Privacy Policy

1. Roles of the parties

Rebookt distinguishes between two types of personal data:

• Business and staff data: account information of the Business and its employees. With respect to this data, Rebookt acts as Controller.
• The Business's end-customer data (the individuals who book appointments and receive services): with respect to this data, the Business is the Controller and Rebookt acts solely as Processor, processing that data on behalf of and under the instructions of the Business to provide the service.

The Business is solely responsible for having a valid legal basis (consent or otherwise) to collect and upload its end customers' data on the Platform, and for informing those customers about the processing of their data.

2. Data we collect

2.1 Business and staff data

• Business name, address, phone, and email.
• Data of the users (owner, managers, staff): name, email, password (stored encrypted), role.
• Billing and payment data, processed through Stripe (see section 5). Rebookt does not store full card numbers.

2.2 End-customer data (uploaded or generated by the Business)

• First name, last name, phone, email, and date of birth.
• Identity document (type and number: national ID, passport, or other), when the Business requests it.
• Digital handwritten signatures and signed consent forms.
• Appointment history, services, notes, and preferences recorded by the Business.
• Communication preferences (email and/or WhatsApp opt-in).
• Messages exchanged with the WhatsApp booking agent.

2.3 Technical and usage data

• IP address, device type, and browser.
• Access and activity logs (date, user, operation) for security and audit purposes.

3. Purposes of processing

We use the data to:

• Provide and operate the Platform: bookings, appointment management, customer retention, consent forms, staff management, and billing.
• Send transactional notifications (confirmations, reminders) by email, SMS, or WhatsApp, according to the end customer's preferences.
• Operate the automated WhatsApp booking agent.
• Process the Business's subscription payments.
• Ensure security, prevent fraud, and comply with legal obligations.
• Improve the Platform through aggregated, non-identifiable analytics.

4. Artificial intelligence

The WhatsApp booking agent uses language model services (Azure OpenAI) to interpret end customers' messages and respond automatically. Messages are processed solely for the purpose of managing the conversation and the booking. Rebookt does not use these conversations to train third-party models.

5. Providers and international transfers

To operate the Platform we share data with service providers ("sub-processors") that act under confidentiality and security obligations:

Since Rebookt is a U.S. entity and uses cloud infrastructure, data may be processed and stored outside the Dominican Republic, including the United States and other Azure regions. By using the Platform, the Business consents to this international transfer and undertakes to inform its end customers where applicable.

We do not sell personal data to third parties.

6. Data security

We apply reasonable technical and organizational measures to protect data, including:

• Encryption in transit (TLS) and encryption at rest on Azure infrastructure.
• Multi-tenant isolation: each Business can only access its own data; the Business identifier is always derived from the authenticated session token.
• Role-based access control (owner, manager, staff) and authentication via signed tokens.
• Audit logs of operations on the data.
• Passwords stored encrypted (never in plain text).

No system is completely secure. In the event of a security breach affecting personal data, we will notify the affected Business without undue delay.

7. Data retention

We retain data while the Business's account is active and for as long as necessary to fulfill the described purposes and legal, tax, or accounting obligations. After account termination, data is deleted or anonymized within 90 days, unless there is a legal obligation to retain it.

8. Individuals' rights

In accordance with Law No. 172-13 of the Dominican Republic on the protection of personal data, individuals have the right to access, rectify, cancel, and object to the processing of their data.

• End customers must exercise these rights with the relevant Business, which is the Controller of their data. Rebookt will cooperate with the Business to handle such requests.
• Businesses may exercise their rights by writing to legal@rebookt.com.

9. Minors

The Platform is not directed at minors as account holders. If a Business registers data of end customers who are minors, it is the Business's responsibility to have the consent of the parent or guardian in accordance with applicable law.

10. Cookies

The Platform uses only cookies and similar technologies that are strictly necessary for the operation and security of the session. We do not use third-party analytics or advertising cookies.

11. Changes to this Policy

We may update this Policy. When changes are material, we will notify them through the Platform or by email and indicate the new effective date and version number. Continued use of the Platform after the effective date constitutes acceptance of the updated version.

12. Contact

For any questions about this Policy or data processing:

Rebookt, Inc.
Email: legal@rebookt.com
Address: 2810 N Church St, STE 89504, Wilmington, DE 19802, USA