act for you with written permission we can check.

If you are in Israel

Israel is our first market. The Protection of Privacy Law, 5741-1981, as amended (including Amendment 13, in force since August 2025), gives you the right to inspect the information held about you, to request its correction or deletion, and to be told the purpose for which it is held. The same address handles these requests: privacytapenda.app. Israel holds an adequacy decision from the European Commission, which is why data can move between our European infrastructure and Israeli businesses without an additional transfer mechanism.

Wherever else you are — Canada, Australia, elsewhere in the EU’s neighbourhood — write to the same address. We apply the standard above as our floor rather than working out the minimum each country would accept.

11. Children

Tapenda is a business tool for adults. You must be 18 or older to hold an account, and the service is not directed at children. A business may have a minor as a client — a tutor’s pupil, for instance — and the business is responsible for the lawful basis and for any parental consent that requires. We do not knowingly collect data from a child directly, and if we learn that a child has created an account we will delete it.

12. Changes to this policy

When this document changes materially, we will update the effective date at the top and tell account holders by email before the change takes effect. Continuing to use the service after that means the new version applies to you. Older versions are available on request.

13. Contact

Privacy questions and requests: privacytapenda.app. Anything else about the service: supporttapenda.app. Suspected phishing or a security issue: securitytapenda.app, and see our security page.

Alexandra Romanov, sole proprietor (Osek Patur), Israel
Alexandra Romanov (רומנוב אלכסנדרה)
Herzl 19, Apt 6, Netanya 4243002, Israel
הרצל 19, דירה 6, נתניה 4243002

This policy is written in English. A translation, if we publish one, is for convenience; the English version governs.