Who we are and what this covers
Converbold is run by Murifex Technologies Limited, Lagos, Nigeria. This policy explains how we handle personal information when you:
- visit converbold.com or contact us;
- create a Converbold account for your business, or are invited to one as a team member;
- book an appointment with a business that uses Converbold.
We follow the Nigeria Data Protection Act 2023. Where the UK or EU General Data Protection Regulation applies to you, we follow it too.
Our two roles
For business owners and their team, we decide how your account information is used, so we are the data controller.
For people who book with a business, the business decides what to collect and how to use it. The business is the controller and we are its data processor: we store and process your booking details on the business’s behalf. If you booked with a salon, clinic or other business through Converbold and want to see, change or delete your information, please contact that business first. If you can’t reach them, write to us and we’ll help.
What we collect
From business owners and team members
- Account details: name, email address, password (stored only in scrambled, hashed form), phone number, role.
- Business details: business name, category, country, city, address, phone, logo, booking-page settings, services, prices, opening hours and staff schedules.
- Billing details: plan, invoices and payment status. Card details are entered on Paystack or Stripe’s own pages. We only receive the card brand, last four digits and expiry, never the full number.
- Security information: the devices and browsers you’re signed in on, their IP addresses and when they were used, so you can see and sign out of them. If you turn on two-factor authentication, we store the secret your authenticator app uses.
From people booking an appointment
- The details the booking form asks for: name, phone number, email address (if given) and any note you add.
- The appointment itself: service, staff member, date, time, price, status and history (for example, rescheduled or cancelled).
- Payment status for deposits: amount, whether it was paid, and the payment provider’s reference. Card or bank details are handled by the business’s payment provider, not by Converbold.
- Anything the business adds about you, such as tags, notes or whether you must pay in full before booking.
From everyone
- Messages you send us through the contact form or by email.
- Basic technical information our servers log when pages are requested, such as IP address, browser type and the time of the request. We use this to keep Converbold secure and working, for example to stop automated abuse of booking pages.
We don’t use advertising trackers or sell personal information. See our Cookie Policy for the small number of cookies we use.
How we use it and why
| What we do | Our legal basis |
|---|---|
| Run your account, booking page, calendar and reminders | To perform our contract with you |
| Process bookings and send confirmations and reminders on a business’s behalf | The business’s instructions, as its processor |
| Bill for paid plans and message credits, and keep financial records | Contract, and legal obligations (tax and accounting) |
| Keep accounts secure, prevent fraud and abuse, fix problems | Our legitimate interest in a safe, working service |
| Reply to messages and support requests | Contract, or our legitimate interest in helping you |
| Send important service notices (security, billing, policy changes) | Contract and legal obligations |
| Send product news to business owners | Your consent, which you can withdraw with one click |
We never use the details of people who book with a business to market Converbold or anything else to them.
Who we share it with
We share personal information only with service providers that help us run Converbold, and only what they need:
| Provider | What for |
|---|---|
| Cloud hosting and storage providers | Running Converbold and storing its data and backups |
| Zoho (email) | Sending account emails, booking confirmations and reminders |
| Paystack, Stripe | Processing Converbold subscription and credit payments |
| Paystack, Flutterwave, Stripe (the business’s own account) | Processing deposits a business collects from its customers |
| Termii (SMS) and Meta (WhatsApp) | Sending text and WhatsApp reminders, only when a business turns these on |
| Google Fonts and public content delivery networks | Loading fonts and page code, which means your browser connects to them and shares your IP address |
We may also share information if the law requires it, to protect people’s safety, or as part of a merger or sale of our business, in which case this policy would continue to protect it. We don’t sell personal information to anyone.
International transfers
Some of our providers store or process data outside Nigeria, for example in the European Union or the United States. When that happens, we rely on the safeguards the Nigeria Data Protection Act and the GDPR allow, such as the provider’s contractual commitments to protect the data.
How long we keep it
- Business accounts: for as long as the account is open. When the owner deletes the account, the business, its services, bookings and customer records are deleted from our live systems straight away, and from backups within 30 days.
- Customer records: for as long as the business keeps them. A business can delete a customer at any time. If that customer has past bookings, their name and contact details are erased and the bookings are kept without them, so the business’s reports still add up.
- Invoices and payment records: for as long as tax and accounting law requires, usually six years.
- Signed-in device records: until you sign out of that device or the session expires.
- Messages to us: for up to two years, unless we need them longer to deal with an issue.
How we protect it
Passwords are hashed, payment card details never reach our servers, every business’s data is kept separate and team members only see what their role allows. You can read more on our Security page. No system is perfectly secure. If a breach affects your personal information, we will tell you and the relevant regulator as the law requires.
Your rights
Depending on where you live, you can ask to:
- see the personal information we hold about you and get a copy of it;
- correct anything that’s wrong;
- delete it, or limit how we use it;
- object to how we use it, or withdraw consent you gave;
- receive it in a format you can take elsewhere.
Business owners can do most of this themselves: edit details in Settings, download everything with Export data, and delete the account. For anything else, email support@converbold.com. We’ll reply within 30 days, and we may need to confirm who you are first.
If you’re not happy with how we’ve handled your request, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng), or to the data protection authority where you live.
Children
Converbold accounts are for people aged 18 and over. Businesses may book appointments for children (for example a child’s haircut or a tutoring session), in which case the parent or guardian should provide the details. If you think a child has given us personal information without a parent’s involvement, contact us and we’ll remove it.
Changes to this policy
We’ll update this page when our practices change, and change the date at the top. If a change matters, we’ll tell business owners by email before it applies.
Contact
Murifex Technologies Limited, Lagos, Nigeria. For anything about privacy, email support@converbold.com with “Privacy” in the subject line.