Privacy Policy

Last updated: April 5, 2026

Venzallo d.o.o. ("Venzallo", "we", "us", or "our") operates the Venzallo Booking Assistant, an automated appointment scheduling service available through Instagram Direct Messages. This Privacy Policy explains how we collect, use, store, and protect your personal data when you interact with our service.

1. Data Controller

Venzallo d.o.o.
Zagreb, Croatia
Email: privacy@venzallo.com

2. Data We Collect

When you interact with a business through our Instagram booking assistant, we collect:

• Instagram User ID — your unique Instagram identifier (a numeric ID, not your username)
• Message Content — the text of messages you send to and receive from the booking assistant
• Appointment Data — date, time, and service details when you book an appointment
• Conversation History — the sequence of messages in your booking conversation, used to maintain context within a session

We do not collect your Instagram password, email address, phone number, photos, or any data from your Instagram profile beyond your user ID.

3. How We Use Your Data

We use the collected data exclusively to:

• Process your appointment booking requests
• Check available time slots at the business you are contacting
• Confirm, modify, or cancel your appointments
• Maintain conversation context so the assistant can understand follow-up messages
• Provide the business with appointment information so they can serve you

We do not use your data for advertising, profiling, or any purpose unrelated to appointment scheduling.

4. Data Sharing

Your data is shared only with:

• The business you are booking with — they see your appointment details and can see your Instagram user ID to identify your booking
• OpenAI — message content is processed by OpenAI's API to generate intelligent responses (subject to OpenAI's Privacy Policy)
• Meta/Instagram — messages are transmitted through Meta's Messenger Platform (subject to Meta's Privacy Policy)
• Microsoft Azure — our infrastructure provider where data is stored and processed

We do not sell your personal data to third parties.

5. Data Storage and Security

• Data is stored in a secured SQL database hosted in Europe
• All data transmission is encrypted using TLS/HTTPS
• Access to the database is restricted to authorized personnel only
• Conversation history is stored to maintain booking context and is associated with your Instagram user ID

6. Data Retention

• Conversation history is retained for up to 90 days after your last interaction, then automatically deleted
• Appointment records are retained for as long as the business requires them for their operations, typically up to 12 months after the appointment date
• You may request earlier deletion at any time (see Section 8)

7. Legal Basis for Processing (GDPR)

We process your data based on:

• Legitimate interest (Article 6(1)(f) GDPR) — to provide the booking service you initiated by sending a message
• Performance of a contract (Article 6(1)(b) GDPR) — to fulfil the appointment booking you requested

8. Your Rights

Under GDPR and applicable data protection laws, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request that we limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing of your data

To exercise any of these rights, contact us at privacy@venzallo.com. We will respond within 30 days.

9. Data Deletion

You can request deletion of all your data at any time by:

• Sending an email to privacy@venzallo.com with your Instagram username
• Sending "delete my data" to the booking assistant via Instagram DM

Upon receiving a deletion request, we will remove your conversation history, appointment records, and Instagram user ID from our systems within 7 business days.

10. Children's Privacy

Our service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

For any questions or concerns about this Privacy Policy or our data practices:

Venzallo d.o.o.
Email: privacy@venzallo.com