emly Privacy Policy
Effective date: 1 October 2026
1. Summary
emly is a booking and client-management platform for beauty, wellness, fitness, esthetic-medicine, psychology and similar businesses, and an app in which their customers find businesses, book and manage their visits. This policy explains what personal information we handle, why, who receives it, how long we keep it, and how you can control it.
- We collect what the service needs. For customers that is mainly your phone number, name, bookings and payments. For businesses it is the details of the people who use the dashboard and the business data they enter.
- The businesses you book with receive your booking details, because they need them to serve you. Each business is responsible for how it uses its own client records.
- We never see your full card number. Card payments are made on the bank's secure payment page.
- We do not sell personal information, and we do not use it to build advertising profiles.
- You are in control. You can change your notification choices, opt out of any business's marketing, and delete your emly account in the app at any time (section 12).
2. Who we are
emly is provided by RetentionForce, Inc., a Delaware corporation, 131 Continental Drive, Suite 305, Newark, DE 19713, United States ("emly", "we", "us").
- Privacy questions and requests: [email protected]
- Help with the app or the dashboard: [email protected]
In Armenia, emly is sold and supported by RetentionForce AM LLC, an independent Armenian company that is our authorised distributor and representative. RetentionForce AM LLC also provides online card payments for Armenian businesses together with Ameriabank CJSC (section 7.3). Local support in Armenia: WhatsApp +374 98 660833, phone +374 11 288 088.
This policy covers the emly mobile app, the businesses' web booking pages and the business dashboard (at emly.am and emly.co). Our marketing websites (www.emly.am, www.emly.co) have their own short privacy and cookie notices.
3. Whose information this is, and our role
This policy covers:
- Customers who use the emly app (iOS and Android). You have an emly account, which works with every business on emly.
- Customers who book on a business's web booking page (for example
emly.am/b/…oremly.co/b/…). You sign in to that business's page with your phone number. This does not create an emly account: your details become that business's client record. - Business users: owners, managers and staff who use the emly dashboard.
- Other people whose details reach us through a business or a customer, for example the recipient of a gift card.
Our role depends on the information:
| Information | Our role | What it means |
|---|---|---|
| Your emly app account, devices, favourites and notification choices; business-user accounts and business billing; the security logs of our services | Controller | We decide how this information is used, and this policy applies in full. |
| The client records a business keeps in emly: its client list, bookings, visit history, sales, notes, forms, and the messages it sends, including the record created when you book on its web booking page | Processor (service provider) for the business | The business is the controller and decides how its records are used. The business's own privacy notice applies. We process these records only on its instructions (Part C of our Terms). Requests about them are best sent to the business; we will help it respond. |
| Connecting business records that carry your phone number to your emly app account and showing them to you in the app; filling in a new app profile from those records; publishing ratings and reviews | Independent controller | We use these records for these purposes of our own, as described in sections 4.1, 7.1 and 7.5. |
RetentionForce AM LLC is the controller of the records it keeps for its own contracts with Armenian businesses (sales, invoicing and local support) and, with Ameriabank, of the payment records described in section 7.3.
4. What we collect
4.1 Customers using the emly app
Your phone number and name are required to create an account and book. Everything else is optional.
| Category | Details | Source |
|---|---|---|
| Phone number | Creates your account and signs you in with a one-time code. | You |
| Sign-in codes | A one-time code sent by SMS or WhatsApp. The code itself is not kept in our message logs. | We generate it |
| Profile | First and last name, preferred language; optionally email address, date of birth, gender and photo. | You. If a business on emly already has you as a client under the same phone number, we may fill in your name, email and language from that record when you first sign in. |
| Bookings | Businesses, services, staff, dates and times, notes you write to the business, booking status, cancellations and no-shows. | You and the businesses |
| Purchases and balances | Deposits, payments, memberships, packages, gift cards, vouchers, coupons, loyalty points and prepaid balances at each business. | You, the businesses and the payment provider |
| Payment details | Amount, currency, status, order reference, and what the bank returns to us: a masked card number, the cardholder name, the card-issuing bank and its country and, if you entered it, an email. We never receive your full card number or security code. | The bank |
| Receipts | Sale receipts and, in Armenia, fiscal (eHDM) receipts. | The businesses and the fiscal system |
| Favourites | Businesses you save. | You |
| Device and session data | A random identifier for each app install, device platform, app and operating-system versions, sign-in session records and, if you allow notifications, a push token. | Your device |
| Notifications | The notifications sent to you and whether they were delivered, opened or tapped; your notification choices, lock-screen privacy setting, and whether and how you agreed to receive offers (section 13). | Us and your device |
| Location (optional) | Only if you allow it, and only while you use the app. With "Near me" on, the app sends your location rounded to about 110 metres with the search, to sort businesses by distance. Sorting a business's branches by distance happens on your device. We do not store your location in your account or keep a location history. | Your device |
| Crash reports | Error type, where in the app it happened, app and device versions, and your internal account identifier. Names, phone numbers and message text are removed before a report is sent. | Your device |
The app asks for these permissions, and works without them:
- Location (while using the app): "Near me" results and distances.
- Notifications: booking updates and, if you agree, offers (section 13).
- Calendar: only on iPhones with iOS versions before 17, and only when you tap "Add to calendar". We do not read your calendar.
The app contains no advertising, no third-party analytics or attribution tools, does not use advertising identifiers and does not track you across other companies' apps or websites.
4.2 Customers using a web booking page
When you sign in to a business's booking page and book, we collect for that business:
- your phone number (verified with a one-time code), name and, optionally, email address;
- the booking, your notes, and your answers to the business's booking questions or forms;
- payment and receipt details, as in section 4.1.
If the business has connected its Facebook page, you can also book from its Messenger chat; the business then receives the Messenger identifier Facebook gives it and, as Facebook provides them, your name, profile photo, language, time zone and gender.
These details become the business's client record (section 4.4). We also handle, as controller, the technical data your browser sends (section 4.7).
4.3 Business users
- Account: name, email address, phone number, password (stored only as a salted hash; memory-hard scrypt hashes, to which older hashes are upgraded), language, and your Google account identifier if you sign in with Google.
- Work data the business enters: locations, role, access level, working hours, services, and, if entered, photo, bio, title, pay, commission and targets.
- Activity and security: sign-in sessions with the IP address and browser of each, last activity, API-key use, and, if you allow browser notifications, a push subscription.
- Sign-up: how you found us (campaign source), country, industry, team size and the sign-up steps you completed.
- Billing: plan, seats, invoices and billing contact. Subscription card details are collected by Stripe, not by us. For online card payments in Armenia, the business's bank account details.
- Support: messages you send us.
4.4 Client records that businesses keep in emly (we act as processor)
A business may store about its clients: name, phone numbers, email, date of birth, gender, language, address, social-media handles, photo, client card number, notes and recommendations, tags, visit and purchase history, balances, memberships, check-ins, loyalty and referral data, answers to intake forms (including images), files it uploads, feedback and ratings, messages sent and received by SMS, WhatsApp, email or push, and, if it connects a phone system, call logs. emly also calculates statistics from this history for the business, such as number of visits, spending and when a next visit is due.
The business decides what to record. Some businesses may record health-related information in notes or forms; the business is responsible for having a lawful basis and any consent this requires.
4.5 Information we receive from someone else
- From businesses: your client record, when you are their client and have (or later create) an emly app account with the same phone number (section 7.1).
- From another customer: if someone buys you a gift card, we receive your name, phone number, email address and their message so we can deliver it. You are added as a client of that business (or the record it already has for your number is used), so the gift card appears in your emly account if you have one. That business may then send you messages as its client (section 13).
- From Google or Facebook, if a business user signs in with Google or a business connects its Facebook page: the identifier, name and email address these services provide.
4.6 Health-related information
Health-related businesses on emly are psychologists and medical or therapy clinics, such as dental, physiotherapy, speech-therapy, psychiatric or other medical clinics. Cosmetic and esthetic-medicine practices are not among them. That you booked with a health-related business, and the service you booked, can reveal something about your health, so we treat it as sensitive information:
- we use it only to provide your bookings and show them to you, and never for marketing, advertising or statistics of our own;
- outside that business it reaches only the service providers that run emly (section 7.2) and any tools the business itself connects;
- we show it in your emly app account only with your consent, which we ask for when you create your account. You can withdraw it at any time by writing to [email protected]; we then stop showing bookings at these businesses in your account;
- push notifications about these businesses show no details on the lock screen by default ("Automatic" lock-screen privacy). SMS and WhatsApp messages, such as reminders, can still show the business's name in your phone's previews;
- reviews of these businesses are published without the reviewer's name (section 7.5);
- the business's own Meta Pixel (section 4.8) is never loaded on the booking pages of psychiatric and other specialized medical clinics. Other health-related businesses may add one to their booking page, like any business; it then learns that you visited the page and that you booked.
4.7 Information collected automatically
- Server logs: IP address, time, the page or API address requested, response status and browser or app version. The rounded "Near me" location can appear in these logs.
- Diagnostics: error reports and performance data from our servers, the dashboard, booking pages and the app. Server error reports exclude request contents and client details. Dashboard error reports include the business user's account identifier and email address, and the business's identifier and name.
- Message engagement: for messages sent through emly, delivery status and, for emails and tracked links, whether they were opened or clicked.
4.8 Cookies and local storage
The dashboard and the booking pages use no analytics or advertising cookies of ours.
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
emly_rt, emly_sh, emly_at (cookies) |
Business dashboard | Keep you securely signed in; allow file downloads | Up to 60 days after the last sign-in renewal; removed when you sign out |
x-auth-customer-token:<business> (local or session storage) |
Web booking pages | Keeps you signed in on that business's booking page | Until you sign out, or until the browser tab closes if you did not choose to stay signed in |
ui-locale, ui-locale-chosen, ui-customer-locale, calendarView, calendarTimeCellHeight, preferred-location (local storage) |
Dashboard and booking pages | Remember language and display preferences | Until cleared |
push-prompt-dismissed-until, push-prompt-never-ask, emly.setupGuide.celebrated.*, emly.subscriptionCheckoutIntent:*, emly.smsBundlePurchaseIntent:* (local storage); emly.business-setup.*, emly.wizardStepsSent.*, emly-chunk-reload (session storage) |
Business dashboard | Remember the state of prompts, set-up, checkout and purchases; recover after an app update | Until cleared, or until the tab closes (session storage) |
client-referredBy (local storage) |
Booking pages | Remembers the referral link you arrived from, so the referral reward works | Until cleared |
| Cloudflare Turnstile | Business sign-up | Protects sign-up from bots | Session |
emly_handoff_token (cookie) |
Web booking pages, after you open a sign-in link from a message | Passes your sign-in from the link to the booking page, so the link's address never carries it | Up to 2 minutes; removed as soon as the page has read it |
Meta Pixel of the business (_fbp cookie) |
A business's booking page, only if that business added its own Pixel ID | Lets that business measure its own advertising. The business is responsible for it. Never loaded on the booking pages of psychiatric and other specialized medical clinics, or on the page you return to after a card payment (section 4.6). Where it is loaded, it learns that you visited the page and when you book. | Set by Meta, 90 days |
When you move from a booking page to another page or site, the booking page passes on only its site name (the domain), not the address of the page you were on.
Pages also load fonts from Google Fonts, icons from cdnjs (Cloudflare), maps from Google Maps (dashboard address fields) and error reporting from Sentry; these services receive your IP address and browser details.
In the mobile app we store on your device your sign-in tokens (in the device's encrypted secure storage), the app-install identifier and a cache of your data so the app works offline. This is removed when you sign out or delete the app.
You can clear or block cookies and local storage in your browser. Blocking the sign-in items will sign you out.
5. Why we use information, and our legal bases
| Purpose | Information | Legal basis (GDPR and UK GDPR) |
|---|---|---|
| Create and secure your account, sign you in, keep sessions safe | Phone, sign-in codes, device and session data | Contract (Art. 6(1)(b)); security is also a legitimate interest (Art. 6(1)(f)) |
| Find businesses, book, pay, and see your bookings, memberships, gift cards, loyalty, receipts and favourites | Profile, bookings, purchases; location only with your permission | Contract (Art. 6(1)(b)); location: consent (Art. 6(1)(a)) |
| Connect your app account to the client records businesses hold under your phone number, so all your bookings are in one place | Phone, client records | Contract (Art. 6(1)(b)); for health-related businesses, your explicit consent (Art. 9(2)(a)) |
| Send booking confirmations, reminders, changes, cancellations and receipts | Contact details, bookings | Contract (Art. 6(1)(b)) |
| Send you offers by push from businesses you have a relationship with | Account, the businesses you visited, booked or saved, consent record | Consent (Art. 6(1)(a)) |
| Take payments, refunds and payouts | Payment details | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Provide the dashboard, subscriptions and billing to businesses | Business-user accounts, billing | Contract (Art. 6(1)(b)) |
| Store and process client records for businesses | Section 4.4 | On the business's instructions, as its processor (Art. 28) |
| Deliver gift cards and add the recipient as a client of the business | Recipient's name, phone, email, message | Legitimate interest in delivering the gift the buyer paid for (Art. 6(1)(f)) |
| Publish ratings and reviews (section 7.5) | Rating, comment, date, reviewer's first name and last initial, staff member's first name | Legitimate interest in honest, useful reviews (Art. 6(1)(f)); you can ask us to remove your review |
| Keep the service reliable and secure, prevent fraud and abuse | Diagnostics, logs, activity | Legitimate interest (Art. 6(1)(f)) |
| Tell business users about emly's features and offers, if we send such messages | Business-user contact details | Legitimate interest, with an unsubscribe link in every message (Art. 6(1)(f)) |
| Answer support requests | Your messages, account data | Contract or legitimate interest (Art. 6(1)(b)/(f)) |
| Comply with the law; establish, exercise or defend legal claims | Relevant information | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details and object at any time (section 11). Where we rely on consent, you can withdraw it at any time; this does not affect what was done before.
Armenia. Under the Law of the Republic of Armenia "On Protection of Personal Data", we process your information with your consent, which you give when you create your account or sign in to a booking page and which covers the purposes above, or where a law provides for it. Business users give it when they create their account.
Australia and New Zealand. We collect personal information only when it is reasonably necessary for the purposes above, use it for those purposes or related ones you would reasonably expect, and collect sensitive (health) information only with consent.
Providing your phone number and name is necessary to create an account and book; without them we cannot provide the service. Everything else is optional.
6. Automated processing
emly does not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Some things happen automatically:
- Security checks. Repeated failed sign-in attempts, too many code requests or bot-like sign-ups are blocked or slowed down automatically for a while, using the phone number, IP address and browser signals. If you think you were blocked by mistake, write to [email protected].
- Business rules. A business can set rules that apply automatically, for example that a deposit is required to book certain services, or reminders and messages sent at set times. The business sets and is responsible for these rules. You can ask the business to review a decision.
- Client groups. emly sorts a business's clients into groups, such as "new" or "due for a visit", from their visit history, so the business can look after them. The business decides what to do with them.
- Offers by push reach you only from businesses you have visited, booked with or saved as a favourite, and only if you agreed to offers.
The AI assistant available to some business users answers questions about the business's own figures. It does not make decisions about customers.
7. Who we share information with
7.1 The businesses you book with
When you book, buy or sign in, the business receives what it needs to serve you: your name, phone number, email (if given), language, the booking and payment details, your notes and form answers. A business sees only its own relationship with you, not your bookings at other businesses. It can see whether the messages it sent you were delivered, opened or clicked.
When you first book with a business through the app, we create a client record for you in its account, or connect your account to the record it already has for your phone number; your profile may fill in an empty name, email or language field in that record.
We connect your app account to every client record that businesses on emly hold under your phone number: when you sign in, and whenever a business adds a record with your number or changes a record's number to yours. This is how bookings you made by phone or in person appear in the app. We tell you about this when you create your account.
Reassigned phone numbers. Mobile operators sometimes give an old number to someone new. If you see bookings, balances or other items in the app that are not yours, or receive messages meant for someone else, write to [email protected] (or tell the business) and we will unlink the records.
7.2 Service providers
These providers run emly for us. They may use the information only to provide their service, under contracts that require them to protect it.
| Provider | What it does | Information | Location |
|---|---|---|---|
| Heroku (Salesforce, Inc.) | Application hosting | All service data while it is processed | United States |
| MongoDB, Inc. (MongoDB Atlas) | Database hosting and backups | All stored service data | United States (AWS us-east-1) |
| Redis Ltd. (Redis Cloud) | Job queues and short-lived working data | Message and job data | United States (AWS us-east-1) |
| Amazon Web Services, Inc. | Storage of uploaded files, such as photos and form images (S3); our fixed-address relay server for bank payouts | Uploaded files; encrypted payout requests passing through the relay | United States |
| CDN77 (DataCamp Limited) | Fast delivery of uploaded images and files | Uploaded files, IP address | Global network |
| Cloudflare, Inc. | Network security and delivery; bot protection (Turnstile) | IP address, browser signals | Global network |
| Twilio Inc. (SendGrid) | Email delivery, open and click tracking | Email address, message content | United States |
| SMS gateways: Dexatel (Armenian numbers), Peleka (Russian numbers), Cellcast (Australian numbers); and gateways a business chooses for its own account (Plivo, Nikita, Mobis, Africa's Talking, Paradox) | SMS delivery, including sign-in codes | Phone number, message content | Armenia (Dexatel, Peleka), Australia (Cellcast); for a gateway a business chooses, that gateway's country |
| Pact LLC (Russia), which connects to WhatsApp (Meta Platforms, Inc.) | WhatsApp messages, including sign-in codes (sent by WhatsApp first to phone numbers outside Armenia and Australia) | Phone number, message content | Russia (Pact); WhatsApp: United States and other countries |
| Apple Inc. (APNs) and Google LLC (Firebase Cloud Messaging) | Push notifications to the app | Push token, notification content | United States |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Browser notifications for business users | Push subscription, notification content | United States and the EU |
| 650 Industries, Inc. (Expo) | App updates | IP address, device and app version | United States |
| Stripe, Inc. and its affiliates | Subscription and SMS-credit billing for businesses | Billing contact and payment details | United States and the EU |
| Google LLC | Maps and address suggestions, Google Sign-In, fonts, voice for the AI assistant | IP address and map requests; Google account identifier, name and email; assistant answers | United States |
| OpenAI, L.L.C. | The AI assistant, only when a business user uses it | The question as typed, the user's first name, the staff list (names and roles) and the business's own figures; emly adds no client names | United States |
| Functional Software, Inc. (Sentry) | Error and crash reports | Section 4.7 | European Union (Frankfurt) for the app; United States for our servers, dashboard and booking pages |
| New Relic, Inc. | Server performance monitoring | Technical request data | United States |
| RetentionForce AM LLC | Sales, onboarding and support for businesses in Armenia | Business-user and business account data; client records only when a business asks for help with them | Armenia |
Only for Armenian businesses that accept card payments: Ameriabank CJSC (card payments and payouts, with RetentionForce AM LLC), ArmSoft (bank payout interface), Telcell (payment terminals, if the business uses them), and the fiscal systems the business uses (the State Revenue Committee's eHDM, or Haysell).
When a business connects its own tools to emly, such as its own SMS account, a Facebook page, a fiscal-register provider, a phone system or its own Meta Pixel, information flows to those tools on the business's instructions and under its responsibility.
We will update this list before we add or replace a provider that handles client records, as described in Part C of our Terms.
7.3 Card payments in Armenia
Online card payments to Armenian businesses are provided by RetentionForce AM LLC together with Ameriabank CJSC. You pay on Ameriabank's secure payment page; Ameriabank processes the card transaction and holds the funds until they are paid out to the business. Ameriabank and RetentionForce AM LLC receive the payment details they need for this, keep their own payment records as Armenian banking and tax law requires, and act as controllers of those records.
7.4 Fiscal authorities
Sales in Armenia are registered in the State Revenue Committee's electronic fiscal (eHDM) system, as the law requires. The receipt includes the items, amounts and payment method.
7.5 Ratings and reviews
After a visit, a business may ask you to rate it. The request tells you that your review may be published. If you add a written comment, the review may be shown publicly on the business's profile and on the staff member's profile, in the emly app and, if the business turns this on, on its booking page, with:
- the rating, the comment and the date;
- your first name and the initial of your last name, or no name at all for psychologists and medical or therapy clinics (the health-related businesses of section 4.6);
- the first name of the staff member linked to the visit.
Ratings without a comment count only towards average ratings. Reviews that a business brings from the booking system it used before emly are shown in the same way. Only a client of the business can leave a review, through the feedback link sent after a visit or by signing in to its booking page; a review is marked "verified visit" when it is linked to a recorded sale. To have your review removed, or to report a review, write to [email protected].
7.6 Legal requests and protection
We may disclose information if the law, a court order or a lawful request from a public authority requires it, or when needed to protect the rights, property or safety of our users, the businesses, the public or emly.
7.7 Business changes
If emly is involved in a merger, acquisition or sale of assets, personal information may transfer to the new owner, who must protect it as this policy describes. We will tell you before that happens.
We do not sell personal information and do not share it with third parties for their own advertising.
8. International transfers
We are a US company and our main servers are in the United States. Our providers are in the countries listed in section 7.2: mainly the United States, and also the European Union, Armenia and global networks. So your information may be processed outside the country where you live.
- EU, EEA, UK and Switzerland: when we receive information from these countries, or send it on to a provider in a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (with the UK Addendum for the UK), or rely on the provider's certification under the EU–US Data Privacy Framework and its UK and Swiss extensions.
- Australia: your information is likely to be disclosed to recipients in the United States, the European Union, Armenia and, for WhatsApp messages, Russia. We require our providers to protect it to a standard consistent with the Australian Privacy Principles.
- New Zealand: we disclose information overseas only to providers bound by contract to protect it in a way comparable to the New Zealand Privacy Act 2020.
- Armenia: information is transferred abroad with your consent, given when you create your account or sign in to a booking page, and for client records on the instructions of the business.
You can ask us for a copy of the safeguards at [email protected].
9. How long we keep information
We keep personal information only as long as we need it for the purposes in this policy or as the law requires, and then delete or anonymise it.
| Information | How long |
|---|---|
| emly app account and profile | Until you delete the account (section 12). We may delete an account nobody has signed in to for 3 years, after telling you by SMS 30 days before. |
| Sign-in codes | Valid for 15 minutes; deleted 24 hours after they are issued. |
| Sign-in sessions | Until you sign out, or 60 days after the session was last renewed. |
| App devices | Disabled when you sign out; deleted 90 days later. |
| Favourites, notification choices and your consent to offers | Until you change them or delete your account. |
| A business's client records, bookings and sales | As long as the business keeps them in its emly account, and until it asks us to delete them or the account. |
| Sign-in code messages (the code itself is never stored) | 12 months after they were sent. |
| Notifications in the app's Notifications inbox | 12 months after they were sent. |
| Messages businesses send and receive through emly (SMS, WhatsApp, email, push) | The content and recipient address are deleted 24 months after sending. A record without them (date, channel, delivery status) is kept as long as the business account exists, for its reports. |
| Marketing opt-outs | As long as the business's account exists, so your choice is respected. |
| Published reviews | As long as the business's account exists, or until you ask us to remove them. |
| Business-user accounts | As long as the user has access to a business account; then as for that business's data. |
| Business accounts | Until the business asks us to delete them. We may delete a business account that has had no paid subscription and no sign-in for 24 months, after telling its owner by email 30 days before. |
| Error reports and performance data | Up to 90 days. |
| Server logs | Not archived: our hosting provider keeps only the most recent entries, for a short time. |
| Database backups | 7 days, after which they are overwritten. |
| Support requests | 3 years after the request is closed. |
RetentionForce AM LLC, Ameriabank and Stripe keep their own billing and payment records for the periods the law requires of them.
10. Security
We protect personal information with technical and organisational measures, including:
- encryption in transit (HTTPS) everywhere, and encrypted storage at our hosting providers;
- passwords stored only as salted hashes, using memory-hard scrypt (older hashes are upgraded); one-time codes that expire after 15 minutes and are limited in attempts;
- short-lived sign-in tokens, sessions that rotate and can be ended from any device, and app tokens kept in the device's encrypted secure storage;
- card payments only on the bank's certified payment page;
- permission levels for business staff, and restricted internal access; when our support team signs in to a business account at its request, the session is time-limited and recorded;
- removal of credentials and client details from diagnostic reports;
- regular backups.
No system is completely secure. If a data breach is likely to cause you serious harm or puts your rights at high risk, we will tell you and the competent authorities as the law requires, including under the GDPR (within 72 hours to the authority) and the Australian Notifiable Data Breaches scheme. Where a breach affects a business's client records, we tell the business without undue delay so that it can act.
11. Your rights
You can ask us to:
- tell you whether we hold information about you, and give you a copy (access);
- correct information that is wrong or incomplete;
- delete information, or stop or restrict its use;
- give you your information in a portable format;
- stop using your information for marketing, at any time;
- object to uses based on legitimate interests;
- withdraw a consent you gave.
These rights apply as the law where you live provides:
- EU, EEA and UK: all the rights above, and the right to complain to your data protection authority (in the UK, the Information Commissioner's Office). UK residents can first complain to us at [email protected]; we will acknowledge the complaint within 30 days.
- Australia: access and correction under the Australian Privacy Principles, and the right to complain to the Office of the Australian Information Commissioner (oaic.gov.au) if you are not satisfied with our answer.
- New Zealand: access and correction under the Privacy Act 2020, and the right to complain to the Privacy Commissioner (privacy.org.nz).
- Armenia: the rights under the Law "On Protection of Personal Data", including to know, access, correct, block or destroy your information, withdraw consent, and appeal to the Personal Data Protection Agency or a court.
- United States: where a state privacy law applies to us, the rights it gives, without discrimination for using them. We do not sell or share personal information for cross-context behavioural advertising.
How to exercise them:
- In the app: edit your profile and notification choices in Profile & settings, and delete your account (section 12).
- By email to [email protected], with the phone number of your account. We confirm the request with a one-time code sent to that number, and may ask for more to confirm your identity.
- For client records a business keeps about you (section 4.4), contact the business. If you contact us, we pass your request to the business and help it respond.
We answer within one month, or sooner where the law requires. Exercising your rights is free, unless a request is clearly unfounded or excessive.
12. Deleting your emly account
You can delete your emly app account at any time (if the app refuses, for example because the account is blocked, email us):
- In the app: Profile & settings → Delete account.
- Without the app: email [email protected] from any address with the phone number of the account. We confirm the request with a one-time code sent to that number and delete the account within 30 days.
When your account is deleted:
- your emly account, profile, favourites, notification choices, consent records, sign-in sessions and devices are deleted;
- each business's client record about you, with your bookings, balances, memberships, gift cards, deposits, sales and receipts, stays with that business and is unlinked from your account. Nothing is forfeited because of the deletion; each business's own rules continue to apply, and you can contact the business directly;
- upcoming bookings are not cancelled. If you will not attend, cancel them before you delete your account;
- your account will not be connected to those records again automatically if you later sign up with the same number;
- each business controls its own records; ask the business if you want them deleted.
Customers who only use web booking pages have no emly account: their details are the business's client record, so requests to delete them go to the business (we will help).
13. Notifications and marketing
- Booking notifications (confirmations, reminders, changes, cancellations) are part of the service. You can turn off Appointment updates by push in Profile & settings → Notifications, or block notifications in your phone's settings; they then come by SMS instead.
- Lock-screen privacy: in Profile & settings choose Automatic (no details for medical and therapy visits), Always discreet or Always detailed.
- Offers by push: when you turn on notifications in the app, you can agree to receive offers by push from businesses you have visited, booked with or saved as a favourite. You can withdraw at any time by turning off Offers in Profile & settings → Notifications.
- Marketing from a business by SMS, WhatsApp or email: the business is the sender and is responsible for having your consent where the law requires it and for identifying itself. Every such message sent through emly carries an unsubscribe link. You can also reply STOP to a WhatsApp message, and to an SMS where the message allows replies. Opting out applies to that business only, takes effect immediately, and does not stop booking notifications.
- Feedback requests: a business may ask for feedback after a visit. You can ask the business to stop.
- emly's emails to business users: any marketing email we send you has an unsubscribe link; service emails about your account continue.
14. Children
emly is not directed at children. You must be at least 16 to create an emly account or a business-user account. A parent or guardian may book services for a child with their own account. If you believe a child has given us personal information, write to [email protected] and we will delete it.
15. Changes to this policy
We update this policy when our service or the law changes, and publish the new version with a new effective date. If a change is significant, we tell you before it takes effect: business users by email, and customers by email or, if we have no email address for you, by SMS. Where a change needs your consent, we ask for it.
16. Contact and complaints
RetentionForce, Inc. 131 Continental Drive, Suite 305, Newark, DE 19713, United States Privacy: [email protected] · Support: [email protected]
In Armenia: RetentionForce AM LLC, Kanakertsi 173/5, Yerevan 0092, Armenia · WhatsApp +374 98 660833 · Phone +374 11 288 088
Please contact us first; we will try to resolve your concern. You can also complain to your data protection authority, including the Office of the Australian Information Commissioner, the New Zealand Privacy Commissioner, the UK Information Commissioner's Office, the authority of your EU or EEA country, or the Personal Data Protection Agency of the Republic of Armenia.
This policy is published in English, Armenian and Russian. The English version prevails, except where the law requires the Armenian version to prevail.