Zivly Technologies Inc. (“Zivly,” “we,” “us,” or “our”) operates the Zivly platform at zivly.ca — a cloud-based business management and online booking platform for Canadian personal-care businesses, together with the Zivly customer app. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.
By using Zivly — whether as a subscribing business (“Merchant”), an end customer booking an appointment (“Customer” or “Client”), or a visitor to our marketing website — you acknowledge that you have read this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described.
Dual-role notice
Zivly acts as the data controller for information about Merchants, their staff, and visitors to our marketing website. For personal information about a Merchant's end customers (Clients) collected through a Merchant's booking page, Zivly acts as a data processor on behalf of that Merchant, who is the data controller. Customers wishing to access, correct, or delete information held by a specific business should contact that business directly — we will support them as the processor.
1. Who We Are
Zivly Technologies Inc. is a Canadian technology company headquartered in Etobicoke, Ontario. We build and operate the Zivly platform, which provides scheduling, payment, marketing, and business management software to personal-care businesses in Canada and a customer app for booking appointments at those businesses. Privacy Officer: [email protected].
2. How This Policy Applies to You
If you are a Customer (booking appointments)
You interact with Zivly through the customer app or a Merchant's Zivly-powered booking page. Some of your data is held by Zivly (account credentials, login activity, app analytics) and some is held on behalf of the Merchant you booked with (your appointment details, notes, preferences). For account-level requests, contact Zivly. For appointment-level requests at a specific salon, contact that salon directly.
If you are a Merchant or staff member
Zivly is the controller of information you provide for your subscription, your account, and your business profile. You and your business are responsible for being a controller of the Client data you collect through your Zivly account — including providing Clients with a privacy notice and honouring access, correction, and deletion requests under PIPEDA.
If you are a website visitor
If you visit zivly.ca without booking or subscribing, we collect limited analytics and any information you submit to forms (newsletter signup, contact form). See Sections 3 and 6.
3. Personal Information We Collect
3.1 From Customers (consumer app)
- Account info: name, email, phone, password (hashed) or third-party login identifier;
- Booking history with participating Merchants;
- Communication preferences and consent records;
- Device, app, and usage information (see Section 3.5);
- Payment method tokens (no raw card data — see Section 3.4).
3.2 From Merchants and Staff
- Business legal name, operating name, business address and province;
- Owner/administrator name, email, phone;
- Billing information (processed via Stripe — Zivly does not store raw card numbers);
- Staff names, email addresses, roles, login credentials;
- Content uploaded by the business (services, prices, photos, descriptions, custom forms).
3.3 Client Data Collected on Behalf of Merchants
When a Customer/Client books through a Zivly-powered booking page or the Zivly customer app, the following may be collected on behalf of and at the direction of the Merchant: full name, email address, phone number, appointment history, preferences, custom-form responses, and staff notes. Zivly collects this data solely to provide the platform services to the Merchant. We do not use Client data for our own marketing or share it with advertisers.
3.4 Payment Information
Payment card details are collected and processed exclusively by Stripe, Inc. Zivly never collects, stores, or transmits raw card numbers, CVV codes, or full PAN data. Zivly stores only Stripe payment-method tokens and Stripe Connected Account identifiers. All payment-data security is governed by Stripe's PCI DSS Level 1 compliance.
3.5 Automatically Collected Information
IP addresses, browser and device type, pages visited, features used, session duration, click patterns, error logs, and crash reports. Used to operate, secure, and improve the platform.
3.6 Google Services
We use Google Firebase Authentication for login and the Google Maps API for location features. Google may collect technical data per their Privacy Policy at policies.google.com/privacy.
4. How We Use Your Information
We use personal information only for the purposes for which it was collected and to the extent necessary:
- Providing the platform: operating, maintaining, and delivering features — scheduling, payments, staff management, customer communications;
- Authentication and security: verifying identity via Firebase, preventing unauthorized access, detecting fraud, protecting platform integrity;
- Transactional communications: booking confirmations, reminders, receipts via Resend (email) and Twilio (SMS), with SMS sent only to customers who have opted in (see SMS/Text Messaging Consent below);
- SMS/Text Messaging Consent: Customers may opt in to receive appointment-related SMS messages (booking confirmations, reminders, and updates) by checking the consent checkbox during booking. Message and data rates may apply. Message frequency varies. Reply STOP to opt out at any time, or HELP for assistance. SMS opt-in information will not be shared with third parties for marketing purposes.
- Marketing SMS Consent: Customers may separately opt in to receive marketing SMS messages (promotions, discounts, and offers) from individual Merchants they have booked with, by enabling this preference during the booking process for that specific Merchant. This consent is distinct from, and independent of, consent for transactional SMS. Message and data rates may apply. Message frequency varies by Merchant. Reply STOP to unsubscribe from a Merchant's marketing messages at any time, or HELP for assistance. Marketing SMS opt-in phone numbers are not shared with third parties for marketing purposes.
- Mobile Information Non-Sharing: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. This information is used solely to deliver the transactional and marketing messages described above, on behalf of the Merchant the customer has a relationship with.
- Marketing communications: promotional messages via Brevo (email) and Twilio (SMS), sent on behalf of Merchants only where the recipient has provided valid CASL express or implied consent. Every message includes a working unsubscribe;
- Billing and payments: processing subscription fees and managing billing via Stripe;
- Analytics and improvement: analyzing usage via PostHog and Google Analytics; aggregated and anonymized where feasible;
- Customer support: responding to inquiries, troubleshooting, resolving disputes;
- Legal compliance: fulfilling obligations under applicable Canadian law, including responses to lawful authority requests.
We do not use personal information for automated decision-making that produces legal or similarly significant effects on individuals.
5. Third-Party Service Providers
We share personal information only with the following service providers to operate the platform. Each is bound by contractual data-protection obligations and may use information only as directed by Zivly:
- Stripe, Inc. — Payment processing and Stripe Connect infrastructure (stripe.com/privacy)
- Google LLC — Firebase Authentication, Google Maps API, Google Analytics
- DigitalOcean, LLC — Cloud hosting, managed MySQL database, object storage (DO Spaces), Kubernetes cluster. Primary region: Toronto, Canada (TOR1)
- Resend — Transactional email delivery
- Brevo (Sendinblue) — Marketing email campaigns (CASL-compliant)
- Twilio — SMS delivery for booking notifications, appointment reminders, and marketing messages (where the recipient has opted in)
- PostHog — Product analytics, error tracking, session monitoring
- Upstash — Redis-based caching and session state
- GitLab — CI/CD pipeline automation and container registry
We do not sell, rent, or trade your personal information to any third party. We do not allow advertisers to target users within the Zivly platform. We may disclose information to law enforcement or courts when required by valid Canadian legal process, or to protect the safety of individuals.
6. Cookies and Tracking Technologies
We use cookies, browser local storage, session storage, and similar technologies. Categories include strictly necessary (authentication tokens, CSRF protection, Stripe.js), analytics (PostHog, Google Analytics), and functional preferences (location, UI, language). See the Cookie Policy for details, including how to manage your preferences.
7. Data Retention
- Customer accounts: retained for as long as your account is active and for up to 24 months after you close it, unless a longer retention period is required by law (e.g., tax records).
- Active Merchant accounts: retained for the subscription period and for 7 years following termination to meet Canadian tax and audit requirements.
- Client booking data (held on behalf of Merchants): retained for the duration of the Merchant's subscription, then deleted within 90 days of account termination.
- Payment transaction records: retained for 7 years as required by Canada's Income Tax Act.
- System logs and analytics: retained for up to 12 months for security and operational purposes.
When data is no longer required, we securely delete or irreversibly anonymize it.
8. Data Security
We implement the following security measures to protect personal information:
- TLS 1.2 or higher (HTTPS) for all data in transit;
- Encryption at rest within DigitalOcean's managed database and object storage;
- Application-layer encryption for sensitive form inputs before storage;
- Google Firebase Authentication with multi-factor authentication support;
- Role-based access controls restricting data access to authorized personnel only;
- DigitalOcean Toronto data center with ISO 27001 and SOC 2 Type II certifications;
- Ongoing monitoring, error tracking, and alerting via PostHog and centralized logging.
No electronic system is 100% secure. In the event of a confirmed breach creating real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required under PIPEDA's mandatory breach reporting provisions.
9. Cross-Border Data Transfers
Our primary infrastructure is in DigitalOcean's Toronto, Canada region. However, several third-party service providers (including Stripe, Google, Twilio, Brevo, PostHog, and Upstash) may process data outside Canada, including in the United States. We rely on contractual data-processing agreements and each provider's security certifications to ensure equivalent protection. By using the platform, you consent to such transfers.
10. Your Privacy Rights
- Right of access: request access to personal information we hold about you. We respond within 30 days.
- Right to correction: request correction of inaccurate or incomplete information.
- Right to withdraw consent: withdraw consent for certain uses, subject to legal and contractual limitations.
- Right to deletion: request deletion of your personal information (see Section 11).
- Right to challenge compliance: challenge Zivly's compliance with PIPEDA by contacting our Privacy Officer.
To exercise these rights, email [email protected] with your name, account email, and a description of your request. We may verify your identity before processing. Customers seeking access or deletion of data held by a specific Merchant (e.g., your appointment notes at a salon) should contact that Merchant directly.
11. Data Deletion Requests
Email [email protected] with subject “Data Deletion Request.” Include your full name, account email, and a description of the data to be removed. We acknowledge within 5 business days and complete deletion within 30 days, subject to legal retention requirements. We will inform you if any portion cannot be fulfilled and explain why.
Warning for Merchants: Deletion of a Merchant account permanently removes all staff accounts, client data, booking history, and settings. This is irreversible. Export your data before submitting a deletion request — see Your Data: Security, Export, and What Happens If You Cancel for how.
12. Children's Privacy
The Zivly customer app is intended for users 16 years and older (with parental consent for those between 16 and the age of majority in their province). The Zivly merchant platform is intended for businesses and adults 18 years and older. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected information from a child, contact us at [email protected] and we will delete it promptly.
13. Changes to This Policy
We may update this policy periodically. For material changes, we will (a) update the Effective Date; (b) notify users by email at least 14 days before changes take effect; and (c) display a notice on the platform. Continued use after the effective date constitutes acceptance.
14. Contact and Complaints
Privacy Officer: [email protected]
Support: [email protected]
Mailing address: Zivly Technologies Inc., 146 Thirtieth Street, Etobicoke, Ontario, Canada
If you are unsatisfied with our response, you may file a complaint with: Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3 · www.priv.gc.ca · Toll-free: 1-800-282-1376.
© 2026 Zivly Technologies Inc. All rights reserved.