Privacy Policy

Last updated: August 27, 2026

Xomo (xomo.org) is an online booking service for professionals, salons and their clients. This policy explains what data we collect, why we need it and how you can manage it. Questions: support@xomo.org.

Data we collect

Account: e-mail, display name, interface language, password hash (if you sign in with a password). With Google or Telegram sign-in we store your account identifier at that provider; with passkey sign-in, the credential's public key. We never store or see plain-text passwords.
Business data (for booking page owners): name, description, services, prices, schedule, staff.
Bookings: client name, e-mail and phone, chosen service, date and time of the visit, payment status. This data is visible to the business the client booked with.
Reviews: rating and text left after a visit.
Notifications: if you connect Telegram, the chat identifier used to send you booking messages.
Payments: processed by Stripe. We never receive or store card details — only the payment status and payment session identifier.
Technical data: a session cookie required for signing in. No advertising or third-party tracking cookies.

Google Calendar

If you connect Google Calendar in the dashboard, we request calendar access (calendar.events and calendar.readonly scopes) and store the OAuth tokens and the e-mail of the connected Google account. The access is used for two things only:

creating, updating and deleting events in your calendar that correspond to Xomo bookings;
reading your availability so that busy time cannot be booked. From your other events we store time intervals only (start and end) — no titles, descriptions, attendees or any other details.

Xomo's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising and do not share it with third parties except as needed to operate the service.

You can disconnect the integration at any time in the dashboard ("Disconnect Google Calendar") — we then delete the stored tokens and busy intervals. You can also revoke access on the Google account permissions page.

How we use data

Only to run the service: showing the booking page, managing schedules and bookings, sending booking notifications (e-mail, Telegram), calendar sync and payment processing. We do not sell personal data and do not show ads.

Who we share data with

Processors the service cannot work without: our hosting provider, Stripe (payments), Google (with a connected calendar or Google sign-in), Telegram (with connected notifications or Telegram sign-in). Booking data is visible to the business you booked with.

Retention and deletion

Data is kept while the account or business page is active. To delete your account and the data linked to it, e-mail support@xomo.org from the address the account is registered to — we delete the data within 30 days.

Changes to this policy

If anything substantial changes, we update this page and the date above. The current version is always available at xomo.org/privacy.