Privacy policy

In effect since October 5, 2026, updated October 25, 2026

What we collect

When you leave a request: your mobile number, your first name (if you give it), the service you want, when you want it, your city, your neighbourhood and your budget (if you give them), and the date of your consent.

When you ask for a reminder after booking: your mobile number, the category, city and number of weeks you chose, and the date, exact wording and version of your consent. Only one text is sent, between 8 a.m. and 9 p.m., and only if spots open up; otherwise, nothing.

When you book with a pro who asks for a deposit: you pay it by card on Stripe’s secure page, straight to the pro. Dispolà never sees your card number; we only keep the payment ID, amount and status (paid, refunded). See Deposit and no-shows.

Not your location. When you pick “Near” (your location, postal code or neighbourhood), sorting by distance happens in your browser: Dispolà never receives or keeps that choice. Your browser remembers it for your next visit (rounded to about a hundred metres for your location); pick “Anywhere” to clear it. In the on-request search (“When are you free?”), the place you give is sent with your search, in the page address, to sort salons by distance: the neighbourhood or postal code you type, or the centre of the map when you move it, rounded to about a hundred metres. If you choose “Near me”, your location, rounded the same way, is sent. Dispolà does not keep it: the visit counter only records the page name, never the full address. The map comes from OpenStreetMap, which, as with any online map, receives the map tiles your browser displays.

The city you pick on the home page is kept in a cookie so we show you the same city next time. It holds only the city name; “All” clears it.

When you click one of a clinic’s times, we count that click to show the clinic how many clients Dispolà sends them: the clinic, the category, the city, the date and the source of the shared link, if any. Nothing that identifies you: no IP address, no cookie, no device.

We count visits to the site, as daily totals, to learn which pages are useful and where people come from: the page viewed (without anything after the “?” in the address), the day, the city and category of the page, the language, the name of the site you came from (for example google.com, never the full address), the source given in a shared link (?ref=…) and whether it is a phone or a computer. Your IP address, browser and device are used only to filter out bots, tell phones from computers and, on the home page, show spots in your region first (to the nearest city), then forgotten: they are never stored, not even encrypted. No cookie, no identifier, no fingerprint: no one can tell who saw what, or follow a person from one visit to the next. The source of a shared link follows through the links on the page, so clicks and requests that come from it are counted too.

Your browser keeps the date of your last visit (in its storage, not in a cookie). Dispolà only receives how long it has been since you last visited (for example “2 to 7 days”) and whether you opened it from your home screen or from a text link: never the date or anything that identifies you, and never with the page viewed. That date is erased after 13 months.

Your favourites and recent searches stay in your browser: Dispolà never receives them. A button clears them.

If you add Dispolà to your home screen, your phone keeps an offline page, never the spots.

For clinics that write to us through “Is this your clinic?”: their name, email or mobile number and message, so we can reply. Deleted after 12 months.

For registered pros: the business name, neighbourhood, services, prices and the open spots they choose to publish. Their phone number is never shown.

Why

Only to find a spot that matches your request, confirm it with the pro and text you about it, or send you the reminder you asked for. We don’t sell your information and we don’t use it for advertising.

Who has access

The Dispolà team, and the pro you book with (your first name and number, for the appointment). Our technical providers (Cloudflare hosting, Twilio text messaging, Stripe for deposits) process this data on our behalf. Some of these providers may store data outside Quebec.

How long

A request is kept while it is active, then for 12 months at most, unless the law requires otherwise.

A reminder ends as soon as it is sent, when you reply STOP, or 7 days after its date if no spot opened up. Proof of your consent (your number, the date, the checkbox wording and its version) is kept for 3 years, to show you agreed to that text (Canada’s anti-spam law), then deleted.

Dispolà Pro (pros with an account)

Your account. Your business name, category, city, neighbourhood, your address if you give it, your mobile number, your email (optional), your bio, your instructions to clients, your services, prices, hours and settings, and the date and version of the terms you accepted. The text code that proves your number is kept only as a hash and expires after 10 minutes.

The session cookie. When you sign in, a cookie named “pro” keeps your session open, for 30 days at most. That is all it does: it is only read in the pro space, never to track you or for advertising, and it is cleared when you sign out. We keep only its hash, not the token itself. It is necessary for the service: without it, you could not stay signed in.

Your Google Calendar, if you connect it. Dispolà only reads your busy times (start and end), so it never posts a time that is already taken: never the title, description, location or guests of your appointments. Dispolà only writes the appointments you confirmed in Dispolà (the client’s first name, the service and the time) to your calendar, and removes them if they are cancelled. Your open times, worked out from your hours and your calendar, are posted on your page: that is the point of the service. Data received from Google is used for nothing else: it is never sold or shared with others, never used for advertising, never used to create, train or improve an artificial intelligence model, and no one at Dispolà reads it, except at your request, for security or when the law requires it. Your Google access token is encrypted. When you disconnect your calendar or close your account, we revoke access at Google and delete the token.

Dispolà’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

An iCal link, if you paste one. We treat it like a password: it is encrypted and never shown in full. Of what your calendar contains, we only keep the start and end of each busy time.

The manual calendar. What you enter there (an appointment taken by phone, a break, a closed day) is only used to work out your open times. Only enter a first name, never health information.

Your clients’ information. When a client books with you through Dispolà, Dispolà collects their first name, mobile number, service and time, and passes them on to you for the appointment. What you enter yourself, or what Dispolà reads in your calendar, Dispolà processes only on your behalf, to run the service, never for anything else, and deletes when you close your account.

Payments through Stripe. If you ask for a deposit, your client pays it on Stripe’s secure page, straight into your Stripe account. Dispolà never sees or keeps their card number. We only keep your Stripe account ID and, for each booking, the payment ID, amount and status (paid, refunded). Stripe handles payment information under its own privacy policy.

Outside Quebec. Our providers for Dispolà Pro are Cloudflare (hosting and database), Twilio (text messages), Google (if you connect your calendar) and Stripe (deposits). They may process information outside Quebec, including in the United States. We assess the protection they offer before sharing any information with them, and we bind them in writing.

Retention and deletion. Your account is kept while it is open. You can close it at any time in your settings or by writing to us: your spots are removed right away, and your account, services, hours, manual calendar, calendar links and tokens and sessions are deleted within 30 days. Bookings and their payment status are kept for 12 months after the appointment (to answer a question or a dispute), then deleted, unless the law requires us to keep them longer. Before closing your account, or at any time, you can get your information in a structured, commonly used format.

Your rights

You can access your information, have it corrected or deleted, and withdraw your consent at any time. To stop the texts, reply STOP.

Person in charge of the protection of personal information

Leon Talbot. For any question or request: bonjour@dispola.ca