Privacy Policy for Todayly

Last Updated: August 17, 2026

1. Introduction

Welcome to Todayly ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application Todayly (the "App"), including its booking, professional workspace ("Workspace"), and space-rental ("Spaces") features.

2. Information We Collect

2.1 Personal Information

When you create an account or use our services, we may collect:

• Account Information: Email address, full name, phone number
• Date of Birth: Collected during onboarding to verify you meet our minimum age requirement (see §8)
• Profile Information: Profile picture, biography, preferences
• Location Data: City, area (for finding nearby professionals or rentable spaces)
• Shipping Address: Full delivery address, collected only when you order a physical product through our marketplace feature, used solely to fulfill and ship that order
• Payment Information: Processed securely through Stripe (we do not store card details)

2.2 Professional Verification Information

If you register as a service professional, business (Workspace), space host, or licensed attorney, we may additionally collect:

• Business Information: Business name, service categories, portfolio images
• Professional Licensing: For attorneys, your bar number and bar jurisdiction, which we manually verify against the relevant public state bar directory before your profile is published
• Payout Information: Bank/payout details, processed via Stripe Connect (we do not store full account numbers)

2.3 Usage Information

• Booking history and preferences
• Messages exchanged within the app, including voice messages sent in Workspace chat
• Reviews and ratings you provide
• App usage patterns and features used
• Promotional feature purchases (e.g., Boost, Available Now visibility tokens)

2.4 Device Information

• Device type and operating system
• IP address and approximate location
• Push notification tokens (for sending you updates)
• Crash and diagnostic data (device model, OS version, app version, and error logs) collected automatically when the app crashes or encounters an error
• Calendar Data (optional): If you grant calendar permission, the App reads and writes events on your device's calendar to schedule your appointments and avoid creating duplicates. This happens locally on your device — we do not upload the contents of your calendar to our servers, only the appointment details you already gave us are written as an event

2.5 Mandatory vs. Optional Information

Account information (email, name, phone number) and payment information are required to create an account and use the App's core booking features — without them, we cannot provide the service to you. Other information, such as your profile picture, biography, or calendar access, is optional and provided at your discretion to improve your experience.

2.6 Information You Provide About Others

In limited cases you may give us contact details for someone who is not yet a Todayly user — for example, a gift card recipient's email and name, or a prospective team member's email or phone number when a Workspace owner sends a staff invite. We use this information only to deliver that specific gift or invitation on your behalf and do not otherwise contact that person. They may request deletion of their information at any time using the contact details in §12.

2.7 Care Bookings (Special Category Data)

Todayly is a booking marketplace for beauty, personal care, home and professional services. Some CareNow professionals — for example a dentist, a physiotherapist, a nutritionist or a counsellor — provide services that relate to your body or wellbeing. Where that is the case, the booking itself can say something about your health: which category you chose, which professional you booked, and when. Under Article 9 of the GDPR that is special category data, and we treat it differently from the rest of your account, whether or not a store or a regulator would call Todayly a health service:

• Legal basis: we process it only on the basis of your explicit consent under Article 9(2)(a) GDPR, which you give by choosing such a category and confirming that appointment. No part of Todayly requires you to book one, and you may withdraw that consent at any time — see §6, including your right to erasure
• We do not collect clinical information. Todayly never asks for and never stores symptoms, diagnoses, prescriptions, test results, insurance numbers or medical records. What we hold is the appointment: category, professional, date, time, price, and any note you choose to write yourself
• Who can see it: you; the professional you booked; where that professional works inside a Workspace, the colleagues their business has given booking access to; and the limited Todayly staff who need it for support, payments and fraud prevention. It is never used for advertising, never sold, and never sent to the Gemini API or any other AI service (§4.2)
• Free-text is your choice. Booking notes and chat messages go to the professional and are stored like any other message — please do not write clinical details there that you would rather not have stored on the platform
• Retention: these bookings are deleted with your account on the same terms as any other booking (§7). Where a service name appears in an accounting record that Czech law obliges us to keep, it is retained for that legal purpose only

If you would rather Todayly held no booking of this kind at all, book only in the beauty, home-service or professional categories — the rest of the App works exactly the same.

3. How We Use Your Information

We use the information we collect to:

• Provide Services (performance of a contract with you): Process bookings, send notifications, facilitate payments
• Improve Experience (our legitimate interest in a functional, relevant product): Personalize recommendations, optimize app performance
• Communication (performance of a contract; your consent for marketing messages): Send booking confirmations, updates, and support messages
• Safety (our legitimate interest, and legal obligation where reporting is required by law): Verify users, prevent fraud, detect suspected illegal use of the platform (see our Terms of Service, §10), and enforce our terms
• Analytics (our legitimate interest in understanding and improving the platform): Understand usage patterns to improve our platform
• Professional Licensing Verification (legal obligation and our legitimate interest in platform trust): Verify attorney bar admission before publishing a professional's profile
• Care Bookings (your explicit consent under Article 9(2)(a) GDPR — see §2.7): Schedule, confirm, remind you of and take payment for appointments you choose to book in a category that relates to your body or wellbeing

We do not make any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Recommendation and ranking features are provided for convenience only and never restrict your ability to browse or book any professional.

4. Information Sharing

4.1 With Professionals

When you book a service, the professional receives:

• Your name
• Your contact information
• Booking details (date, time, service)

4.2 With Service Providers

• Stripe: Payment processing and professional payouts (PCI-DSS compliant)
• Supabase: Database and authentication services
• Google, Apple, Meta (Facebook): If you choose to sign in or sign up using one of these providers, they authenticate you and share a verified identifier (and email address, if you permit it) with us to create your account. We do not post to your account or access your social graph on these platforms
• Expo: Push notification services
• Sentry: Crash reporting and error monitoring
• Vercel: Aggregated, cookie-free page-view analytics for todayly.net (not used within the mobile app)
• smsbrana.cz: Delivery of one-time login codes and SMS notifications (Czech Republic-based)
• Resend: Delivery of our emails — workspace and team invitations, and promotional emails sent by a professional to customers who have opted in. Resend receives the recipient's email address and first name solely to deliver the message
• Google (Gemini API): Used only when a professional chooses the optional AI writing assistant to draft promotional ad copy. The business name and any ad text already written are sent to Google's Gemini API to generate wording suggestions. No customer data and no booking data are sent to this service

4.3 Spaces (Space Rentals)

For space rentals booked through the App, Todayly facilitates scheduling only. We do not collect, process, or transmit the rental payment between you and the space host — that payment is arranged directly between you and the host outside the App. Todayly only charges the host a separate listing fee for use of the booking tool.

4.4 Legal Requirements

We may disclose information if required by law or to:

• Comply with legal processes
• Protect our rights and safety
• Prevent fraud or abuse
• Report suspected illegal activity — including solicitation of prostitution or commercial sexual services, money laundering, or other criminal conduct prohibited under our Terms of Service — to law enforcement or regulatory authorities

5. Data Security

We implement industry-standard security measures:

• Encryption: All data transmitted over HTTPS
• Authentication: Secure login via Supabase Auth
• Payment Security: Stripe handles all payment processing
• Access Control: Role-based access to sensitive data

6. Your Rights (GDPR Compliance)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate information
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Request your data in a portable, machine-readable format — submit a request as described below and we will provide it within 30 days
• Objection: Object to certain processing of your data
• Restriction: Request limitation of data processing
• Withdraw Consent: Where we rely on your consent (for example, marketing communications), withdraw it at any time, free of charge, without affecting the lawfulness of processing carried out before withdrawal

To Exercise Your Rights:

Contact us at: admin@todayly.net

We will respond to your request within 30 days.

To delete your account and personal data, see Delete your Todayly account — you can do it yourself in the app in under a minute, or send us the request form on that page if you no longer have the app installed.

7. Data Retention

We retain your data for as long as:

• Your account is active
• Needed to provide our services
• Required under Czech accounting and tax law, which sets different retention periods (typically 5–10 years) depending on the type of financial record

You can request data deletion at any time.

8. Children's Privacy

Todayly is not intended for users under 16 years of age. We do not knowingly collect information from children under 16.

9. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA) — for example, by Stripe, Sentry, Expo, Resend, Google (including the Gemini API), Apple, and Meta (Facebook) (United States). Where we transfer data outside the EEA, we rely on:

• The European Commission's Standard Contractual Clauses (SCCs)
• Adequacy decisions, including the EU-U.S. Data Privacy Framework, for certified recipients

We are in the process of confirming or formalizing a transfer safeguard for every service provider listed in §4.2; where one is not yet finalized for a given provider, we are actively working to close that gap.

10. Cookies and Tracking

We use essential cookies and local storage for:

• Authentication (keeping you logged in)
• Preferences (language, theme)
• Session management

We also use limited, non-advertising tools for stability and traffic measurement:

• Sentry: crash and error reporting (see §4.2)
• Vercel Analytics: aggregated, cookie-free page-view counts on todayly.net

We do NOT use:

• Advertising cookies
• Social media pixels
• Cross-site or cross-app tracking for advertising purposes

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via:

• In-app notification
• Email notification

Continued use of the app after changes constitutes acceptance.

12. Contact Information

For privacy-related questions or to exercise your rights:

Email: admin@todayly.net Subject: Todayly Privacy Inquiry

Data Controller: Valeriia Baranova IČ (Company ID): 23296747 Děčínská 552/1, Střížkov, 180 00 Praha 8, Czech Republic Email: admin@todayly.net

Valeriia Baranova is the registered Czech business entity that operates Todayly and is the controller of the personal data described in this policy. The Todayly application software is authored by Vashish Imrith and licensed to the operator; the author is not the controller of your personal data.

13. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority.

In Czechia: ÚOOÚ (Úřad pro ochranu osobních údajů) Pplk. Sochora 27 170 00 Praha 7 Czech Republic Website: https://www.uoou.cz

---

By using Todayly, you acknowledge that you have read and understood this Privacy Policy.