Privacy Policy

Write Me TG ("Write Me TG", "we", "us") operates a booking platform (the "Platform") for salons and other appointment-based businesses (each, a "Business"), reachable through a Telegram Mini App, public web booking pages, and an Owner Dashboard.

Write Me TG is currently operated by an individual based in Chisinau, Republic of Moldova, MD-2038, and is not presented as a registered company. If that changes, this Policy will be updated to name the operating entity. We do not currently have a Data Protection Officer or an EU representative appointed; if either becomes required or is appointed, this Policy will name them.

This Privacy Policy explains what personal data Write Me TG processes across the Platform, why, and what choices you have. It applies to Business Owners and Staff Members using the Owner Dashboard, and to Customers booking appointments through the Telegram Mini App or a public web booking page. It does not cover a Business's own privacy practices toward its Customers beyond what Write Me TG itself does with the data — see Section 6 for that distinction.

• Business Owner / Staff Member account data — email address, a hashed password, or a Google account identifier if you sign in with Google; Business name and URL slug; role (owner or manager); consent record (which version of these Terms and this Policy you accepted, and when).
• Telegram identifiers— when a Customer opens a Business's Mini App inside Telegram, we receive the Telegram ID, first/last name, and username Telegram provides via its authentication mechanism ("initData"), which we validate cryptographically on every request.
• Customer booking data — a name and phone number for anyone booking an appointment (through Telegram or the public web booking page), plus the service, staff member, date, time, and status of each booking.
• Business configuration data — the services, staff profiles, schedules, and booking-page branding a Business Owner configures, and any logos, cover images, service photos, or staff avatars uploaded for the booking page.
• Notification and delivery records — a log of booking confirmations, reminders, and alerts sent, for delivery tracking and troubleshooting (see Section 12 for how long these are kept).
• Support records — messages exchanged through the in-dashboard support channel or sent to [email protected].
• Security and audit records — sign-in/sign-out events, password changes, and session activity, and, for Businesses on plans that include a team activity log, staff additions and role changes within that Business.
• Technical data — IP addresses and request timestamps our hosting and network infrastructure retain briefly for security, abuse prevention, and reliability, and aggregate traffic metrics (see our Cookie Policy).

Paid subscriptions are paid through Dodo Payments' hosted checkout; payment card details are entered there and never pass through or are stored on our systems. See Section 9 for the billing information we do receive.

• To operate the booking flow: creating, confirming, rescheduling, and cancelling appointments.
• To authenticate Business Owners/Staff Members and Telegram/web Customers, and to keep each Business's data isolated from every other Business.
• To send booking confirmations and, on plans that include it, reminders and status-change alerts.
• To let a Business Owner run their business: manage services, staff, schedules, branding, and view statistics about their own Business.
• To maintain and secure the Platform, including detecting abuse, investigating security events, and diagnosing technical problems.
• To respond to support requests sent to [email protected] or through the in-dashboard support channel.

We do not sell personal data, and we do not use Booking Data or Business data for advertising.

Where applicable data protection law requires a legal basis, we rely on: performance of a contract (running the booking service a Business or its Customer requested), legitimate interests (keeping the Platform secure, functioning, and improving it), consent where we specifically ask for it (for example, optional analytics — see our Cookie Policy), and compliance with a legal obligation where applicable. Where a Business is the controller of its own Customers' data (Section 6), the Business is responsible for having its own legal basis to collect and use that data.

Write Me TG is a multi-tenant platform: many independent Businesses use it, each isolated from every other Business at the database level. The same organization can be a controller for one activity and a processor for another, so we distinguish by activity rather than making a single blanket statement:

• Write Me TG account data (a Business Owner's or Staff Member's login, Business profile, subscription/plan) — Write Me TG is the controller, since we determine how this is used to operate the Platform itself.
• Business configuration data (services, staff, branding a Business configures) — the Business is the controller of what it chooses to enter; Write Me TG is a processor storing and displaying it as instructed.
• Customer booking data (a Business's own Customer's name, phone number, Telegram identifiers, and appointment history) — the Business is the controller of its own Customer relationships; Write Me TG is a processor, running the software the Business uses to collect and manage that data under our Data Processing Agreement, which is incorporated into our Terms of Service.
• Billing information — payment details are collected by Dodo Payments in its own hosted checkout; Dodo acts as an independent party for the payment transaction itself. We receive the limited billing information described in Section 9.
• Security and audit data (sign-in/session records, platform audit logs) — Write Me TG is the controller, since we determine how this is used to keep the Platform secure and accountable.

A Customer asking how their Booking Data is used should generally contact the Business they booked with directly, since that Business controls its own Customer relationships; Write Me TG can help route that request (Section 15).

We share information only as needed to run the Platform:

• Telegram— to deliver Mini App bookings, notifications, and reminders, information necessarily passes through Telegram's Bot API, governed by Telegram's own privacy terms.
• Subprocessors — infrastructure and service providers that process data on our behalf under contract, listed in full on our Subprocessors page.
• We do not sell personal data to third parties, and we do not share it for third-party advertising or marketing.
• We may disclose information if required by law, or to protect the rights, safety, or property of Write Me TG, our users, or others.

The Telegram Mini App authenticates users via Telegram's own "initData" mechanism; Write Me TG verifies its authenticity on the server but does not control what Telegram itself collects or how the Telegram client app behaves — that is governed by Telegram's own policies. If a Business has not connected a Telegram bot, or a visitor uses the public web booking page instead, no Telegram identifier is involved; booking still uses a name and phone number.

Paid subscriptions are sold through Dodo Payments, our Merchant of Record. Payment details are entered directly into Dodo's hosted checkout and customer portal — they do not pass through our systems, and Write Me TG never receives or stores full card numbers or other full cardholder data. Dodo acts as an independent party responsible for its own processing of payment data under its own privacy terms, including payment processing, applicable tax calculation, fraud prevention, refunds, and disputes.

• What we send to Dodo when a checkout starts: the plan and billing period chosen, an internal identifier of the Business Account, and — only if it has been verified — the Business Owner's email address.
• What we receive from Dodo: notifications about the subscription and its payments. They contain the Dodo customer and subscription identifiers, subscription status, plan, amounts and billing dates, and billing details Dodo holds for the transaction — the billing name, email address, phone number (if provided), billing address, tax ID and business name (if provided), cancellation reason (if given), and the card brand, type, issuing country, and last four digits.
• Why: to activate, renew, change, or end the Business Account's plan, and to answer billing questions.

Paid plans arranged manually and directly with Write Me TG before online billing was available are handled as described in our Refund Policy.

The Owner Dashboard signs you in with a pair of HttpOnly cookies; the Telegram Mini App, public web booking, and Super Admin surfaces use bearer tokens stored in the browser's local storage instead. On the marketing site we use Google Analytics, gated behind your cookie consent choice and inactive by default. See our Cookie Policy for full details on cookies, local storage, and analytics, and how to change your choice at any time.

Our infrastructure spans several providers, not all located in the same country: Cloudflare operates a global network (used for our CDN, reverse proxy, and object storage); Google, our email provider, and Telegram may process data outside your own country. Our application server runs on Oracle Cloud Infrastructure in the Frankfurt, Germany region, so our own hosting is within the European Economic Area. Where personal data is nonetheless transferred outside the EEA — for example through Cloudflare's global network, or Google's or Telegram's own infrastructure — we rely on the transfer safeguards each provider makes available (such as the European Commission's Standard Contractual Clauses, where applicable) rather than a data-residency guarantee, since we have not configured region-pinned hosting for those providers. See our Subprocessors page for each provider's role and location where known.

We keep different categories of data for different, deliberately limited periods:

• Business Account data and Customer booking data — for as long as the Business Account is active, so owners can review booking history and statistics.
• Notification delivery logs (Telegram/booking notifications) — 180 days, then automatically deleted.
• Email delivery logs — 90 days, then automatically deleted.
• Security event logs (sign-in, sign-out, password changes, session activity) — 90 days, then automatically deleted.
• Billing notifications received from Dodo Payments (Section 9) — 180 days after they have been applied to the Business Account's subscription, then automatically deleted, including after account deletion. The Dodo customer and subscription identifiers and status kept with the Business Account are deleted with it.
• Platform audit logs (administrative actions) — 365 days; entries authored by a platform administrator are kept for accountability after that but have any link to a deleted Business removed (see Section 13).

Database backups: we keep a daily backup of the production database on a rolling 30-day cycle — a backup more than 30 days old is automatically deleted, and we do not keep backups beyond that window. This means that if data is deleted (for example, through account deletion under Section 13, or a Customer's Booking Data being removed), a copy of it may still exist in a backup for up to 30 days after deletion, until that backup itself rotates out. We do not delete data from individual backups on request — deletion from backups happens only through this rolling expiry, not immediately.

A Business Owner can delete their Business Account themselves from the profile page of the Owner Dashboard, after confirming their identity (by re-entering their password, or by a recent Google sign-in), or by contacting [email protected]. Deletion is delayed by 24 hours after the request, during which the Business Owner can cancel it from the same page. Once it proceeds:

• Any active paid subscription is cancelled with Dodo Payments first, so no further charges occur; Dodo keeps its own transaction records under its own terms.
• The Business Account, its Staff Members' sessions and credentials, services, staff, schedules, bookings, notification logs, and support tickets are permanently deleted.
• Uploaded media (logos, images) is queued for deletion from storage and normally removed within 24 hours; if storage is temporarily unavailable, deletion is retried automatically for a further period, and in rare cases of persistent failure may require manual staff intervention to complete.
• A Telegram user's identifier is removed unless that same person has an active relationship with another Business, in which case their record is kept, associated only with that other Business.
• Platform-administrator-authored audit entries about the Business are kept for accountability, with the link to the deleted Business removed.
• A minimal internal record that the deletion occurred (an identifier and timestamp, no other personal data) is kept for platform accountability.

As noted in Section 12, deleted data may still exist in a database backup for up to 30 days after deletion, until that backup rotates out on our standard 30-day cycle.

Business data is isolated at the database level, so one Business's data is not readable by another. Passwords are stored hashed, never in plain text. Uploaded images are stored via Cloudflare R2 or on the application server's own storage, depending on deployment configuration. Payment card details are entered only in Dodo Payments' hosted checkout, so no full cardholder data is stored on our systems. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Depending on where you are located, you may have rights to access, rectify, erase, restrict, or object to our processing of your personal data, to receive a copy of it in a portable format, and to withdraw consent where processing is based on consent. To exercise these rights over your Business Owner or Staff Member account, contact [email protected]. If your request concerns a booking you made with a specific Business, we recommend contacting that Business directly first, since it controls its own Customer relationships (Section 6); we are also happy to help route the request. If you are not satisfied with our response, you may have the right to lodge a complaint with the data protection supervisory authority in your country of residence.

We do not use your personal data to make decisions about you through automated processing that has a legal or similarly significant effect on you.

The Platform is a business tool for appointment-based businesses and their adult clientele, and is not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact [email protected] and we will address it.

We may update this Policy as Write Me TG's features, infrastructure, or business arrangements change . The "Last updated" date and version number at the top of this page reflect the current version; material changes will be reflected here.

Questions about this Privacy Policy can be sent to [email protected].

Write Me TG
Address: Chisinau, Republic of Moldova, MD-2038
Email: [email protected]
Website: writemetg.com