- •We only collect what a booking needs: name, phone number, (optionally) email and the booking details.
- •When a customer books, that data belongs to the business; NopeQ keeps it only on the business's behalf.
- •We never sell personal data and we don't use advertising trackers.
- •Data is stored on secure cloud servers (Supabase, Vercel). Card payments go through Stripe — we never see card numbers.
- •You can ask to see, correct or delete your data at any time, under Sri Lanka's Personal Data Protection Act No. 9 of 2022 and, where it applies, the GDPR.
This summary is for convenience only. The full text below is what applies.
This policy explains how Ravion Studio (“we”) handles personal data in NopeQ. It covers business owners and staff who use the dashboard, and customers who book, order, chat or rate on a business's NopeQ page. We follow the Sri Lanka Personal Data Protection Act, No. 9 of 2022 and, for people in the European Economic Area and the UK, the GDPR.
1. Who is responsible for your data
- For business accounts (the owner's login, business profile, billing): Ravion Studio is the controller.
- For customer data a business collects through NopeQ (bookings, orders, AI chats, ratings, reminders): the business is the controller and Ravion Studio is its processor. We use that data only to provide NopeQ to the business, on its instructions, and never for our own marketing. If you are a customer and want to see or delete your booking data, you can ask the business directly or ask us and we will pass the request on.
2. What we collect
| Who | Data | Why |
|---|---|---|
| Business owners | Email, password (stored hashed by our auth provider), business name, type, address, phone, WhatsApp, social links, logo and photos, services, prices, hours, staff names, branches | To create the account and show the public page |
| Business owners | Plan, payment references and bank-transfer slips; for card payments a Stripe customer ID (no card numbers) | To run the subscription and keep accounting records |
| Customers | Name, phone number, optional email, chosen service, date and time, notes; for some businesses: reference photos, body placement (tattoo), pet name, species, breed and reason for the visit (vets) | To make and manage the booking or order |
| Customers | Messages written to the AI receptionist | To answer and book; the business can read the chat |
| Customers | Star rating and comment, first name shown publicly | To show reviews on the business page |
| Everyone | Push-notification token if you allow notifications; country from your IP address; basic technical logs (browser, errors) | To send reminders, show your language and local prices, and keep the Service secure |
3. How we use it
- to provide the Service: booking pages, calendars, confirmations, reminders, next-visit reminders, QR posters, reports and the AI receptionist;
- to send service messages by email, push notification and WhatsApp about a booking, an order, or the account;
- to take payments and prevent fraud and abuse;
- to fix problems and improve NopeQ using aggregated, non-identifying statistics.
Our legal bases are: performing our contract with businesses, the business's legitimate interest in managing its bookings, our legal obligations (for example tax records) and, for push notifications, your consent — which you can withdraw at any time in your phone or browser settings.
We do not sell personal data, we do not use it for advertising, and we do not use customer data or chats to train AI models.
5. International transfers
Our providers run data centres outside Sri Lanka (for example in Singapore, the United States or the EU). When data leaves Sri Lanka we rely on the providers' contractual and security safeguards, and where GDPR applies, on standard contractual clauses.
6. How long we keep it
- Business accounts are kept while the account is active. If you ask us to delete your account, we delete the business and its customer data within 30 days, except records we must keep for tax or legal reasons.
- Bookings and orders are kept for the business's history until the business deletes them or closes its account.
- AI chats are kept for up to 12 months so the business can review them.
- Payment slips and payment records are kept for as long as tax law requires (usually up to 6 years).
- Push tokens are removed when they stop working or when you turn notifications off.
8. Security
Data is encrypted in transit (HTTPS). Each business can only see its own data, enforced by database row-level security. Payment slips are kept in private storage. Card details are handled by Stripe and never touch our servers. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
9. Your rights
You can ask us to:
- tell you what data we hold about you and give you a copy;
- correct data that is wrong;
- delete your data, or stop or limit how we use it;
- withdraw consent (for example for push notifications);
- move your data to another service where that is possible.
Contact us through our contact page. We will reply within 30 days. You may also complain to the Data Protection Authority of Sri Lanka, or to your local data protection authority if you live elsewhere.
10. Children
NopeQ is not meant for children to use on their own. Business accounts are for adults. If a child's details are booked (for example a kids' haircut), the parent or guardian making the booking is responsible for it.
11. Changes
We may update this policy. Important changes will be shown in the dashboard or sent by email before they take effect. See also our Terms of Service.
12. Contact
Ravion Studio, Kuliyapitiya, Sri Lanka. Data protection questions: through our contact page.