Privacy Policy

1. Information We Collect

We collect information you provide directly:

• Account information: name, email, phone number, business name
• Business and provider profile data: bio, services, pricing, and portfolio links
• Client data: names, phone numbers, and email addresses you provide
• Message content: conversations between you and your clients
• Calendar data: availability settings and event data from Google Calendar or Outlook, when connected
• Uploaded files: booking references, conversation attachments, business verification images, and documents
• Document records: drafts, versions, signer details, signatures, signing timestamps, technical audit records, and completed copies
• Managed texting setup: public business website, country, business type, contact details, and preferred area code
• Dino Weekly: the email address you submit, consent and confirmation history, and unsubscribe or delivery-suppression status

2. How We Use Your Data

• To provide configured AI assistance with setup, business work, and client-message drafts
• To personalize AI assistance using business information, saved context, examples, and feedback within the enabled AI settings and permissions
• To process deposits and payments via Stripe
• To send booking confirmations, reminders, and notifications
• To create, customize, store, and share documents and deliver signed copies to the designated client and business
• To check uploaded files for malware and keep connected calendars aligned with your bookings
• To review business texting requests and coordinate setup requirements with you
• To comply with legal obligations (TCPA, GDPR, CCPA)
• To send Dino Weekly only after you request it and confirm your address; you can unsubscribe without changing essential account or booking emails

3. Data Storage & Security

Data is transmitted over encrypted connections and stored with our cloud service providers. We use access controls, bcrypt password hashing, and encryption for supported provider credentials such as Google Calendar and Meta access tokens.

4. Third-Party Services

We integrate with third-party services to provide core functionality:

• Stripe — payment processing (see Stripe’s Privacy Policy)
• SignalWire — SMS and managed business-texting delivery
• Google — optional sign-in, Calendar sync, and Google Meet links (see Section 5)
• Microsoft — Outlook calendar sync (if connected)
• Resend — transactional email, including signed-document copies, and the separate, opt-in Dino Weekly newsletter
• DeepSeek / OpenAI — AI language model processing
• Cloudflare R2 — private storage for uploaded files and retained signed documents
• Cloudmersive — malware scanning of uploaded file contents before acceptance
• Tavily — public-source search when you request it; your search query is sent to the provider
• Sentry — application error monitoring
• Meta (Facebook / Instagram / Messenger) — social messaging integration (see Section 6)

5. Google Account and Calendar Data

Google sign-in uses your account identifier, name, email address, and email verification status to identify and protect your Dino account. Connecting Google Calendar is a separate, optional step. Dino stores encrypted access credentials and the connected calendar identifier to maintain that connection.

Calendar sync reads event identifiers, titles, times, and availability status to show outside busy times and prevent scheduling conflicts. Dino stores the relevant event identifiers, titles, and time ranges. It sends booking titles, descriptions or notes, and appointment times to Google when creating or updating synced bookings. Cancelling a synced booking can remove its corresponding Google event. For services configured with Google Meet, Dino requests a meeting link and stores it with the appointment.

Google data is used for the sign-in and scheduling features you enable. It is not sold or used for advertising. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect Google Calendar in Dino to remove its stored access credentials and imported busy times. This preserves your Dino bookings and existing Google events. You can also revoke access in your Google Account connections. Revoking access stops future access but does not itself erase records already stored in Dino. To request deletion of retained account or document records, use the contact details in Section 9. Retention is described in Section 10.

6. Meta / Facebook / Instagram / Messenger Integration

Dino Booking integrates with Meta Platforms (Facebook, Instagram, and Messenger) to let you manage Instagram DMs and Facebook Messenger messages, with optional assistant help. When you connect a Meta channel, we process and store:

• Your Facebook Page ID and Page name
• Your Instagram professional account ID and Instagram handle
• Message content and sender IDs (IGSID / PSID) for conversations
• A Page access token, encrypted at rest with AES-256-GCM

Message data is sent to Meta’s Graph APIs (the Instagram Messaging and Messenger Send APIs) to deliver your replies and receive inbound messages. Meta’s handling of this data is governed by Meta’s Privacy Policy. To disconnect or request deletion of this data, see our Data Deletion page.

7. SMS & Communications

When clients message you, their phone number, message content, and any images they share are processed to provide the Service. We maintain opt-in/opt-out records for TCPA compliance. Clients can text STOP to opt out at any time, and HELP for assistance. You are responsible for obtaining and managing appropriate consent for client data you provide to the Service.

8. Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings, though some features may not work properly if cookies are disabled.

9. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access, correct, or delete your personal data
• Export your data in a portable format
• Restrict or object to certain processing
• Withdraw consent at any time

To exercise these rights, contact us at support@dinobookingtool.com or visit our Data Deletion page.

10. Data Retention

We retain data while an account is active and as needed to provide the Service, resolve disputes, prevent abuse, and meet financial or legal recordkeeping duties. Verified deletion requests are handled through support. Depending on the record, we delete or anonymize personal data; records that must be retained are restricted, and backup copies age out through the normal backup cycle. We confirm the scope and expected timing when a request is verified.

11. Changes to This Policy

We may update this policy. Material changes will be communicated via email and/or in-app notification. Continued use after changes constitutes acceptance.

12. Contact

Privacy questions? Reach us at support@dinobookingtool.com.