Privacy

Lazavee is booking software that businesses install on their own websites. This page describes what the software collects, how long it keeps it, and who else sees it. Every statement here is taken from how the system actually behaves rather than from intent.

Two different relationships

There are two kinds of people in this product and the difference matters legally.

Businesses — the salons, clinics and tour operators who sign up — are our customers. We are their supplier.

Their customers — the people who book an appointment through a widget on a business's website — are not our customers, and we have no relationship with them. The business decides what to ask them, what to do with the answers, and how long to keep them. In data-protection terms the business is the controller and we are the processor: we hold the data on their instructions and do not use it for anything of our own.

If you booked an appointment and want your data changed or deleted, the business you booked with is who to ask. We will help them do it; we will not do it behind them.

What the software collects

From someone making a booking

What	Required	Why
First name	Yes	So the business knows who is arriving
Last name	No	Same
Email address	Yes	The confirmation, the reminder, and any change to the booking
Phone number	No	Only if the business asks for it
Time zone	Collected	Read from the browser, so times are shown correctly rather than guessed
A note to the business	No	Free text, if the person chooses to write one
Answers to the business's own questions	Depends	Each business defines its own fields

No tracking pixels, no third-party analytics, and no advertising identifiers are loaded inside the booking widget. It sets no cookies at all — see Cookies.

Fields a business defines itself

A business can add its own questions to a booking form, and we cannot control what it asks. A clinic labelling a field "reason for visit" will receive answers that are health information.

The software treats every such answer as sensitive by default and without being told to: the values are excluded from application logs, and they are stripped out of error reports before those leave our servers — not redacted but removed entirely, field names included, because the names of a clinic's questions disclose something on their own.

From a business using the dashboard

Name and email address for each person with a login, the business's own details (name, time zone, currency, contact address), and an audit record of significant actions — who cancelled a booking, and when. The audit log exists so that question has an answer; it is append-only and no part of the application updates or deletes a row in it.

How long it is kept

What	Kept for
Bookings and customer records	As long as the business keeps its account. They are the business's records, not ours.
Records of emails sent about a booking	90 days, then deleted automatically. These hold a recipient's address, so they expire on a schedule rather than on request.
Error reports	Kept by our error-monitoring provider under their retention policy, with personal data removed before they arrive.

Who else sees it

We use other companies to run the service. Each one is listed, with what it receives, on the subprocessors page. That list is part of this notice and changes to it are changes to this notice.

We do not sell personal data, and we do not use one business's data to do anything for another.

Where it lives

Security

Each business's data is isolated from every other business's at four independent layers, and the enforcement fails closed: where the software cannot establish which business a request belongs to, it refuses the request rather than returning unfiltered data.

To report a vulnerability, see /.well-known/security.txt. We would much rather hear from you than not.

Your rights

Contact

[email protected]