Controller: Kiraku Inc. (株式会社キラック) — contact for privacy requests: privacy@tenbin.link. Service: Tenbin at https://tenbin.link.
1. Data we collect
- Account information (email, password hash via Supabase Auth).
- Google account data: tokens (encrypted at rest), calendar list metadata, free/busy intervals, and events we create on your behalf when guests book.
- Booking data: guest name, email, notes, timestamps, management tokens.
- Payment data: processed by Stripe; we store Stripe customer and subscription IDs.
- Usage logs as emitted by hosting (Cloudflare) and application diagnostics.
2. Purposes
To provide scheduling, send transactional email, process payments, prevent abuse, and improve reliability and security of the service.
3. Processors / recipients
- Google (Calendar API, OAuth).
- Stripe (payments).
- Resend (email delivery).
- Supabase (database and authentication).
- Cloudflare (hosting, DNS, CDN, security).
4. Retention
While your account is active, plus up to 90 days after deletion for backups and legal obligations unless a longer period is required by law.
5. Security
TLS in transit, encryption for sensitive fields where applicable (e.g. OAuth tokens with AES-256-GCM at the application layer), and database access controls including Row Level Security policies on Supabase.
6. Your rights
Subject to applicable law (including GDPR), you may request access, correction, or deletion of personal data. Contact privacy@tenbin.link. We will respond within a reasonable timeframe.
7. Cookies
We use cookies and similar technologies for authentication and session management only. We do not use advertising cookies on the product.
8. Changes
We may update this policy; material changes will be announced via the service or email where appropriate.