Privacy Policy

This Privacy Policy explains how personal data is handled when you visit Belom, create or use an account, join a business workspace, view a Provider’s public profile, send an enquiry, make or manage a booking, pay a deposit or other amount, use a prepaid product, communicate through the Platform, connect an integration or use a Belom mobile application.

Belom is operated by the following Estonian company, which is the controller for the Belom purposes described in this Policy:

The exact allocation may vary where law determines the purposes and means differently. Belom and the Provider will not use the label “processor” to reduce rights you have against the party that actually controls the processing.

Depending on the features used, Belom processes:

• Identity and contact data: name, display name, email address, telephone number, avatar, preferred language and communication preferences.
• Account and security data: account identifiers, sign-in method, password hashes or authentication-provider references, sessions, two-factor state, recovery events, invitations, roles, permissions, security signals and access history. Belom does not receive a social sign-in password.
• Business and professional data: business or trading name, workspace members, locations, services, prices, qualifications, descriptions, working hours, policies, legal and tax details, payout or merchant-account status, subscription and invoice data.
• Client and booking data: client profiles, custom fields, enquiries, requested and confirmed appointments, waitlist and slot-offer activity, service and Provider, date, time, duration, location, attendance, cancellation, no-show, rescheduling, rebooking, reminders, visit history, preferences, internal notes and review history.
• Communications: email, SMS, Telegram and connected Meta-channel identifiers; message text; thread and delivery state; attachments and file metadata; campaign, opt-out and consent records; support and complaint correspondence; and audio submitted for transcription.
• Content and uploads: profile, portfolio, gallery, blog and page-builder content; media; forms and submitted values; custom-domain details; reviews and replies; drafts and publication history.
• Payment and commerce data: seller, payer and transaction references; processor and merchant identifiers; amount, currency, tax, payment and settlement status; deposit or prepayment amount; remaining balance; accepted cancellation and no-show terms; refunds, disputes, chargebacks and complaints; gift-card or package balance; redemption; Platform subscription; subscription add-ons and invoice or receipt details. Belom does not store full payment-card numbers or card security codes.
• Integration data: connected account identifiers, account names, permissions and scopes, encrypted access or refresh credentials where needed, selected calendars or channels, synchronisation state, external campaign and content identifiers, and actions requested through the integration.
• Device, usage and diagnostic data: IP address when a request is received, browser and device type, operating system, app version, route and referral domain, timestamps, coarse viewport, locale, cookie or browser-storage choices, rate-limit and anti-bot signals, audit logs, error names and messages, sanitised stack traces, performance data, mobile sync state and push token.
• Analytics and advertising data: a random tab-scoped session identifier, daily rotating one-way visitor hash, page and funnel events, UTM fields, conversion and deduplication identifiers, Google click identifiers, Meta browser identifiers where separately authorised, audience or campaign configuration, and consent provenance.
• AI feature data: prompt or question, selected action and bounded workspace context, generated response or proposal, feedback and audit state, analytics aggregates used for narration, transaction text supplied for categorisation, voice audio requested for transcription, and a limited conversation excerpt and booking facts when an authorised chat assistant is invoked.

We receive personal data:

• directly from you when you register, configure a workspace, submit a form, book, pay, message, upload content or contact support;
• from the Provider or authorised workspace members when they create or import a client record, record a visit, add a note, manage a booking, issue a refund or communicate with a Client;
• from another Client or payer, for example when a person books for someone else or purchases a transferable product, where permitted;
• automatically from the browser, app and Platform infrastructure, subject to the consent controls described below; and
• from services you or a Provider connect, such as a payment processor, Google, Meta, Telegram, Canva, Zernio, calendar, email or SMS service.

If you provide another person’s data, you must be authorised to do so and give them the privacy information required by law. Providers are responsible for the legality and accuracy of imported client lists.

Where consent is the basis, you may withdraw it at any time without affecting processing already carried out lawfully. Where Belom relies on legitimate interests, we balance the stated interest against the person’s rights and reasonable expectations. You may ask for more information or object as described below.

Some identity, contact, booking and payment information is required to create an account, confirm a booking or complete a transaction. If it is not provided, the relevant feature or contract may be unavailable. Optional profile fields, marketing, analytics, advertising measurement and external media are not required for core Platform use.

A Provider decides why it keeps client records, custom fields, service history, notes, messages and marketing preferences. Belom supplies access controls, audit evidence, export, correction and deletion tools and processes that data under the Provider’s documented instructions, except where Belom has an independent legal purpose described in this Policy.

A Provider may send booking confirmations, reminders, changes, cancellations and payment updates needed for the requested service. Marketing and rebooking offers are separate. A Provider must have consent or another basis permitted by applicable direct-marketing law, identify itself, respect frequency and channel rules, and offer a free and easy objection or unsubscribe. Belom records suppression and consent evidence so an opt-out can be enforced.

When Belom receives a request about data controlled by a Provider, we may direct it to the Provider or assist the Provider in responding. We will respond directly for data Belom controls. If the same record serves both purposes, each party remains responsible for its part.

A service may require information about allergies, contraindications, accessibility, pregnancy, medication or other health-related circumstances. This can be special-category data. Providers must request only what is necessary for safe service and identify the purpose before collection.

Where explicit consent is required, the form or Provider must obtain it separately. The related ordinary-data basis may be the requested service or legitimate safety interest, while the special-category condition is explicit consent or another condition permitted by law. Consent can be withdrawn for future processing, although a Provider may be unable to perform a service safely without necessary information. Legal-claim or professional-law conditions may allow limited retention despite withdrawal.

Sensitive notes are not used for advertising or audience creation. Users should not place unnecessary health, payment-card, identity document or other highly sensitive data in free-text messages, AI prompts or public forms.

For Provider services and Provider-issued prepaid products, the named Provider is the seller. A payment is processed through the Provider’s own connected Stripe account or Montonio merchant store where enabled. Belom processes the seller reference, total price, amount due now, remaining balance, currency, accepted cancellation and no-show policy, payment and refund state, processor identifiers, consent version, timestamps, dispute evidence and complaint history.

These records are needed to prove what deposit or prepayment was accepted, prevent duplicate collection, apply the correct refund, preserve gift-card or package value, resolve chargebacks and meet anti-fraud and legal obligations. Belom may notify the Provider and payment provider of a required refund and provide a technical route for the Provider to request it, but Belom does not fund or execute the transfer.

Stripe, Montonio, the selected payment method, issuing bank and the Provider may process additional identity, device, risk, account and payment credentials as independent controllers under their own notices. Belom receives transaction status and limited payment-method information, not a full card number or card security code.

AI processing occurs only when an authorised user invokes the relevant feature or deliberately enables a described assistant or automation. Depending on the request, Belom may send OpenAI or another disclosed AI provider the user’s prompt and the minimum context needed to answer: aggregate business metrics; proposed action context; transaction text; voice audio for transcription; page content; or a bounded recent client-chat excerpt and limited booking facts for reply drafting.

Detectable email addresses and phone numbers are replaced before a client-chat excerpt is sent, but free text may still contain personal or sensitive information. Users must review the context and avoid unnecessary sensitive data. AI providers receive nothing merely because a visitor opens a page or accepts analytics.

Belom keeps proposal, approval, rejection and action-audit records as needed for safety, accountability and support. Belom records the production AI provider’s role, processing location, retention, training-use setting and transfer safeguards in its subprocessor records and applicable agreement, and uses the service according to those configured terms. Current information about those safeguards may be requested from hello@belom.app.

The Cookie Policy lists the cookies, local storage and session storage used by Belom. Essential authentication, security, consent-record and requested preference storage does not depend on optional analytics consent.

First-party analytics and browser monitoring

Optional public-site and booking-funnel analytics is off by default. If accepted, Belom records page path, random tab-scoped session ID, referral domain, UTM fields, coarse viewport, events and anti-bot signals. Event rows use a daily rotating one-way visitor hash instead of the raw IP address or full user-agent string. Withdrawal clears Belom analytics and view-deduplication values in the current tab and prevents new optional submissions.

Where Sentry browser monitoring is configured, the same optional analytics choice controls browser exception messages, sanitised stack traces, route, browser or device context and sampled performance traces. It is not initialised before acceptance; session replay is disabled. Essential, sanitised internal error logging and operational server monitoring may run separately to keep the service secure and functional.

Google advertising measurement

A separate, versioned choice controls Google Ads measurement. When a Provider has configured it and the visitor accepts, Belom may retain a case-sensitive Google click identifier (gclid, gbraid or wbraid), consent state, booking or conversion event and deduplication key and send a confirmed conversion to the selected Google Ads account. Analytics consent alone does not enable this. Rejection or withdrawal clears browser-held identifiers and prevents new ones being retained.

Provider-configured Meta Pixel

A third, independent, versioned choice controls a Provider’s Meta Pixel on published profile and booking pages, including a verified custom domain, and replaces the older page-view-only choice. Belom makes no browser or server request to Meta for a journey through a published Belom profile, booking page or verified custom domain without the current separate consent. After acceptance, the browser sends PageView on published profile and booking pages, ViewContent when booking availability opens, and Schedule only after a code-owned, server-proven confirmed appointment. Meta inherently receives the request IP address, browser and device details and page address, and may set or read its own cookies as an independent controller. Belom does not enable automatic advanced matching in its own browser runtime. A Provider can change that Meta-side setting outside Belom and should review the live state shown in Connections & tracking. Provider-supplied executable snippets are not run.

For a journey through a published Belom profile, booking page or verified custom domain, the connected Zernio/Meta integration relays a Lead only for a successful public enquiry or form, BookingConfirmed plus the Meta-standard Schedule only for a confirmed booking, and Purchase only for an attributable real paid sale. Every such Meta request requires the current durable separate-consent receipt tied to that successful journey. It may carry _fbp or _fbc, while applicable contact identifiers are relayed only when both that receipt and the relevant contact or privacy permission allow them. As one narrow exception, a later attributable paid Purchase originating in a native Meta Instant Form may be sent only for an exact chain from a Belom-created Meta campaign through a native Meta lead, confirmed booking and posted sale, based on affirmative marketing consent captured and frozen in that form. This route has no Belom browser receipt, sends no Belom _fbp / _fbc, and may relay only eligible contact identifiers originally captured through the form plus the linked-customer identifier. The stable appointment event ID is used solely to deduplicate the browser and server Schedule. The current server relay does not add a stored raw IP address, raw user agent or source URL. Belom does not sell personal data or send private messages, health or other sensitive notes, payment credentials or card data to advertising conversions.

Withdrawal stops future browser dispatch and new capture, clears Belom’s marketing-tracking values in the current tab and signals an already loaded Pixel. It neither retroactively uploads activity nor itself deletes Meta-controlled cookies, which must be managed with browser or Meta controls. For Belom-page journeys, a conversion first completed without the current consent is never backfilled after a later grant, and an unsent conversion whose identifiers have been purged or erased is not sent anonymously later.

A feature uses a connected provider only when it is configured and needed. Current integration categories include:

• Email and SMS: Resend or configured SMTP service and BudgetSMS may receive the recipient, message, sender details, template and delivery metadata.
• Payments: Stripe may support connected Provider payments and Belom subscriptions; Montonio may support Provider checkout or Belom subscriptions and subscription add-ons according to the checkout shown. Provider-service funds are handled through the Provider’s own merchant or connected account and do not pass through Belom.
• Telegram and Meta messaging: the connected service receives user or chat identifiers, message text, media and delivery data needed to operate that channel. Belom may store encrypted workspace credentials and channel state.
• Google Calendar: with one-way sync, Belom stores encrypted OAuth credentials, granted scopes and selected-calendar metadata and sends service or entry title, start and end, duration, location where present, a Belom management link and pseudonymous markers. Client names, contact details, private notes, prices and custom fields are excluded from that calendar projection.
• Google Ads and Meta advertising: connected account, campaign, audience, consent and conversion data is processed only for configured, authorised operations and the separate visitor choices described above.
• OpenAI: receives the bounded AI inputs described in section 8 only when an AI feature is invoked.
• Canva and Zernio: receive connected-account, creative, campaign or publication information needed for an action the Business User requests.
• Sentry: may receive consent-gated browser monitoring and operational server-monitoring data where configured.

A public profile may embed YouTube, Vimeo, Loom, SoundCloud or Google Maps. Belom shows a local placeholder first. The provider is contacted only after the visitor chooses Load once or Always allow external media. Loading can disclose the IP address, browser information and viewed page and may let the provider use its own storage. Blocking the panel again removes the embed and saved “always allow” choice.

Belom may disclose the minimum necessary data to:

• the Provider, authorised workspace members and the relevant Client or payer, according to role and permission;
• infrastructure, hosting, database, storage, job processing, authentication, communications, monitoring, support, payment, analytics and AI vendors acting under contract;
• connected services the authorised user chooses, as described in section 10;
• professional advisers, auditors, insurers and financing partners where bound by confidentiality;
• courts, regulators, law enforcement or other authorities where legally required or necessary to protect rights and safety; and
• a buyer, investor or successor in a genuine corporate transaction, subject to confidentiality, due diligence minimisation and notice where law requires it.

Belom does not disclose one Provider’s client data to another Provider for that other Provider’s marketing. Public content is visible according to the publishing settings selected by its owner.

Some service providers or their support teams may process data outside the European Economic Area. Belom records the service, processing role and relevant location for each production provider. Where the destination is not covered by an adequacy decision, Belom uses an available lawful mechanism, such as European Commission Standard Contractual Clauses, together with supplementary measures where required.

You may request information about the applicable safeguards and a copy or summary of relevant transfer terms from hello@belom.app. Commercially confidential or security-sensitive details may be redacted without hiding the substance of the safeguard.

Belom keeps personal data only for the shortest period needed for the purpose, Provider instructions, security, legal obligations and claims. The current application and Estonian accounting baseline use the following limits:

Active accounts, client relationships, bookings, messages and content are generally retained while needed to provide the service. After closure or deletion, limited account, payment, invoice, refund, consent, legal-acceptance, complaint, fraud and audit evidence may be kept for the applicable tax, accounting, consumer, anti-fraud and limitation periods or an active legal hold. Provider transaction records are otherwise kept under the Provider’s lawful instructions, except for limited evidence Belom must retain for its own security, complaint or legal obligations.

Erasure may mean deletion, irreversible anonymisation or separation from active systems. Residual encrypted backups are protected from normal use and removed through the backup cycle unless preservation is legally required.

Belom uses rules and statistical or AI-assisted signals to detect bots, fraud, delivery problems, unusual activity, availability, rebooking opportunities and operational insights. Providers may use filters or suggestions to organise work. These tools may prioritise or propose an action, but Belom does not use solely automated processing to make a decision about a Client that produces legal or similarly significant effects.

If Belom later introduces such a decision, the affected person will receive specific notice of the logic and likely consequences and any legally required right to human intervention, express a view and contest the decision before it is used.

Belom uses measures proportionate to the data and risk, including role-based access, workspace isolation, secure session cookies, encryption of selected connected-account credentials, access and action logging, input validation, rate limiting, redaction of common secrets and contact details from diagnostics, restricted production access, backups and incident response.

No system is completely secure. Users must protect credentials, devices and exported data, grant the minimum workspace permissions and notify hello@belom.app promptly about suspected compromise. If a personal-data breach creates a legally reportable risk, the responsible controller will notify the authority and affected people within the required period.

Depending on the law and processing, you may have the right to:

• receive clear information and access a copy of your data;
• correct inaccurate or complete incomplete data;
• request erasure or restriction;
• receive data you supplied in a structured, commonly used, machine-readable format and transmit it where portability applies;
• object to processing based on legitimate interests and object at any time to direct marketing, including related profiling;
• withdraw consent at any time for future processing;
• obtain human intervention and contest an applicable solely automated significant decision; and
• complain to the data-protection authority where you live, work or believe an infringement occurred.

For service records, first contact the Provider named in the booking or profile because it normally controls that client relationship. For Belom-controlled data, or if you cannot reach the Provider, email hello@belom.app. We may verify identity and authority, ask you to narrow an unclear request, and coordinate with the other controller. Exercising a right is free unless a request is manifestly unfounded or excessive as defined by law.

Because Belom’s operator is established in Estonia, its lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia. You may instead complain to the competent authority where you live, work or believe the infringement occurred.

Belom is designed for service businesses and people arranging services, not for children to create professional accounts independently. A parent or guardian should make a minor’s booking and provide health information where applicable law requires it. If Belom learns that a child’s data was collected without required authority, it will work with the responsible Provider to restrict or erase it.

Providers choose what to publish on profiles, portfolios, reviews, blog posts and custom domains. Public content can be copied or indexed by others even after removal, so users must not publish confidential client data without a valid basis. Links and loaded embeds lead to services with their own privacy practices; this Policy does not cover their independent processing.

We will update the version and review date when this Policy changes. Material changes will be highlighted or notified through an appropriate channel before they take effect where required. New consent will be requested when a new purpose cannot lawfully rely on the existing basis. Historical consent and policy-version evidence is retained for accountability.

Questions, requests or complaints may be sent to hello@belom.app, by telephone at +372 5553 8800, or by post to the registered office stated in section 1. Because marnei OÜ is established in the EEA, an Article 27 EEA representative is not required. Belom has assessed its current processing scope and has not appointed a Data Protection Officer. Privacy matters are handled through the contact above. Belom will reassess this position if the nature, scope or scale of processing changes. You may complain directly to a competent supervisory authority without completing Belom’s internal process first.