Draft for review · 9 September 2026. This notice must be completed and matched to the deployed service before publication.
1. Who operates Zaynat
Zaynat.app is operated by Luca Kozak, a UAE freelancer licence holder registered in Abu Dhabi. Where Luca Kozak determines the purpose and means of personal-data processing described here, he is the responsible controller.
Privacy contact: luca@zaynap.app [confirm spelling]. Registered business address, licence number and issuing authority: [complete in Legal Notice].
A "Partner" is an independent business using Zaynat for bookable services. Partners normally control their own use of customer information for providing treatments and meeting their legal obligations. Zaynat may act as a processor when hosting a Partner's records solely on its instructions, and as an independent controller for platform accounts, security, subscriptions and support. The exact relationship depends on the processing activity, not the branding on the screen.
2. Important information about the current demo
The current prototype stores its simulated accounts, appointments, Partner settings, callback/support requests and much of its analytics in the browser used to access it. Submissions are not yet delivered to a shared operational inbox through Supabase. A demo callback or support receipt confirms local saving only; it does not mean Luca has received the request remotely.
People with access to the same browser profile may be able to access its saved data and demo roles. The demo is not an appropriate place for real customer databases, health information, payment information or confidential business material. Do not reuse a real password in a demo account: prototype credentials are stored in browser data and are not production authentication.
Browser-local storage does not mean there are no external network connections. Hosting, map and image providers may receive normal request information when their content loads. The Google Maps API key identifies the operator's project; it is not a customer credential.
Supabase account authentication, shared storage, server-enforced permissions and shared analytics are planned, not presently described as operational. The production disclosures below must be finalised when those services are selected and connected.
3. Information used by the platform
Depending on the features you use, relevant information includes:
- Account details: name, email, telephone number, account preferences and authentication information; optional date of birth where provided.
- Booking details: selected Partner, service, professional, appointment time, status, history and any notes you choose to provide.
- Partner and staff details: business identity, professional contact information, licence information where requested, authorised users, services, schedules and uploaded branding.
- Enquiries: callback contact details, preferred callback information you provide, support subjects/messages and status updates.
- Public content: reviews and business listing information, including publicly available contact details and coordinates.
- Technical information: browser/device characteristics, request and error information, and pseudonymous interaction events as described below.
At the present launch model, you pay Partners directly. Zaynat does not collect full payment-card details for customer bookings. Do not send passwords, card numbers, identity documents or unnecessary health information through support or callback forms.
4. Purposes and applicable grounds
Information is used where necessary to respond to a request, provide an account or booking feature, allow a Partner to deliver a service, operate the platform, protect its security, manage subscriptions or comply with applicable legal obligations. Where processing relies on consent, we will explain the purpose and obtain consent in the manner required by applicable law. Withdrawal of consent will not make earlier lawful processing unlawful.
Before production, each processing purpose must be mapped to a valid ground under the applicable UAE data-protection regime. We do not treat a generic "legitimate interests" label as a substitute for identifying an applicable legal ground. We do not treat acceptance of Terms as blanket consent to optional tracking or promotional communications.
A callback request authorises a response about that enquiry, not unrelated promotional campaigns. Partner marketing features must not be used until the relevant legal requirements and platform controls have been established. No marketing permission is inferred merely from making a booking, leaving a review or asking for support.
5. Accounts across Partners
Your Zaynat view can show your own appointments across participating Partners. A Partner-branded account view limits the displayed appointment history to that Partner. This visual choice is not permission for Partners to share customer databases with one another.
In a production service, Partners and their authorised staff should receive only the information needed for their services and responsibilities. Platform administrators may need proportionate access to investigate support issues, operate the service or satisfy legal duties. The current demo role switcher is not a production access-control mechanism.
6. Analytics, cookies and browser storage
The prototype's customer-journey tracker records a random browser visitor ID, session ID, session start, event time, page path without query parameters, a limited traffic-source label, device category, and whether the browser is new or returning. Relevant events can also identify the business, service, professional, booking and CTA. It tracks checkpoints such as landing views, service selection, booking submission and confirmation.
The tracker is designed not to collect form contents, customer names, email addresses, phone numbers, full referring URLs or complete query strings. Technical diagnostics are a separate feature and need their own checks against unintended personal information in error messages.
A session expires after 30 minutes of inactivity. Reports identify a browser, not a verified individual across devices. The local event store is capped at 20,000 events; records older than 90 days are pruned during subsequent event writes, rather than by a continuously running deletion service. A pending booking may retain its attribution context so a later confirmation can be associated with the original journey.
The current tracker respects a detected Do Not Track or Global Privacy Control signal. These controls apply to that tracker; they do not necessarily disable third-party maps, images or hosting logs. Browser settings let you remove site storage, which also removes local demo accounts and settings. Customer account deletion is not currently a comprehensive deletion of every independent analytics or enquiry storage key.
Before production, provide any legally required choice for non-essential analytics or third-party technologies and ensure collection follows that choice. A privacy notice by itself does not implement a consent mechanism.
7. Providers and external content
The deployed configuration determines which external providers receive data:
- GitHub Pages: the current static hosting service receives technical information necessary to serve pages, subject to its own service arrangements.
- Google Maps: displaying a map contacts Google. Live Places searches, where enabled, send the search/location parameters needed for that feature. The current database-pin view can use saved directory coordinates without making live Places searches. Google may process technical information under its relevant terms and privacy policy.
- Image providers: loading remote images, including Unsplash images, sends requests to those hosts. Some fonts and images may instead be served with the site assets.
- Sentry: remote error reporting activates only if configured for the deployed build. Otherwise the prototype uses a local error log. Confirm its actual configuration, fields and retention before publication.
- Supabase, messaging and billing providers: these are planned or to be selected. Add their actual services, processing locations, contractual roles and transfer arrangements before enabling them for personal information.
A listed provider is not automatically a processor for every purpose. External sites opened through a phone, website or map link have their own notices and practices. We do not sell private booking or account records as a feature of Zaynat; any future materially different sharing requires appropriate notice and a lawful basis.
8. Public directory information
The directory includes attributed OpenStreetMap business information. Only records with a usable phone or website are currently displayed. Inclusion is not proof of a contractual partnership or permission to send marketing. A business contact may also be an individual's personal information.
If a listing concerning you is inaccurate or should be reviewed, contact the privacy address with the listing and reason. We may need reasonable evidence of authority to act for the business. We can review our display and explain where source corrections should be requested. Third-party attribution and licence requirements continue to apply.
9. Retention and deletion
The current demo's core records and enquiries generally remain in local browser storage until removed by the relevant feature or by clearing site data. They are not centrally archived by the prototype inbox. Error and analytics stores have their own limits. Removing data in one browser does not delete copies held by an independent Partner or technical information lawfully held by a hosting or other provider.
Production retention schedule — to finalise before launch: define periods and deletion triggers for active/inactive accounts, booking records, enquiries, security logs, analytics, invoices and backups. Retain information only as needed for the disclosed purpose or a specific lawful retention requirement. Unresolved disputes or legal duties may justify retaining particular records; they do not justify keeping all data indefinitely. Communicate meaningful limitations when responding to a deletion request.
10. Your requests and choices
Subject to applicable law and its conditions, you may request information about processing, access to your information, correction, deletion, restriction or cessation of certain processing, and transfer of data where applicable. You may withdraw consent where we rely on it, and raise concerns about relevant automated processing where such rights apply.
Send requests to the privacy contact in section 1. We may ask for proportionate information to verify identity, but do not send identity documents unsolicited. We will explain where a request must be handled by a Partner acting as a separate controller and assist within our responsibilities. We will respond within the period required by applicable law and explain any lawful limitation or refusal. You may complain to the competent data-protection or other authority.
11. Security, international processing and children
We will use safeguards appropriate to the actual service and risk. No internet service is completely secure, and a notice cannot substitute for technical safeguards. Before commercial launch, production authentication, access controls, staff permissions, incident response and deletion procedures must be implemented and checked. Do not infer that the demo has those protections.
Provider processing may occur outside the UAE. We will identify actual production locations and use the transfer safeguards required by the applicable legal regime before making a restricted transfer. We do not promise that all data stays in the UAE merely because the operator's licence is registered in Abu Dhabi.
The platform is not intended for children to create independent accounts. Where a guardian lawfully arranges a permitted appointment for a minor, minimise the minor's information and follow the Partner's relevant consent requirements. Contact us if information about a child has been provided inappropriately.
12. Updates
Publish an effective date and version for this notice. Material changes to data use, providers, international processing or rights procedures will be communicated appropriately. Where a change requires consent, an updated notice alone will not be treated as obtaining it.