Privacy Policy

1. Introduction

This Privacy Policy describes how Bogdan Kiselev, operating Obano, processes personal data when people create an Obano business account, use Obano, book through an Obano-powered public booking page, manage an appointment through a secure link, contact support, or interact with subscription and billing functions.

2. Who operates Obano

Obano is operated by Bogdan Kiselev, a sole trader / self-employed individual established in Portugal.

• Legal operator: Bogdan Kiselev
• Operator type: Sole trader / self-employed individual
• Country: Portugal
• Business address: Rua do Lobito 296, 1B, 2775-228 Parede, Portugal
• Tax number: 326805583

For privacy questions, contact support@obano.life.

3. Business users and end clients

Business users

Business owners or authorized users who create and manage Obano accounts.

End clients

People whose data is entered by a business, submitted through public booking, used in appointment reminders, or accessed through cancellation or rescheduling links.

Bogdan Kiselev acts as controller for account, security, billing, platform-operation and support data. For client data managed by Obano business customers, the business customer generally determines why and how that data is used and acts as the controller; Obano may act as a processor for that data on the business's behalf.

4. Data collected

Account data

Name, email, authentication identifiers, Google OAuth identifiers where used, country, language, timezone, account status, and login and security information.

Business profile data

Business name, public booking slug, description, address where supplied, website, Instagram, logo, cover image, brand color, booking settings, notification settings.

Team-member data

Name, title, profile image, bio, languages, experience, social profile information, working hours, availability.

Client data

Name, email, phone number, appointment history, booking source, notes entered by the business, cancellation or rescheduling activity.

Appointment data

Service, team member, date, time, duration, status, notes, reminder status, cancellation and rescheduling history.

Subscription data

Paddle customer ID, Paddle subscription ID, transaction references, subscription status, trial dates, billing-period dates, cancellation status, payment-failure state. Obano does not store full card details.

Technical data

Where collected: IP address, browser, device, timestamps, logs, webhook events, security and fraud-prevention information, and email-delivery status.

5. Sensitive data

Businesses should not enter unnecessary medical data, biometric data, financial-account data, government identifiers, special-category data, or highly sensitive personal notes. Businesses are responsible for ensuring a lawful basis before entering any sensitive information. Obano is not designed as a medical-record system, an emergency service, or a regulated health-record platform.

6. How data is collected

• Directly from business users.
• From end clients through public booking.
• From businesses about their clients.
• Generated through appointments and reminders.
• Received from Paddle in relation to subscriptions.
• Received from Google where a user chooses Google sign-in.
• Generated technically through service operation.

7. Purposes

• Providing account access.
• Managing appointments, clients, services and availability.
• Providing public booking.
• Sending transactional emails and reminders.
• Enabling client cancellation and rescheduling.
• Maintaining security and preventing abuse.
• Providing customer support.
• Processing and synchronizing subscriptions.
• Diagnosing errors and improving reliability.
• Enforcing terms and complying with legal obligations.

8. Legal bases

Depending on the situation, processing may rely on performance of a contract, legitimate interests, legal obligation, consent where required, or the establishment, exercise or defense of legal claims. The correct basis may depend on the user's country, the business's use, the type of data, and the relationship between the business and the client. Consent is not the basis for every processing activity.

9. Business responsibilities

Businesses using Obano are responsible for:

• Having a lawful basis for client data.
• Giving clients any required privacy notices.
• Configuring reminders lawfully.
• Keeping client data accurate.
• Handling client-rights requests.
• Limiting access within their business.
• Avoiding unnecessary sensitive information.

10. Service providers

Supabase

Database, authentication, server functions, storage, scheduled jobs, access controls.

Paddle

Merchant of Record for subscription checkout, recurring billing, taxes, invoices, receipts, billing management and refunds.

Google

Where a user chooses Google sign-in.

Transactional email

Our transactional email delivery provider is used to send account, booking and reminder emails.

Hosting

Our hosting provider delivers the Obano web application.

11. Paddle and payment information

Paddle independently processes buyer identity, billing address, payment information, tax information, payment method, invoices, receipts and billing support information. Paddle's own terms and privacy documentation apply to the payment transaction.

12. International transfers

Service providers may process data in different countries. Applicable safeguards are used where required.

13. Data retention

Data may be retained while the account is active, while required to provide services, for security, for disputes, or where required by legal or tax obligations. Data may also persist in backups for a limited cycle; deletion from backups may not be immediate.

14. Security

Reasonable safeguards include authenticated access, row-level security, owner isolation, server-side authorization, private storage for non-public files, signed or tokenized secure links, Paddle webhook signature verification, encrypted network transport, restricted admin functions, and audit logging. No security measures can guarantee absolute security.

15. User rights

Depending on applicable law, users may have rights of access, correction, deletion, restriction, objection, portability, withdrawal of consent, and the right to complain to a supervisory authority. End clients may need to contact the business they booked with first, because that business may control their appointment data.

16. Account deletion

Business users may request account deletion by contacting support@obano.life. Active billing should be cancelled through the Paddle Customer Portal. Account deletion and subscription cancellation are separate processes unless explicitly completed together. Some records may be retained where legally required, and backups may not be purged instantly.

17. Children

Obano is designed for business users and is not directed at children.

18. Cookies and storage

Obano uses authentication and session storage, essential security storage, Paddle Checkout-related storage, interface preferences and operational storage needed for app functionality.

19. Third-party links

Public booking pages or business profiles may link to third-party sites such as business websites or Instagram. Obano is not responsible for those sites' privacy practices.

20. Changes

This policy may be updated. Material changes may be communicated through the service or by email.

21. Contact

For privacy questions, contact support@obano.life.