Who we are
Marqui (“the service”) is operated by Roman Bitetti, an individual based in Quebec, Canada (“we”, “us”). Contact: contact@marqui.app.
The service is offered only in Brazil and follows Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018). Roman Bitetti is the data protection officer and can be reached at contact@marqui.app.
Our role and the salon’s role
When you book with a salon, the salon is the controller of your personal data: it decides why and how its customers’ data is used. We process that data on the salon’s behalf, as its processor, only to provide the booking service and following its instructions.
You can contact the salon about its use of your data, or write to us at contact@marqui.app and we will pass your request on to the salon and help it answer.
We are the controller of the data of salon managers (their account), of the people who sign up on this website to be told when sign-ups open, and of the technical data of this website.
Data we process
Salon customers
- Name and phone number.
- Bookings: salon, service, professional, date and time, price, status and change history.
- When you book on WhatsApp: your WhatsApp phone number, WhatsApp profile name, the menu choices you make, and message identifiers.
Salon managers
- Email address and sign-in data.
- Salon information: name, team, services, prices and opening hours.
Salons that ask to be told when sign-ups open
- Name and email address, entered in the form on this website.
Technical data
- IP address, used only to limit abusive traffic.
Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Provide the booking service: show availability, create, change and cancel bookings | Performance of a contract (LGPD art. 7, V) |
| Reply to you on WhatsApp and keep the conversation state, so the bot knows where you are in the menu | Performance of a contract (LGPD art. 7, V) |
| Give salons access to their appointments | Performance of a contract (LGPD art. 7, V) |
| Tell you when sign-ups open, if you asked us to through the form on this website | Consent (LGPD art. 7, I) |
| Security and abuse prevention | Legitimate interest (LGPD art. 7, IX) |
| Comply with legal obligations | Legal obligation (LGPD art. 7, II) |
Who we share it with
We share personal data only with these service providers and partners, and only as needed to run the service:
- The salon you book with, which receives your booking and contact details.
- Supabase: database and authentication, hosted in São Paulo, Brazil.
- Vercel: hosting, São Paulo region.
- Meta Platforms (WhatsApp Business Platform), which carries WhatsApp messages. See the WhatsApp Privacy Policy.
We do not sell personal data and we do not use it for advertising. We may also disclose data when the law requires it.
International transfers
The service’s data is stored in Brazil (São Paulo). Some of it is still accessed from or transferred to other countries:
- the operator of the service works from Canada and accesses the data remotely to run, support and maintain the service;
- Supabase, Vercel and Meta Platforms are companies based in the United States, which may access the data or process it there.
These transfers are made only to provide the service and rely on the mechanisms of article 33 of the LGPD, including the contractual clauses of ANPD Resolution CD/ANPD No. 19/2024 where applicable. The data stays protected by the same security measures as in Brazil.
How long we keep it
- WhatsApp conversation state: deleted automatically 24 hours after the last message.
- WhatsApp message identifiers: deleted after 7 days.
- Opening-notification list (name and email): deleted at the latest 6 months after sign-ups open, or sooner if you ask.
- Customer and booking records: kept while the salon uses the service or until deletion is requested, unless the law requires us to keep them longer.
Your rights
Under the LGPD (art. 18), you can ask for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- deletion, anonymization or blocking of your data;
- portability of your data;
- information about the entities we share your data with;
- information about the possibility of not giving consent, and its consequences;
- withdrawal of your consent, where processing relies on consent;
- objection to processing that does not comply with the LGPD.
Send your request to contact@marqui.app. It is free. We reply within 15 days. When the salon is the controller, we forward your request to the salon and help it answer.
You can also file a complaint with Brazil’s National Data Protection Authority (ANPD).
Deleting your data
Email contact@marqui.app with the phone number you used and the name of the salon. We confirm the deletion by email. Full instructions are on the data deletion page.
Security
- Data is encrypted in transit.
- Each salon’s data is isolated from other salons at the database level.
- Access follows the least-privilege principle: each person and system gets only the access it needs.
- If a security incident may cause significant risk or harm, we notify the salons concerned without delay and, as required by the ANPD, the ANPD and the people affected.
Children
The service is not intended for children under 14.
This website
This website does not use cookies, analytics or any third-party trackers.
Changes and contact
When we update this policy, we publish the new version on this page with a new “last updated” date. Questions: contact@marqui.app.