Privacy Policy

What data we collect

• Phone number. Without it we can neither book you nor let you into your account: you sign in to the service with your number and a code from a message.
• Password. You create it at your first sign-in and use it to sign in from then on. We do not store the password itself — only the result of an irreversible transformation from which the original password cannot be recovered; the service's staff cannot see it. A forgotten password is changed with a code sent to your number, and you can change it at any time.
• Name — the one you gave when booking. The venue sees it so it knows whom to expect.
• Your bookings: the venue, service, specialist, time and your comment, if you left one; cancellations and reschedules.
• Reviews — if you write them. They are public and shown with your name. You can also leave a review via a link sent by a venue or a specialist — such a review is labeled "By invitation".
• Messages with a venue — messages, photos and files that you send to a venue and it sends to you. Only the participants of the conversation see them; the service's staff open a message only if it has been reported. If the venue has turned on an AI assistant, it reads the messages of that conversation too — see "The AI assistant in messages with a venue".
• Photos — your avatar and pictures attached to reviews, if you upload them. A review photo is public together with the review. Venues you book with and everyone who reads your reviews see your avatar; you can remove it in your profile or together with your account.
• Location — only if you tap "Near me" and allow access to it. The coordinates go into the search request to sort places by distance, are not saved in your account and remain only in the server's technical logs for a limited time.
• The camera works on your device: it reads a venue's QR code at the entrance or takes a picture you decided to send. The camera image is not sent to us — only a picture you have sent yourself.
• A venue's notes about you — if the venue keeps them: for example, about an allergy to an ingredient or what was done at your last visit, sometimes with a photo of the result. The venue keeps them itself; we store them on its instructions and do not show them to you in the service. To find out what has been recorded, or to correct or delete it, contact the venue; deleting your account deletes them at all venues at once.
• Technical data: IP address, device and browser type, session cookies. They are needed for sign-in to work and to tell people from bots.
• Usage statistics: which pages and screens were opened (together with the page address, including the text of a search query), where you came from, device and browser type, whether it was the website or the app, and approximate location based on the IP address. They are collected by Google Analytics through its own identifier — both on the websites and in the apps.
• Device token — if you installed the app and allowed notifications. It contains neither your number nor your name.

We do not ourselves collect health data, documents or payment details, and we do not track you in other apps or on other websites. You pay for a service at the venue, not through us.

If you own a venue or are a specialist

The dashboard has a different role, and it is more honest to describe it separately than to mix it into the general list. About you, we collect your phone number (sign-in is the same — by code), name, the name and address of the venue, the price list, schedule and photos you uploaded, and your subscription payment history.

• Your clients' data belongs to you. We store it and pass it on at your instruction — we remind clients of visits and show you their contacts — but you control it, and you are responsible for it to the client. We do not use your client base for anything other than running your own dashboard: we do not send our own messages to it, do not pass it to other venues and do not sell it.
• Public and non-public. The name, address, opening hours, price list, photos, and the names and ratings of specialists are visible to everyone — that is the storefront. Your number, client base, till and subscription are visible only to you and those you have given access to.
• Staff do not see everything. Permissions are nested: the owner sees more than an administrator, an administrator more than a specialist. A specialist sees their own schedule and does not see clients' contacts — this restriction is enforced in the database, not in interface settings.
• Notes about clients — the client card and visit log kept by you and your staff, together with photos. The client does not see them in the service; if the client asks to see or delete what has been recorded about them, you must respond, and the notes export exists for this. A specialist sees notes only about people who booked with them and cannot export them. When a client deletes their account, their notes are erased together with the photos.
• Number for tips. If you have turned on showing a number for tips, clients who had a visit with you see it for 30 days after the visit. Only you can turn it on and off — a venue owner cannot do it for you; turning it off takes effect immediately. The transfer goes directly to you and we take no part in it: we take no fee, do not see it and store nothing except the number and the recipient's name that you entered.
• Automatic translation of catalog texts. If you save a name or description in fewer than all of the service's languages, the dashboard offers a translation of the missing ones. For this, the field text goes to a third-party artificial intelligence service provider; see "Who we share data with". The translation is only suggested: it is published after you review and confirm it. Only the texts you write about the venue for the storefront are sent: names and descriptions of services, price list sections, options and passes, and the "About us" text. Clients' data, phone numbers, bookings, notes and a specialist's "About me" text are not sent; so do not put information about people in the descriptions.
• Dashboard assistant. If the assistant is enabled for your venue, you and your staff can ask it about the venue's work: bookings, free time, services and prices, opening hours, staff, passes, reviews, the cash desk. The answer is prepared by an artificial intelligence service of a third-party provider; see "Who we share data with". To answer, the provider receives: your question as you wrote it; the venue's name, field of activity and time zone; the name and role of the person asking; and the dashboard data the assistant read for the answer within your permissions — booking dates and times, services and prices, specialists and their schedules, the venue's opening hours and profile, clients' passes, reviews of the venue, statuses, amounts, cash totals. If you have a specialist profile, the assistant can also see your bookings in every place you work at (without clients), invitations and your specialist profile, including the «about me» text. The provider does not receive clients' names or numbers, nor a review author's name; notes about clients and messages with clients are not sent to the dashboard assistant. If you type a client's name into a question yourself, it is sent too — so do not type numbers, health information or anything else the question does not need. You see your conversation with the assistant — the venue owner does not read staff members' conversations; it is kept for 90 days and deleted together with your account. If you work in several venues, you have one conversation with the assistant; when your access to a venue ends, everything about that venue is deleted from it. A question the assistant had no function for is also seen by our staff who develop the service: such questions tell us what to teach it next; it is kept for the same period. The answer is written by a machine and may be inaccurate — check what matters on the dashboard screen. The assistant cannot change data without your confirmation. Details are in clause 11.9 of the Terms.
• The AI assistant in messages. If you turn it on for your venue, the messages of clients who have consented and the information listed in "The AI assistant in messages with a venue" are sent to the artificial intelligence service provider on your instructions. It does not read the messages of a client who has turned the assistant off.

A subscription paid on the website goes through a payment gateway. The card number never reaches us and is not stored by us — we receive from the gateway only a confirmation of successful payment and the last digits. If the subscription was purchased in the app, the payment is taken by the App Store or Google Play: we have no card data at all, and the store tells us only about the purchase itself — its identifier, term and amount.

Why

• to make a booking and pass it to the venue;
• to remind you of a visit and tell you if an earlier time has become available;
• to let you into your account and show your bookings;
• to protect the service from abuse — limit request rates and block those who disrupt other people's bookings;
• to understand from aggregate statistics which website pages and app screens are used and where people get stuck;
• on the venue's instructions, to answer its staff's questions about bookings, passes and reviews in the dashboard (the dashboard assistant) without passing your name and number to the provider;
• on the venue's instructions and with your consent, to reply to you in messages with the venue's AI assistant or prepare replies for its staff.
• to show venues that are not yet connected to the service, based on information from open sources, and let you write to them;

Who we share data with

We do not sell data and do not give it to advertisers. Data is shared in exactly five cases: three are needed for the service to work, the fourth is to understand how it is used, and the fifth is the provider of an artificial intelligence service for machine translation, page descriptions and AI assistants:

• The venue you booked with receives your name, number, the booking itself and your profile photo, if you uploaded one. From then on the venue handles this data on its own and is responsible for it. Other venues do not see your data. The venue also receives your name and number if you left a review via its invitation link: you become its client.
• Meta Platforms Ireland Ltd. (WhatsApp) — the confirmation code is sent to you on WhatsApp, so your number is passed to Meta to deliver the message. Meta's servers are outside Kazakhstan, which makes this a cross-border transfer, and by booking you consent to it.
• Google (Firebase Cloud Messaging), and on iPhone also Apple (Apple Push Notification service), deliver notifications to the app. They receive the device token and the text of the notification itself: about your booking — the venue, service and time; about a message — who wrote it and what. Notifications to venue staff name the client — about a new booking, in the chat and in the dashboard assistant's replies. Your phone number never goes into a notification. Google and Apple servers are outside Kazakhstan, so this is a cross-border transfer. Notifications can be turned off in your phone settings.
• Google (Google Analytics) counts visits to the naya.kz and biz.naya.kz websites and the Naya apps: it receives an identifier from its own cookie, the addresses of pages opened, device and browser type, whether it is the website or the app, and the IP address. Your phone number and name are not sent, and the booking page opened via a link from a message has no counter at all. Google's advertising features (Signals and ad personalization) are turned off: the statistics are not used for advertising and are not linked to your data in other apps or on other websites. Google's servers are outside Kazakhstan — this is a cross-border transfer.
• Artificial intelligence service provider (machine translation, page descriptions and AI assistants) processes texts on the venue's instructions and at our request, in four cases. Translation: it receives catalog texts that a venue writes about itself when the owner or an administrator saves them in fewer than all languages (names and descriptions of services, price list sections, options and passes, the "About us" text) and the venue's field of activity; the result is published after the venue reviews it. Dashboard assistant: when a staff member of a venue you booked with asks the assistant a question, details of your booking — date, time, service, specialist, status, price, whether the reminder will reach you, — the visits left and validity of your pass at that venue, and your review of it — rating and text — may be sent to the provider without your name and phone number. Your name may be sent only if the staff member types it into the question. The venue's notes about you and your messages with the venue are not sent in this case. AI assistant in messages: if the venue has turned it on and you continued the conversation after the notice about it, the provider receives the information listed in "The AI assistant in messages with a venue" — also without your name and phone number. Descriptions of pages without booking: to write a short description of a page, the provider receives the venue's name, type, address and the names of services from its price list — without the phone number or the Instagram link. The provider processes this data only on our instructions, does not train its models on it and deletes it within 30 days unless it is required to keep it longer by law or to prevent abuse. The provider's servers are outside Kazakhstan, which makes this a cross-border transfer; by booking or continuing a conversation with the AI assistant, you consent to it.

Where data is stored and how it is protected

Data is stored on servers in Kazakhstan. Venues' clients' phone numbers are stored encrypted; only the venue itself has access to its data — the separation is enforced at the database level, not by interface settings. A venue employee with limited permissions does not see clients' contacts.

How long we keep data

Bookings and related data — as long as your account exists: the visit history is needed by both you and the venue. Technical logs — for a limited time needed to investigate failures and abuse. At your request we delete earlier.

If you have deleted your account, a fingerprint of your number remains — a hash with a secret key from which the number itself cannot be read. It serves one purpose: if a venue uploads its old client base with your number, no bulk messages through Naya will be sent to it.

A venue staff member's conversation with the dashboard assistant — 90 days from each message; earlier if the staff member deletes their account. Questions the assistant had no function for — the same. The log of requests without the conversation text (time, volume, which functions were used) is kept longer: it is used to calculate costs and investigate abuse. Actions a staff member confirmed on an assistant card (what was changed, by whom and when) stay in the venue's log without the conversation text — like the bookings themselves.

Draft replies the AI assistant prepared for venue staff — 90 days. Replies sent into a conversation are kept with it. The assistant's work log without message text (time, volume) is kept longer: it is used to calculate costs and investigate abuse.

Backup copies of the database and files are kept for two weeks on our servers in Kazakhstan and are used only to recover from a failure. Anything deleted — by you, by the venue or because its retention period ended — stays in them until that period runs out and disappears from them no later than 15 days after deletion.

A venue page without booking — while it is in the catalog. After removal its information and photos are kept unpublished — until the venue connects or until you ask us to delete them using our contacts; the phone number of the person who removed the page is kept with them. The codes from the WhatsApp button are kept with the page, with no information about who pressed it; the transformed IP address — two days.

Your rights

You can find out what data we hold, correct it, withdraw your consent and demand deletion. Withdrawing consent means we will no longer be able to book you or remind you of visits. Records that a venue is required to keep under its own rules stay with the venue — our deletion does not extend to them.

The deletion procedure — step by step, with what is deleted and what remains — is on a separate page: data deletion.

Write or call — we will reply:

Children

The service is used by adults. If you book for a child, you do so as a parent or legal representative and are responsible for the child's data.

Changes

If the processing rules change, we will raise the version number on this page. The current one is v21 of 5 October 2026.

On 3 September 2026, the operator of personal data changed from the individual entrepreneur Ryzhkov to NayaIT Solutions LLP, BIN 260940005233. The data collected, the purposes of processing and the retention periods did not change.

On 13 September 2026, Google Analytics visit statistics appeared on the websites — they are described in "What data we collect" and "Who we share data with". Nothing changed in the apps.

On 17 September 2026, Google Analytics statistics appeared in the apps as well — with the same data as on the websites and with Google's advertising features turned off.

At the same time, venues' notes about clients appeared — they are described in "What data we collect" and in the section for venue owners.

On 23 September 2026, automatic translation of catalog texts appeared in the dashboard — it is described in the section for venue owners and in "Who we share data with". It does not concern clients' data.

At the same time, in version v9, the policy described in more detail what was already in the service: messages with venues and attachments, photos, location for "near me" search, the camera, and subscription payment through the App Store and Google Play. Visit reminders come only as app notifications, so WhatsApp remains only for the confirmation code.

On 25 September 2026, in version v10, reviews by invitation appeared: a venue or a specialist sends a link, and by leaving a review through it you become their client — your name and number are passed to them just as when booking. This is described in "What data we collect" and "Who we share data with".

On 28 September 2026, in version v11, venues you book with began to see your profile photo — in bookings and in messages, to recognize you at the front desk. You can turn this off in your profile with the "Photo for venues" switch; a photo you did not upload will not appear anywhere.

On 29 September 2026, in version v12, an assistant appeared in the dashboard: venue staff ask it about the venue's work, and the answers are prepared by an artificial intelligence model of a third-party provider. Details of your booking may be sent to it without your name and number — this is described in "Why", "Who we share data with", "How long we keep data" and in the section for venue owners. At the same time, "How long we keep data" began to state how long backup copies are kept.

On 30 September 2026, in version v13, the dashboard assistant got access to the price list, opening hours, the venue profile, passes and reviews: the visits left and validity of your pass and your review of a venue may be sent to the artificial intelligence service provider without your name and number. This is described in "Why", "Who we share data with" and in the section for venue owners.

On 30 September 2026, in version v14, we stated that a venue staff member's question the assistant had no function for is seen by our staff who develop the service and is kept for 90 days. This is described in the section for venue owners and in "How long we keep data".

On 30 September 2026, in version v15, the dashboard assistant got access to a specialist's own data — their bookings in every place they work at without clients, invitations and their profile, including «about me». This is described in the section for venue owners.

On 30 September 2026, in version v16, the conversation with the dashboard assistant became one per person across all their venues; when access to a venue ends, everything about that venue is deleted from it. This is described in the section for venue owners.

On 30 September 2026, in version v17, the section "Who we share data with" was corrected: notifications to the app are delivered by Google and, on iPhone, Apple, and they receive the notification text — with the client's name in notifications to venue staff. The previous version wrongly said that only the device token is passed. At the same time venue staff started receiving notifications with the dashboard assistant's replies and a morning summary of the day.

On 30 September 2026, in version v18, the photo visibility switches were removed — "Photo in my reviews" and "Photo for venues": the profile photo you upload is seen by venues you book with and by everyone who reads your reviews. You can remove it in your profile or together with your account.

On 30 September 2026, in version v19, the AI assistant in messages with a venue was described: if the venue has turned it on, it replies to you or prepares replies for staff, and your messages are sent to the artificial intelligence service provider without your name and number. Consent is continuing the conversation after the notice above the message field; you can opt out in your profile. This is described in a separate section, in "Why", "Who we share data with", "How long we keep data" and in the section for venue owners.

On 4 October 2026, in version v20, pages of venues without booking were described: information about venues from open sources, the "Write on WhatsApp" button with a code in the message, how a page is removed, and automatic descriptions.

On 5 October 2026, in version v21, the way a page of a venue without booking is removed changed: the link on the page removes it only after signing in with a confirmed number, and a removed page is hidden without deleting its information and photos.