Privacy policy

1. Two kinds of data, two roles

When a business signs up, we are responsible for its account data (the owner’s and team’s details).

The customer data a business keeps in Anni (its bookings, its customer book, notes and payments) belongs to that business. We store and process it on the business’s behalf and follow its instructions. If you booked with a business and have a question about your data, you can ask the business or us.

2. What we collect

• Business accounts: the owner’s name, email, phone and password (stored only as a hash), and the business’s details: name, category, address and location, working hours, services, prices, logo and cover image.
• Team members: name, email, phone, role and permissions, and the revenue share the owner sets.
• Customers who book: name and phone number, and an email address if given; each booking (service, time, provider, status); notes the business adds; payments the business records; and reviews the customer writes.
• Sign-in: customers sign in with a one-time code sent to their phone on WhatsApp. We keep only a hashed form of each code, and it expires.
• Signing in with Google: when an owner or a team member chooses Google, Google tells us their email address and an id for their Google account, and nothing else. We don’t receive their Google password, contacts or photo, we keep no Google token, and we never post or read anything in their Google account. They can disconnect Google in Settings at any time.
• Technical data: our servers log requests (such as IP address, time and the page requested) to keep the service secure and to fix problems. Your browser stores your language, theme and sign-in session so you stay signed in.

We do not use advertising or analytics trackers on annibook.com.

3. How we use it

• To run the service: booking pages, calendars, customer books, packages and reports.
• To send booking messages on the business’s behalf (confirmations, reminders and changes) by WhatsApp and email. Each message carries the business’s name.
• To send account messages: email verification, password resets, invitations and subscription notices.
• To answer when you or your team type or talk to Anni in the dashboard.
• To answer support requests, keep accounts secure, and prevent abuse.

We do not sell personal data, and we never use a business’s customer data to market anything to those customers.

4. Who we share it with

Only with the providers that run parts of the service for us, and only what each one needs:

• Hosting: Railway (our servers and database) and Vercel (the website).
• File storage: Google Cloud Storage (logos, cover images and other uploads).
• Email: Resend.
• WhatsApp: WhatsApp (Meta) and the messaging providers that deliver our WhatsApp messages.
• Anni, the assistant: when you or your team type or talk to Anni in the dashboard, OpenAI processes what you say and the booking and customer details she needs to answer. We keep the conversation’s text in your account; we don’t keep recordings of your voice.
• Payments, once online payments are switched on: the card processor (CyberSource) handles card details directly. Anni never sees or stores full card numbers.

The business you book with sees your booking and the details you gave. We may also disclose data when the law requires it.

Some of these providers store data outside Palestine.

5. How long we keep it

We keep account data while the account is open. A business can ask us to close its account and delete its data; we then delete or anonymise it within a reasonable time, except records we must keep by law (such as invoices). Server logs are kept for a limited time.

6. Your choices

• Businesses can view and correct their data in the dashboard, and export their customers and payments as CSV at any time.
• Customers can see their bookings in their account. To correct or delete data a business holds about you, ask that business, or contact us and we will help.
• Anyone can ask us what we hold about them, or ask us to correct or delete it: write to support@annibook.com.

7. Security

Every page is served over HTTPS. Passwords are stored hashed, customer sign-in codes work once and expire, and team members see only what their role allows. No method is perfect, but we work to protect your data and will tell affected businesses if a breach puts it at risk.

8. Children

Anni is not meant to be used by children on their own. A parent or guardian can book for a child.

9. Changes

When we change this policy we update the date at the top. If a change is significant, we tell businesses by email before it takes effect.

10. Contact

Portous LLC: email support@annibook.com, WhatsApp or phone +972 59 427 6620.