Privacy Policy

• Account data — your name, business name, email, category and booking-page settings.
• Client data you enter — your clients’ names, email addresses, phone numbers and booking details.
• Payment data — processed by Stripe. We receive transaction metadata (amount, status, identifiers) but not full card numbers.
• Usage data — basic technical information such as log data needed to run and secure the service.

We use personal data to:

• provide and operate Nellio, including booking pages and payment links;
• send transactional emails and text messages (e.g. booking links, confirmations and reminders);
• take subscription payments and prevent fraud;
• provide support and improve the service;
• meet legal and accounting obligations.

We rely on: contract (to provide the service you sign up for), legitimate interests (to secure, support and improve the service), legal obligation(e.g. tax records), and consent where required (e.g. certain communications).

We use trusted sub-processors to run the service, including:

• Clerk — authentication and account management.
• Convex — application database and backend hosting.
• Stripe — payment processing.
• Resend — transactional email delivery.
• Twilio — text-message delivery (booking and payment texts).
• Vercel — website hosting and cookieless, aggregate analytics.
• Google — optional calendar integration, only if you connect it.

We do not sell personal data.

We keep account and booking data for as long as your account is active and as needed to provide the service. After closure we delete or anonymise data within a reasonable period, except where we must retain it for legal, accounting or fraud-prevention reasons.

Under UK GDPR you have rights to access, correct, delete, restrict or object to processing of your personal data, and to data portability. To exercise these, email rehans.axis@gmail.com. You can also complain to the UK Information Commissioner’s Office (ico.org.uk). If your request concerns data we process on a business’s behalf, we will refer you to that business as the controller.

Some providers process data outside the UK/EEA, including in the United States. Where they do, we rely on appropriate safeguards such as adequacy decisions (including the UK–US data bridge) or standard contractual clauses.

We use technical and organisational measures to protect personal data, including encryption in transit and access controls. No system is perfectly secure, but we work to keep your data safe and will notify you of a breach where the law requires.

We use only essential cookies needed to sign you in and keep the service working — no advertising or tracking cookies. Our Cookie Policy lists every cookie and why it’s set.

We may update this policy and will revise the date above when we do. Questions or requests? Contact rehans.axis@gmail.com. Postal address: First Floor, Swan Buildings, 20 Swan Street, Manchester M4 5JW.