PRIVACY POLICY

---

1. DATA CONTROLLER

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), we inform you:

Company name: Codeblu, S.L.U.

Tax ID (CIF): B26896167

Registered address: Salvador Espriu 33, 2B - 08320 - El Masnou, Spain

Email: legal@timeblu.com

Website: https://timeblu.com

Web application: https://app.timeblu.com

Mobile application: Timeblu for iOS and Android

Hereinafter, "Timeblu", "we" or the "Controller".

---

2. WHAT IS TIMEBLU?

Timeblu is a simple scheduling application for appointment-based businesses that allows users (professionals, companies, freelancers) to manage their appointments, clients, and calendars, offer a booking page to their clients and send them confirmations and reminders. It is used from the browser and from the mobile application for iOS and Android, which gives access to the same account.

This policy applies to the website, the web application and the mobile application.

---

3. INFORMATION WE COLLECT AND PROCESS

3.1 Timeblu User Data (the professional/company)

When you register as a Timeblu user, we collect:

• Account data: Name, surname, email address, password (encrypted), phone number (optional). If you sign up with Google, we receive your name, email address and profile picture from Google.
• Business data: Business name, address, opening hours, services, prices, the logo and photos you upload, and the texts of your booking page, which is public.
• Billing data: Information necessary to process your subscription (managed by Stripe; we do not store your card details).
• Usage data: Information about how you use the application, preferences, settings.
• Sign-up data: Date, IP address, approximate country and city derived from the IP, and user agent at the time of registration and acceptance of the terms, to evidence consent and prevent fraudulent sign-ups.

3.2 User-Entered Data (user's clients)

IMPORTANT: You decide what information you enter about your clients in Timeblu. In this case, you act as the Data Controller and Timeblu acts as the Data Processor.

Data you may enter, or that your clients provide when booking on your booking page or through WhatsApp, includes:

• Your clients' names
• Phone numbers
• Email addresses
• Addresses and dates of birth
• Free-form notes
• Appointment history
• Answers to satisfaction surveys and intake forms
• Health data, if your activity requires it (see below)
• Messages exchanged with the WhatsApp booking assistant
• Deposit payments (processed by Stripe)

HEALTH DATA: If your activity requires it (for example, a physiotherapy clinic, or a beauty salon that asks about allergies), you may store your clients' health data in Timeblu in notes, visit sheets or intake forms. These are special category data (Art. 9 GDPR) and you, as controller, need a specific legal basis to process them:

• Healthcare, if you are a professional bound by professional secrecy (Art. 9.2.h and 9.3 GDPR), or
• Your client's explicit consent (Art. 9.2.a GDPR), which you can collect with a consent checkbox in the intake form itself.

You must inform your clients of this processing and ask only for the health data you need. Timeblu processes this data as processor, only to provide you the service and with the measures in section 8.

OTHER SPECIAL CATEGORIES: It is not permitted to enter the other special category data under Article 9 of the GDPR (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation). If you enter such data, it is under your sole responsibility.

3.3 Technical Data

• IP address
• Browser and device type
• Cookies and similar technologies on the website and the web application (see Cookie Policy)
• Service access and usage logs
• Error reports: when something fails, we record the technical details of the error, your account identifier and a reconstruction of the seconds before it on screen with all text hidden, so that we can fix it

3.4 Mobile Application (iOS and Android)

The mobile application gives access to your Timeblu account and processes the same data as the web application. In addition:

• Device data: operating system (iOS or Android), app version and a notification identifier (token) assigned by Apple and Google, so that we can send you notifications. The token is deleted when you sign out.
• Push notifications: we notify you of new bookings, changes, cancellations and other events in your business. The content of the notification (for example, the client's name, the service and the time of the appointment) is delivered through Google Firebase Cloud Messaging and, on iPhone and iPad, Apple Push Notification service. You can turn them off in Settings > Notifications or in your device settings.
• Device permissions, used only when you ask for it, and which you can withdraw at any time in your device settings:
  • Camera: when you choose to take a photo for your logo, your team's photos or your booking page. Only the photo you confirm is uploaded.
  • Microphone: while you dictate a message to the AI assistant. The audio is transcribed to text and we do not keep it.
  • Photos: only to save the images you choose to export to your photo library.
• No advertising or tracking: the application shows no advertising, includes no third-party analytics or advertising tools and does not track your activity across other apps or websites.

When you download the application, Apple (App Store) and Google (Google Play) process the download data under their own privacy policies.

3.5 Artificial Intelligence Features

Some features use artificial intelligence: the AI assistant, client summaries, survey analysis, the data import assistant and the booking page copywriter. When you use them, we send the AI provider what it needs to answer: your request and the data of your business and clients related to it. If you dictate by voice, the audio is sent to a transcription provider.

• These providers act as data processors and, under their terms, do not use this data to train their models.
• If your notes or forms contain health data, it may be part of what is sent when you use these features, for example when generating a client summary. Client summaries are generated without the surname or the contact details from the client record.
• We do not store your conversations with the assistant. The assistant may remember lasting facts about your business that you mention (for example, your usual opening hours) to give you better answers; they are deleted with your account.
• The AI does not take automated decisions with legal effects on you or your clients (see section 12).

---

4. FOR WHAT PURPOSES DO WE PROCESS YOUR DATA?

4.1 As a Timeblu User

4.2 As Data Processor (your clients' data)

Timeblu only processes the data you enter about your clients, or that they provide when booking with you, following your instructions to:

• Store it securely
• Allow you to access, modify, export and delete it
• Manage the bookings your clients make on your booking page or through WhatsApp, including collecting deposits if you enable them
• Send on your behalf the communications you set up (confirmations, reminders, surveys and campaigns) by email, SMS and WhatsApp
• Provide the artificial intelligence features you request (section 3.5)
• Make backups

We do not use your clients' data for any other purpose. For more details, see our Data Processing Agreement (DPA).

---

5. TO WHOM DO WE DISCLOSE YOUR DATA?

We do not sell or transfer your data to third parties for commercial purposes.

We only share data with:

5.1 Service Providers (Sub-processors)

All our providers comply with the GDPR and process data under data processing agreements (Art. 28 GDPR), which in most cases are part of their terms of service.

5.2 Third-Party Services on the Website

On the website and the web application we use Google Analytics and Google Ads to measure visits and the effectiveness of our campaigns, as detailed in the Cookie Policy. They are not used in the mobile application. If a business shows its address on its booking page, the map is served by Google Maps.

5.3 Legal Obligations

We may disclose data if required by law, court order, or competent authority (AEPD, Tax Agency, etc.).

---

6. HOW LONG DO WE KEEP YOUR DATA?

• Active account: While you maintain your account active
• Inactive account (never used): paused after 30 days without sign-in or data, with prior notice by email; data kept intact until you reactivate it or the account is deleted
• If you delete your account: it is deactivated at once and permanently deleted after 30 days, with all its data and files. During that period you can recover it by signing in.
• Device notification identifier: until you sign out of the mobile application
• Audio dictated to the assistant: not kept; only the text you send is stored
• Error reports: up to 90 days
• Tax/invoice data: 4 years from the last invoice (Spanish legal obligation)
• Security logs: 2 years (security and legal defense requirements)

---

7. WHAT ARE YOUR RIGHTS?

You can exercise the following rights at any time:

7.1 GDPR Rights

• Access: Obtain confirmation about whether we process your data and access them
• Rectification: Correct inaccurate or incomplete data
• Erasure ("right to be forgotten"): Request deletion of your data
• Restriction: Request that we limit processing in certain circumstances
• Portability: Receive your data in a structured format (CSV/JSON) - feature available in your control panel
• Objection: Object to processing based on legitimate interest
• Withdrawal of consent: If processing is based on your consent, you can withdraw it at any time

7.2 How to Exercise Your Rights?

Option 1 - From the application (recommended):

• Access your account at https://app.timeblu.com or in the mobile application
• Go to Settings > Data & Privacy
• You will find options to:
  • Export all your data
  • Delete your account (we will ask for a code we send to your email to confirm it)
  • Manage communication preferences

The camera, microphone, photos and notification permissions of the mobile application are withdrawn from your device settings.

Option 2 - By email: Send an email to legal@timeblu.com with:

• Subject: "GDPR Rights Exercise"
• Your name and account email
• The right you wish to exercise
• Copy of ID or identification document (to verify your identity)

Response time: 1 month from the request (extendable by 2 more months in complex cases)

If you are a client of a business that uses Timeblu: that business is the controller of your data. Contact it to exercise your rights; if you write to us, we will forward your request to it.

7.3 Complaint to Supervisory Authority

If you believe we have not properly addressed your rights, you can file a complaint with:

Spanish Data Protection Agency (AEPD) C/ Jorge Juan, 6 28001 Madrid Web: https://www.aepd.es Phone: 901 100 099

---

8. DATA SECURITY

We implement appropriate technical and organizational measures to protect your data:

8.1 Technical Measures

• Encryption: HTTPS for all communications, data encrypted in database
• Access control: Robust authentication, two-factor authentication (2FA) option available
• Backups: Encrypted automatic daily backups
• Data segregation: Each user can only access their own data (Row Level Security)
• Audit logs: Record of access and critical operations

8.2 Organizational Measures

• Restricted access to personal data only to authorized personnel
• Internal information security policies
• Security incident management procedures
• The Timeblu team only enters an account to solve a support issue: the session lasts 30 minutes at most and every access is logged with its reason. Access to Timeblu's internal panel requires two-factor authentication.

8.3 Security Breach Notification

In case of a security breach that may pose a risk to your rights:

• We will notify the AEPD within 72 hours
• We will inform you without undue delay if the risk is high
• We will take measures to mitigate the impact

---

9. INTERNATIONAL TRANSFERS

The main database and files are stored on servers located in the European Union (Paris, France).

Some of the providers in section 5.1 (Vercel, Stripe, Resend, Infobip, Anthropic, Groq, Google, Meta and Apple) may process data in the United States. These transfers rely on the adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission, together with the additional security measures each provider applies.

---

10. MINORS

Timeblu is not intended for people under 18 years of age. We do not knowingly collect data from minors. If we detect that a minor has provided data, we will proceed to delete it immediately.

If you are a parent/guardian and believe your minor child has provided data, contact us at legal@timeblu.com.

---

11. MANDATORY DATA AND CONSEQUENCES OF NOT PROVIDING IT

Fields marked with an asterisk (*) in forms are mandatory. If you don't provide them:

• We cannot create your account
• We cannot provide the service
• We cannot process payments (for paid plans)

The mobile application's permissions are optional: if you do not grant them, only the specific feature that needs them stops working (for example, taking a photo or receiving notifications).

---

12. AUTOMATED DECISIONS AND PROFILING

Timeblu DOES NOT perform:

• Automated decisions that produce legal effects on you
• Profiling for marketing or similar purposes

The artificial intelligence features (section 3.5) only offer you suggestions and summaries: you take the decisions.

---

13. UPDATES TO THIS POLICY

We may update this Privacy Policy periodically. Significant changes will be notified:

• By email to your account
• With a prominent notice in the application
• By updating the "Last updated" date at the beginning of this document

We recommend reviewing this policy regularly. Continued use of the service after changes implies acceptance of them.

---

14. CONTACT

For any questions about this Privacy Policy or about the processing of your data:

Email: legal@timeblu.com

---

15. ADDITIONAL INFORMATION

This Privacy Policy complements our Terms of Service and our Cookie Policy, available at:

• Terms of Service: https://timeblu.com/terms
• Cookie Policy: https://timeblu.com/cookies
• DPA (for customers): https://timeblu.com/dpa

---

Applicable regulations:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
• Organic Law 3/2018, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD)