Version 2026-10-23 · Last updated: October 23, 2026 · English

Privacy Policy

This Privacy Policy explains how Tymora handles information in its salon-management application and website. It distinguishes personal local workspaces from optional shared salon workspaces.

1. Who is responsible

“Tymora”, “we”, “us” and “our” refer to Bekir Varol, the independent individual developer operating Tymora in Bulgaria. References to the “Tymora team” describe support for this service, not a separate legal company. Contact us at support@clickhab.com.

We determine how account administration, service security, support and subscription administration are handled and act as controller for those purposes. A salon or professional decides why and how its clients’ information is recorded and normally acts as controller for that information. When the cloud service stores client records solely on the salon’s instructions, we act as processor for that processing, subject to applicable data-processing terms. These labels do not override the roles actually required by law.

Operator address: ul. Parvi Maj 8, Kardzhali, Bulgaria. Telephone: +359 894 355 676. Privacy, support and account-deletion requests: support@clickhab.com.

The Data Processing Addendum governs cloud processing of salon client content on your instructions.

2. Information handled

3. Where records are stored

Device cache: account records and file payloads are cached encrypted on signed-in devices. A server-held, owner-restricted account key protects this cache; this is not end-to-end encryption against the operator. Personal records and files are also stored in the private cloud workspace after acknowledgement. Protect your account and devices. Local pending changes must finish uploading before they are available on another device. Exports, legacy PIN workspaces and backups remain separate copies under your control.

Optional shared salon workspaces: Depending on the selected Team plan, an owner may invite up to four or twenty staff members. Invitations identify an email address and expire after seven days. A recipient must sign in using the matching verified email and accept the invitation. Salon owners decide membership and access to all or assigned appointments, the full client directory and financial records. Team members can view and change only what their granted permissions allow. Shared financial entries are stored separately from appointment and client records. An assigned staff member can access the assigned client card and its shared notes even without access to the complete client directory. Owners or authorized schedulers manage these assignments. Client assignments persist until explicitly removed; changing or cancelling one appointment does not automatically remove client-card access. New shared client and appointment records retain the creator identifier and name. Individual shared notes retain the writer identifier, writer name, text and server time; multiple writers add separate entries. Verified invitation recipients can view and defer their invitation on sign-in before joining. Legacy records may lack author information. Workspace switching keeps personal and shared data separate. Removal ends future authorized server access, but cannot recall copies already obtained by a recipient. Activity entries record the actor identifier, action category and server time; these entries are visible to the salon owner. Shared salon collaboration currently synchronizes its supported records. Personal media belong to the private account workspace and are not automatically shared with salon members.

Cloud infrastructure: when you acknowledge and enable personal cloud storage, salon records are transmitted to and stored in Cloud Firestore, and uploaded images, documents and voice notes in Cloud Storage for Firebase, on Google Cloud infrastructure. Firebase Authentication currently handles Google and email/password sign-in, email verification and password reset messages. Local caches may also remain on signed-in devices to support use and synchronization. Deleting an app or signing out is not the same as deleting its cloud account.

Google is our infrastructure provider, not the salon’s replacement data controller. Authorized support access, if necessary, must be limited to service operation, security, legal obligations or your support request. Do not assume end-to-end encryption or that no service operator can ever access cloud data; those guarantees are not made.

Usage accounting: we process account/salon identifiers, encrypted file sizes, file categories, declared recording duration, operation identifiers and upload/download counters to enforce the selected plan and prevent abuse. Quota delivery reads encrypted bytes without decrypting them on the delivery server. Private media are downloaded when requested rather than automatically on every device. Deleted/replaced files and prior record versions may be retained for up to 30 days for recovery, then removed by scheduled maintenance. Quota counters do not grant staff access to the owner’s private file contents.

4. Purposes and legal grounds

Where the GDPR applies, we rely on performance of our agreement for account and requested service operations; legal obligations for required billing, accounting or regulatory records; and legitimate interests for proportionate security, abuse prevention and responding to service enquiries, balanced against individual rights. Where consent is legally required, it must be specific, informed and capable of withdrawal. We do not rely on a general acceptance checkbox as blanket consent to all processing.

For client content, the salon must establish its own lawful basis, provide appropriate notices and obtain any required explicit consent for health data or recording. Accepting Tymora’s terms on behalf of a salon does not provide consent on behalf of its clients. Only record the minimum relevant information. Obtain permission before photographing, recording or sharing someone, and do not upload unlawful content or information about another person without authority.

5. Providers and sharing

• Google / Firebase: current account authentication and account configuration storage, optional shared salon record storage, personal-workspace and file synchronization after acknowledgement; Google Cloud hosting and operational security where used. See Firebase privacy information and Google’s Privacy Policy.
• Google Play: purchases, subscription administration and transaction verification when you choose to buy through Android.
• Stripe: web subscription payments, payment security, billing information, invoices and the hosted subscription-management portal. Tymora sends an account identifier and the selected subscription, not salon client records, notes, photographs or recordings. Stripe processes payment, device and transaction information as described in its Privacy Policy. Payment processing may involve international transfers and legally required financial-record retention.
• Actions you request: opening WhatsApp, SMS, a phone call, calendar export, PDF export, backup or the device share sheet may disclose the selected information to the app, recipient or location you choose. Review recipients and message contents. Tymora’s reminder shortcuts do not send messages automatically.
• Support and legal requirements: information necessary to handle your enquiry, protect the service or comply with a lawful obligation. We do not disclose salon records for unrelated advertising.

No advertising SDK or third-party behavioral analytics is enabled. To provide optional in-app welcome offers and return reminders, Tymora stores first and last dashboard activity dates, up to 30 active-day labels, and offer start, expiry, dismissal and redemption state in your private account. Eligibility checks use subscription history without reading client-record content. The same state is used across your devices so offers do not restart. Cards can be dismissed; no marketing email, push notification or client message is sent by this feature. You may object to direct marketing by contacting support@clickhab.com. These records are removed with account deletion.

6. International processing

Google services may process information outside your country, including the United States. Firebase Authentication currently operates from US data centers. Firestore and Storage offer regional choices, but selecting a European storage region does not mean every related service processes data exclusively in Europe. The account-configuration Firestore database is in europe-west3 (Frankfurt). The account file-storage bucket is configured in europe-west1 (Belgium). Where required, transfers must rely on a valid mechanism such as an applicable adequacy decision or contractual safeguards, including standard contractual clauses; accepting this notice is not a waiver of transfer protections. You may request information about applicable safeguards.

7. Retention and deletion

Local records remain on your device until removed through the application, application-data controls or your own storage management. Exported PDFs, shared messages, backups and other copies held by you or recipients are not remotely erased when you delete a record in Tymora. Device or operating-system backups may also contain copies.

Support correspondence and records needed for security, legal claims or legal compliance are kept only for as long as necessary for the stated purpose and applicable legal requirements. We limit access to retained information and do not retain it for unrelated reuse.

Account deletion: use the in-app account deletion control or the public account deletion page. A newly confirmed in-app request requires recent sign-in and email confirmation, then enters a 24-hour safety period during which it can be cancelled in Settings. A scheduled server job processes due requests and retries interrupted work. Older or verified support requests may require operator review and are normally completed within 30 calendar days after verification. Processing removes the account identity, encryption key, personal cloud records, personal media, and account-owned shared salons and data; memberships in independently owned salons are removed while their business records remain under their owner’s control. Connected signed-in devices clear the account database when processing begins; offline devices and user exports need separate removal. A minimal completion receipt is retained for up to 30 days and then removed by scheduled maintenance. Support correspondence is reviewed within 30 days of case closure, subject to explained legal exceptions. Provider technical recovery retention is governed by Google’s documented processes.

See Account & data deletion for the current request route. Account deletion and cancellation of a Google Play or Stripe subscription are separate actions; neither action is a prerequisite for requesting the other. Applicable payment or statutory records may need to be retained for a stated legal purpose.

8. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection to processing; you may withdraw consent where processing relies on consent without affecting earlier lawful processing. Contact support@clickhab.com. We may request proportionate verification to prevent unauthorized access or deletion. We aim to respond within the applicable legal deadline, normally one month for GDPR requests, subject to lawful extensions.

If your information was entered by a salon, contact that salon first because it controls its client records. We will assist within our role and legal obligations. You may complain to a competent supervisory authority, including Bulgaria’s Commission for Personal Data Protection, or the authority where you live or work. Contacting us first is not a condition for lodging a complaint.

9. Security and permissions

We use appropriate technical and organizational measures for the deployed service. Shared salon access requires authenticated access, verified email, an English shared-workspace acknowledgement and salon membership permissions; personal account metadata remains restricted to its owner. The extended cloud design requires authenticated access and per-workspace authorization rules, protected transport and restricted operational access. Cloud-provider encryption does not itself establish end-to-end encryption or correct access control. No service or device can be guaranteed completely secure. These statements do not exclude our legal obligations, including any applicable breach-response duties.

Shared client cards may include service plans, body-zone records, client-memory notes, photographs and short recordings. Authorized salon members can read the client records permitted by their assignment and role; financial amounts are stored under separate financial permissions. Shared files are encrypted before upload and use access-controlled shared key metadata, not end-to-end encryption. Uploads and downloads count toward the salon owner’s pooled quota. Removing a member blocks future server access but cannot recall copies already obtained.

Microphone and file/photo access are used for actions you initiate. Denying an optional permission prevents the relevant feature, not basic account access. Protect your Google account, device access and backups, and sign out on shared devices. Inform us if you suspect unauthorized access.

10. Website storage, children and decisions

The website/application uses local storage or similar device storage for essential preferences, session and application functionality. The current build does not deploy advertising cookies. Google Fonts and hosting requests are described above. Tymora is for adults managing a salon or professional practice; it is not directed to children. Client records concerning minors must be handled by the salon with the notices, permissions and safeguards required by law. Tymora does not make automated decisions producing legal or similarly significant effects and does not provide medical diagnoses.

Optional automatic AI growth reports

A paid Team Plus salon owner may separately authorize automatic weekly and closed-month reports. We calculate anonymous aggregate booking counts, completed and cancelled visits, repeated visits within the reporting period, weekday/hour booking patterns and recorded income/expense totals. Only these totals, reporting dates, currency and chosen language are sent to OpenAI through its API to prepare marketing and scheduling suggestions. We exclude names, contact details, client identifiers, notes, photographs and recordings. Aggregation is performed on supported shared-salon records; encrypted personal-workspace content is not decrypted by this feature.

OpenAI is an additional processing provider for this optional feature; processing can involve international transfers and safeguards described in its data processing terms. API content is not used for model training by default. We request store:false; this does not exclude provider security or abuse-monitoring retention under its applicable policies. Reports are advisory, can be inaccurate, and do not guarantee profit, availability or marketing results. No client messages or social posts are automatically sent. Reports are restricted to the salon owner. The owner can disable future processing in salon settings; existing reports remain until the salon/account is deleted under the applicable deletion process. We keep minimal processing and budget records to prevent duplicate charges and abuse. Separate opt-in is required; accepting the general account terms alone does not activate this feature.

11. Changes and language

This notice and the Terms of Use are maintained in English. Do not agree if you do not understand them; contact us for clarification. This does not exclude any legally required language or accessibility rights. The version date will change when these documents are materially revised. The cloud service must obtain a new acknowledgement before materially different cloud processing begins; changes are not retroactive permission for unrelated uses.