Privacy Policy
This policy explains what personal data Datly, operated by Creativa Consultores S.A. (“Datly”, “we”), processes, why we use it, how long we keep it and how you can exercise your rights. Datly is an appointment scheduling platform for service businesses (barbershops, beauty salons and similar) operating in the Americas.
1. Who is responsible for your data
- Business account data (owners and staff who use the dashboard): Datly is the controller.
- End-client data of people who book with a business: the business is the controller; Datly processes it on the business's behalf, as a processor, only to provide the service. If you are a client of a business and want to exercise your rights, you can contact the business or us and we will forward your request.
2. What data we collect
| Who | Data |
|---|---|
| Dashboard users | First and last name, email, password (stored only as an encrypted hash, never in readable form), company details (name, phone, address, city, zip code, country and province) and activity and security logs (sign-in dates, IP address). |
| End clients | Full name, email, phone number and appointment history. The business may add notes about the appointment. |
| Subscription payments | Card data is processed and stored by Authorize.net; Datly only keeps the brand, last four digits, cardholder name and charge history. |
We don't ask for unnecessary data such as ID numbers, date of birth or health information, unless the business flow explicitly requires it.
3. How we use the data
- To create and manage your account and let you use the dashboard.
- To schedule, confirm, remind, reschedule and cancel appointments, and send the related emails.
- To charge the subscription and issue payment receipts.
- To protect the platform: detect unauthorized access, block automated attacks and log security events.
- To comply with legal and accounting obligations.
We do not sell your personal data or use it for third-party advertising.
4. Who we share it with
Only with providers we need to deliver the service, under data processing agreements:
- Mailgun: transactional emails (verification, appointments, security notices).
- Authorize.net: card payment processing.
- Cloudflare: anti-bot verification (CAPTCHA) at sign-in.
- Vercel and our server provider: hosting of the application and data.
To check whether a password has appeared in known breaches we query the Have I Been Pwned service using a method that never sends the password or any data that identifies you.
We may also disclose data when required by law or by a competent authority.
5. How long we keep it
- While the account is active.
- If the owner deletes the account, there is a 30-day grace period to change their mind; after that we erase the personal data of the company, its users and its clients.
- Payment records are kept without personal data for as long as accounting and tax laws require.
- Technical server logs are kept for up to 6 months.
6. Your rights
Depending on the law that applies to you (including California's CCPA, Canada's PIPEDA, Brazil's LGPD, Mexico's LFPDPPP and its ARCO rights, and El Salvador's Personal Data Protection Law), you can:
- Access your data and know how we process it.
- Correct inaccurate or incomplete data.
- Delete your account and data. The account owner can do it from My account → Delete account.
- Object to or restrict certain uses, and withdraw your consent.
- Request portability of your data where the law provides for it.
To exercise them, contact us at hola@app.mydatly.com. We will respond within the time limits set by the applicable law. We will not discriminate against you for exercising your rights.
7. How we protect your data
- All communication is encrypted over HTTPS.
- Passwords are stored with bcrypt; nobody at Datly can see them.
- We block sign-in after several failed attempts, close inactive sessions and email you when your password changes.
- Internal access to data is restricted to staff who need it.
If a security breach affecting your data occurs, we will notify you and the authorities within the time limits required by law.
8. Minors
The Datly dashboard is intended for businesses and is not designed for minors.
9. International transfers
Some of our providers may process data in countries other than yours, mainly in the United States. In those cases we require protections equivalent to those in this policy.
10. Changes to this policy
If we make relevant changes, we will publish the new version on this page and ask you to accept it the next time you sign in to the dashboard.