Privacy policy

1. Who is responsible

DashDotSystems SH.P.K. (NUI 812460880), Ramë Bugujevci 5, Fushë Kosovë, Kosovë ("Termino", "we") is the data controller for your account and your use of the platform. Privacy contact: termino@dashdotsystems.com.

The business you book with is a separate controller for the booking data it receives. For bookings the business enters itself, team notes and notes about clients, Termino acts as a processor on the business’s behalf.

We follow the Law on Protection of Personal Data of the Republic of Kosovo (No. 06/L-082). For people in the European Union and the EEA, the GDPR applies as well.

2. What we collect

• Account: phone number, name, email (to sign in and, once you confirm it with the link we send, for password reset links), password (stored only as a salted hash — we never see the password itself), language, reminder settings, marketing consent, and which version of the terms you accepted and when (including your age confirmation).
• Bookings: business, service, staff member or resource (for example a pitch), date, time and length, the price worked out, party size, status, whether it is part of a weekly booking, the note you write to the business, cancellation reasons, proposals and change history.
• Waitlist, saved places and the reviews you give (rating, tags and comment).
• In-app notifications and your device’s notification token (for push).
• Chats with businesses: the messages (text, time, whether they were read), and the blocks and reports you make.
• Technical and security data: IP address, device/browser type, logs of sign-ins and important actions, and a log of messages sent (recipient and type, not the content).
• For business teams: your role in the business, and the business’s details (name, address, phone, hours, services, photos).

Passwords, verification codes, password reset and email confirmation links are stored only hashed, never in plain text.

3. What we do not collect

We do not collect your location, contacts, card or payment details. We use no ads, advertising cookies or tracking analytics. The app asks for calendar access only when you choose "Add to calendar", and only to add the appointment.

4. Why we use it, and on what legal basis

• To identify you, and to create and manage bookings, the waitlist and reminders — performance of our contract with you.
• For security and to prevent abuse and fraud (for example limits on SMS codes and bookings) — our legitimate interest.
• Push notifications — the consent you give on the device; withdraw it in Settings or in the device settings.
• To send you marketing messages — only with your consent, which you can withdraw at any time.
• To record which version of the terms you accepted, and when — legal obligation and our legitimate interest in being able to show it.
• To meet legal obligations and requests from authorities — legal obligation.

We make no decisions based solely on automated processing that have legal effects on you. The rule that new customers need approval is set by the business.

5. What the business sees

The business you book with sees your name and phone number, the booking and your note, the review you give it and your history with it (appointments, late cancellations, no-shows). The business may keep internal notes about you, which are not shown to you. Staff with the lowest role see your number masked. The business does not see your email.

Public reviews (not the "Only for the business" ones) can be seen by anyone on the business page, with your first name and last initial, the date, the rating, the comment and the business’s reply. If you report a review, we keep the reason and your account so we can look at it; the business and the author do not see who reported it.

If you write to a business in the chat, its team (owner, managers and staff) sees your name and your messages.

6. When someone else or the business books for you

When a business enters a booking or a weekly booking for you (by phone or walk-in), or someone else books for you, we receive your name and number from them, not from you. We use them only for that appointment: we may send the confirmation, changes and reminders to that number. Whoever booked you should tell you. If you do not want these messages, contact the business or write to us.

7. Business teams and Termino staff

A business’s owner or manager adds team members by their phone number; the team sees each other’s names and roles. We record who in the team took important actions (for example a cancellation), for security and disputes.

Authorised Termino staff look at data only when needed: to answer a support request or a report, for security and fraud, or for a legal request.

8. Service providers

We share data only with providers that help us run the service, who act on our instructions under data-processing agreements:

• Supabase — database and storage of business photos (substantially all the data above), in the European Union (Ireland).
• Hostinger — hosts the website and API server.
• Sent.dm and Infobip — send verification codes and SMS/Viber messages (phone number and message).
• Expo, Google (Firebase Cloud Messaging) and Apple (APNs) — deliver push notifications (device token and notification).
• Our email provider — email confirmation and password reset links and, if you chose them, email reminders (email address and message).

We also share data with authorities where the law requires. We never sell your data.

9. Transfers outside Kosovo

Some providers process data outside Kosovo: the database is in the EU, and Google, Apple and Expo are based in the United States. Where data is transferred, we rely on the safeguards the law requires, such as standard contractual clauses or adequacy decisions.

10. How long we keep it

• Your account and bookings: for as long as you have an account.
• When you delete your account: your name, phone, email, password and notes are removed at once; upcoming bookings are cancelled; past bookings stay with the business only as "Deleted user", with nothing that identifies you.
• Verification codes, password reset and email confirmation links: 1 day. Closed sessions: 30 days.
• Chat messages: for as long as you have an account and the business is on Termino; they are deleted with your account.
• Log of messages sent: 90 days. Read notifications: 180 days.
• Security and activity logs: 2 years, to resolve disputes and for security.
• Database backups are overwritten automatically within their cycle.

Bookings and weekly bookings a business entered itself with your number are the business’s records: ask the business about them.

We may keep data longer where the law requires it, or where we need it for an open security investigation or legal claim.

11. Your rights

Under Kosovo Law No. 06/L-082 on the Protection of Personal Data (and the GDPR where it applies) you have the right of access, rectification, erasure, restriction, portability and objection, and to withdraw consent. Change your name and email in Settings; download your data (a JSON file) or delete your account in Settings, or write to termino@dashdotsystems.com. We answer within 30 days.

You may complain to Kosovo’s Information and Privacy Agency and, if you live in the EU or the EEA, to the data-protection authority of your country.

12. Security

We use encryption in transit (HTTPS), hashed passwords and verification codes, a lock after repeated wrong attempts, sessions with rotating tokens, role-based access and audit logs. On your phone the session is kept in the device’s secure storage (Keychain/Keystore). No system is perfectly secure; if a breach puts you at risk, we tell you and the authority as the law requires.

13. Children

Termino is not intended for people under 16; you confirm your age when you first sign in. When a parent books for a child, the parent is the user and is responsible for the details they enter. If we learn that an account belongs to someone under 16, we delete it.

14. Cookies and on-device storage

We only use strictly necessary cookies and local storage: a secure (HttpOnly) cookie that keeps you signed in, the language cookie, a flag that you have a session, the key of the booking in progress and the business sign-up draft (cleared when you sign out). In the app we store your session, language and a copy of your upcoming bookings for offline use. These need no consent; we use no advertising or analytics cookies.

15. Changes to this policy

We will tell you about material changes in the app or by email before they take effect, and change the date at the top.