Who is responsible for data
Vuzol is a service for service businesses that helps receive leads, appointments, orders, customer records, and notifications. For privacy questions, access, correction, export, or deletion requests, contact [email protected]. If you are an end customer of a business that uses Vuzol, some requests about your appointments or orders may need to be handled by the owner of that account.
Categories of data we collect
We may process account data: first name, last name, email, phone number, profile photo, password hash, role, plan, plan expiration date, language preference, Telegram ID, Telegram username, Telegram phone, Google Account ID, and minimum Google profile data for sign-in. We also process business data: name, slug, logos, images, contacts, addresses, colors, products, categories, prices, services, team members, schedules, closed dates, customers, appointments, statuses, reviews, and notes. Technical data may include IP address, user agent, request URL, session cookies, security logs, webhook payloads, delivery logs, and Cloudflare Turnstile verification tokens.
End-customer data
When an end customer submits a lead, places an order, books a time, cancels an appointment, leaves a review, or authorizes through a public Telegram bot, we process the data they provide to create an appointment, order, customer record, booking history, and notify the relevant business. The account owner is responsible for the lawful collection of their customers' data and for responding to customer requests where the owner determines the purpose of processing.
Purposes of use
Data is used for registration and sign-in, session protection, operating the dashboard, CRM, calendar, public booking, storefronts, webhook delivery, Telegram notifications, customer history, available slot display, review processing, user support, error diagnostics, abuse prevention, performance of the agreement, and legal requirements.
Public visibility and user content
Information that an account owner publishes in a storefront or online booking page may be visible to anyone with the link or subdomain: business name, slug, description, contacts, address, photos, logo, products, services, prices, team members, reviews, and available slots. Do not add data to public fields if it should not be public.
Sharing and service providers
We may share data with providers needed to operate Vuzol: Google Cloud Run, Firestore, and Google Cloud Storage for hosting, database, and files; Google Identity Services or Google OAuth for sign-in; Telegram for notifications; Cloudflare Turnstile for automated abuse protection; an SMTP provider for email; Monobank for payments, subscriptions and refunds; and services explicitly connected by the user through webhooks or integrations. We do not sell personal data and do not share it with advertising networks, data brokers, or services for hidden profiling.
Google APIs, Google Sign-In, and limited use
For authorization and registration with Google, Vuzol requests only the minimum necessary permissions, typically openid, email, and profile. We use Google user data only for user-facing features: account creation, sign-in, email verification, displaying a name or profile photo, and account protection. Use of data obtained from Google APIs complies with the Google API Services User Data Policy, including Limited Use: we do not sell this data, use it for advertising, retargeting, personalized advertising, credit-worthiness evaluation, hidden profiling, or surveillance, and we do not transfer it to third parties except to provide or improve a visible Vuzol feature, protect security, comply with law, as part of an asset transaction with appropriate consent, or with the user's explicit consent.
Cookies, sessions, and permissions
Vuzol uses necessary cookies and server-side sessions for sign-in, security, language selection, Telegram frontend mode, and dashboard operation. We do not use cookies for hidden advertising profiling. We do not request Google permissions for speculative future use; if a new feature requires additional scopes or unexpected data, we will update this policy and request separate consent where required.
Security and secrets
We use reasonable technical and organizational measures: HTTPS, session protection, password hashing, CSP nonces, CSRF protection, Turnstile on sign-in and registration forms, restricted environment access, Secret Manager for production secrets, diagnostic logs, and role separation. Telegram tokens webhook URLs, and other integration secrets may be stored to deliver notifications. No transmission or storage method is completely secure.
Retention and deletion
Data is retained for as long as needed to operate the account, provide features, maintain security, restore backups, resolve disputes, or comply with law. Users may contact [email protected] to request access, correction, export, or deletion, and may revoke Vuzol's access to their Google Account in Google settings. Deleting an account removes related data from the active system; limited records may temporarily remain in backups, security logs, or where required by law or legitimate interests.
International processing and children
Data may be processed on provider infrastructure, including Google Cloud, in regions where those services operate. Vuzol is not intended for children and is not directed to persons under 13 years old or below the age of digital consent in the relevant jurisdiction. If you believe a child has provided personal data to us, contact [email protected].
Changes to this policy
We may update this Privacy Policy as features, laws, or platform requirements change. If changes materially affect data use, we will provide prominent notice or request renewed consent where required.
Зміни політики
Ми можемо оновлювати цю Політику конфіденційності відповідно до змін функціоналу, законодавства або вимог платформ. Якщо зміни суттєво впливають на використання даних, ми надамо помітне повідомлення або попросимо оновлену згоду, коли це потрібно.