Privacy policy

What we do not keep

We do not keep a password: an account has none. The only phone number of yours we keep is one you give us yourself, as said below. We keep the email address of the Google or Apple account you sign in with, and nothing signs you in by it. We do not ask for your location, your contacts, your date of birth or your gender. We never ask for official personal documents and do not accept them.

Your phone number, and messages to it

Where the app asks for it, you give a phone number when you send a booking request, or before that in Account. It is for us to reach you about your bookings. We ask for it when you book and not when you sign up, and you can change it or take it off in Account at any time. We send it the code that proves the number is yours. For a booking with a business in the United States we also send a text when the business cancels your visit or asks to move it and, where the business is on Pro, a reminder before the visit: each is a copy of a notice that is already in the app. Nothing else is sent to it, and if that changes we will say so here first.

No business and no other user is ever shown your number, and it is never a way to sign in. We do not sell it, we do not share it with anyone for their marketing, and we do not use it for marketing of our own. The code is sent on WhatsApp, which is run by Meta, or by text message through Twilio, depending on your number's country, and the texts about a booking through Twilio: each is given the number and the words of the message, to deliver it. Of the code we keep only a scrambled form, for ten minutes. The number is removed when you take it off or delete your account.

Your account

The name you give, the language of your app, the area you choose from our list, and your settings. When you sign in with Google we take only Google's number for your account and keep a scrambled form of it, which lets us recognise you and tells us nothing else. We also take the name on your Google account, which gives a new account its name and which you can change, and its email address. With Apple it is the same: a scrambled form of Apple's number for your account, the name Apple hands us at your first sign-in if you share it, and an email address, which is your own or, if you choose, one Apple makes up that passes our mail on to you. We keep the address so that you can see in the app which account opens yours, so that our team can help you if you cannot get in, and so that we can write to you about your account and the service. We will not send you offers or news by email unless you have said we may, and the address is never shown to a business or to another customer. For a passkey (signing in with your fingerprint or face) we keep its public half, which cannot sign anyone in by itself.

For each place you are signed in we keep when it was last used, whether it is an Android phone, an iPhone or a browser, and a scrambled mark of the app's installation. A sign-in ends by itself after 90 days without use. If you allow notifications, we keep your phone's notification address so that we can reach it.

What you do in the app

Your booking requests: the business, the service, the day and time, the note you write, how many people, and for a home visit the area only (you give the address yourself, in a message). Your reviews, the businesses you save or block, the reports you make, and the notices we have sent you.

Your messages with a business and the pictures in them. A thread closes a week after the visit and is deleted, with its pictures, 90 days after it. Our team cannot read your conversations. When one of you reports a thread, the team sees its last 20 messages as they stood, and that copy is kept with the report.

The picture you send with a request is seen only by that business and is deleted 90 days after the visit, unless it became part of a tailor's order. After a finished visit the business may say what it was paid, and on a paid plan may add a photo of the finished work. Both are kept on your booking, for you and that business only. The amount is the business's own word: we take no money and cannot confirm it. The photo is deleted 12 months after the visit, or sooner if you delete your account or the business closes. Your record says when the business changed an amount or took it back. If you say an amount is not what you paid, that is kept beside it, for you and that business only. You can remove the photo from your record at any time, and it is then deleted. The line for the visit in your history (the business, the service, the day, the price and what the business said it received) stays for as long as you have your account, and you can save your history as a file from the app.

Questions you ask in Help. A question typed into the search is answered from answers we wrote and from your own account. It is not kept with your name; when no answer fits, its words are counted, with nothing about who asked, so that we know which answers to write. A question you send to our team is kept with its answer until you send another or delete your account; the team sees your name and, if you belong to one, your business. A bug report or a feature request you send is kept, with the version of the app it came from, until the team has dealt with it or you delete your account. Long numbers, such as a phone number or a code, are taken out of what you send before it is kept.

If you run a business

Your page: name, trade, description, area, opening hours, services, prices and photos. This is public, on the website and in search engines. The names of your team, your plan, and the records you keep in the app (walk-ins, tailors' orders and measurements, your day book), which only your business sees. A contact number, if you give one, is for our use only: our team may write to you on it, on WhatsApp, from our one company number, for example about your plan, and may send it a code so that you can show the number is yours. It is never shown to customers or to anyone outside our team.

When you pay for a plan, the number that pays is passed to the payment partner and we keep only a masked form of it, with the amount and the date. We never see or keep a card.

Who sees what

A business you send a request to sees your name, your request and your note, how many visits you have had with it, how many times you did not come to a booking anywhere in the last 12 months, and how many confirmed visits you cancelled yourself with less than 24 hours to go in those 12 months. It is never given a phone number. Your review is public with your first name and the first letter of your last name. Our team sees your name, how you sign in, the state of your bookings, and reports about you; it does not see your notes or your conversations.

Counting without names

We count, by day, how often an area is searched, how often a business's page is opened, and how many requests are made and how they end. When a search in the app finds no business at all, we keep the words that were typed and how often, to learn what people look for that we do not have; nothing with a digit or an @ in it is kept. These are totals with no record of who. We also count, by month, how many accounts were made, how many of them made a request in each later month, how long businesses took to answer, the page prices of the visits that happened and what businesses said they received, and whether a new account's phone first opened the app through a link to a business. After each month ends these totals are written down once and kept, to run the service and to show how it is doing. They stay after an account or a business is deleted, because nothing in them says whose they were. The website counts which kind of page was opened and whether the visitor came from a search or a shared link, using a random number that lasts for one browser tab. The website sets no cookies. To limit abuse we keep scrambled marks of an installation or an internet address for two or three days.

Who else handles your data

Teofil runs on Google Cloud, and its database is kept in Belgium. Google delivers our notifications to your phone, which means it handles the words of each notice; a notice about a message says only who it is from. If you sign in with Google, Google knows that you did, and the same goes for Apple. A payment partner handles plan payments. Where a business takes cards in the app, the payment partner for those cards is Stripe: you type your card on Stripe's own page, the payment is made on the business's own account there, and we never see or keep the card. Of a card payment we keep the amount, the day and the booking it was for. When a business sets up card payments we pass Stripe its name, the address of its page, its trade, and its owner's name and email address, so that the owner is not asked for them again; whatever else Stripe needs, it asks for itself. A code or a message to a business's contact number is sent through WhatsApp, which is run by Meta. The code to a customer's number goes the same way, or by text message through Twilio. Like any web service, our host's logs record the internet address of each request. Nobody else receives your data, unless the law obliges us to give it. We may show our totals, which name nobody, to people considering investing in or buying the service. If the service is ever sold or joined with another, what we keep about you would pass to the new owner only under the promises on this page, and we would tell you in the app before it did, so that you can delete your account first.

How long we keep it

Notices are kept for 12 months. Conversations are deleted 90 days after the visit. A booking is kept while either the customer or the business still has an account, as described below, and is deleted once both are gone. A visit you did not come to, and a confirmed visit you cancelled with less than 24 hours to go, are counted for businesses for 12 months and not after. Reviews, reports and plan payments are kept for as long as the account or the business they belong to, and as described below after that. Our backups are deleted after 90 days.

Deleting your account

You can delete your account in the app, under Account, or on this website. Your account, your sign-ins, your saved businesses, your notices and your conversations are removed at once, and your open bookings are cancelled. Your past bookings stay with the business, which keeps the service, the day, how the visit ended and what it said it received. They lose your name, your note, your pictures, what you asked to have made, the occasion, the area of a home visit, and any measurements or amounts a tailor had shown you on them. The line written in the business's day book for a visit no longer names you. A booking at a business that has already closed is deleted. Your reviews stay without your name. If you sign in with Apple and do so once more as you delete your account, we also end the sign-in at Apple.

One thing is kept so that deleting an account does not wipe it: if a business marked you as not coming to a visit in the last 12 months, or you cancelled a confirmed visit with less than 24 hours to go, the dates of those visits are kept against the scrambled form of your Google or Apple account, with nothing else, and count again if you open a new account with it. Each is deleted when it is 12 months old. An account opened with a passkey alone leaves nothing of the kind. Reports that were made stay, with the messages attached to them. The record of a card payment you made stays too: the amount, the day and the booking, with no name and no card. A business's own records of you, such as a tailor's measurements, stay with that business until it removes them. Copies in our backups go within 90 days.

When a business is closed, its page, photos, reviews, tailors' orders, day book and conversations are removed, and so are the walk-ins it wrote down, with their names and numbers. Past bookings made in the app are kept for the customers who still have an account, without the business's pictures; those of customers who have deleted their account are removed. Records of plan payments are kept. So are the daily counts of how often its page was opened and how many requests it had, with its trade, its area, its plan and the days it started and closed, and without its name.

Your choices and rights

You can change your name and settings, turn notifications off, see and end the places you are signed in, and delete your account, all in the app. You may ask us for a copy of what we keep about you, to correct it, or to stop using it. Ask from inside the app: open Account, then Help, and choose "Ask our team". You are signed in there, so we know the account is yours; an email cannot show us that, because an email address is never a way in to an account. In the app a customer can also save their history as a file, and a business a copy of its records. If you can no longer open the app, write to privacy@teofil.app, and we will ask you to sign in before we send or change anything. You may also complain to the data protection authority of your country.

Children

Teofil is for adults. We do not knowingly keep an account for anyone under 18. An adult may book for a child in their care; the business sees only the booking.

Changes

If we change this policy we say so in the app before the change applies.