Privacy Policy

Last updated: 3 October 2026

Revisit helps beauty and wellness businesses manage their bookings and stay in touch with their customers. This page explains what personal data we handle, why, and what your rights are. We keep it short and plain.

Who we are

Revisit is run by Lucas Kamdoum, [postal address in Malta]. For any question about your data, write to [contact email].

Our role depends on who you are:

• You booked with a business (a barber, a nail salon…): that business decides how your data is used. It is the data controller. Revisit is its data processor: we store and handle your data only on its behalf and on its instructions.
• You have a Revisit account for your business: Revisit is the data controller for your account data.

If you book an appointment

What the business receives

• Your first name, last name and mobile number.
• Whether you live in Malta.
• Whether you agreed to get “come back” messages, and when you agreed.
• Your bookings: service, date, time, and whether it was done, cancelled or missed.
• The messages prepared for you, and when they were sent.

The business can also add your booking itself, for example when you book by phone. In that case, it enters these details for you.

Why, and on what legal basis

• Booking confirmation and a reminder the day before: needed to manage the appointment you asked for (performance of a contract).
• One request to leave a Google review, about an hour after your visit, once per business and never after a missed appointment: the business's legitimate interest. It is never linked to a reward. If you don't want it, just tell the business.
• “Time to come back” messages: only if you ticked the box (it is never ticked for you), only if you live in Malta, and only if you have no upcoming booking. At most two messages per visit, 7 days apart. Every one says “Reply STOP to unsubscribe”: reply STOP and you will never get one again. This is based on your consent, which you can withdraw at any time.
• Measuring results: to show the business whether “come back” messages really work, a random 1 in 5 of the customers who would get one are left out and receive nothing. This is the business's legitimate interest and has no other effect on you.

How messages reach you

Revisit prepares each message, then the business sends it from its own WhatsApp. Revisit itself never contacts you. Once sent, the message is handled by WhatsApp under its own privacy policy, like any message from that business.

Who sees your data

Only the business you booked with. Other businesses using Revisit never see you, and the business never sees anyone else's customers. We do not sell your data, we do not use it for advertising, and we do not contact you ourselves.

How long it is kept

As long as the business keeps you as a customer. The business can delete you and all your data at any time, in one click. If the business closes its Revisit account, its customers' data is deleted too.

Your rights

You can ask to see your data, correct it, delete it, limit or object to its use, or get a copy. The quickest way is to ask the business directly: it can delete you from Revisit straight away. You can also write to us at [contact email] and we will pass your request on to the business and help it answer.

If you have a Revisit account

• What we keep: your email address and password (never stored in plain text), and your business details: name, trade, town, phone number, opening hours, Google review link, photos, services and prices.
• Why: to provide Revisit to you (performance of a contract), and to send you emails about your account, such as confirming your address or resetting your password.
• What is public: your booking page shows your business name, town, phone number, opening hours, photos, services and prices to anyone with the link.
• How long: as long as your account is open. Ask us at [contact email] to close it, and we delete your account and all your customers' data within 30 days.

Where the data is stored

We rely on a small number of providers, each bound by a data processing agreement:

• Supabase: database, accounts and photo storage. Data is stored in the European Union.
• Vercel: hosts the website. Vercel is a US company; any transfer outside the EU is covered by the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

Cookies

No advertising, no analytics, no tracking. Booking pages use no cookies. Businesses that log in get only the cookies needed to keep them signed in, and one that remembers whether their side menu is open or closed.

Security

All connections are encrypted. Each business can only reach its own data: this is enforced by the database itself, not just by the app.

Children

Revisit is not meant for children under 16. For a child's appointment, a parent books with their own name and number.

Complaints

If you think your data is mishandled, please tell us first so we can fix it. You also have the right to complain to the data protection authority of the EU country where you live or work, for example:

• Malta: IDPC, idpc.org.mt
• France: CNIL, cnil.fr

Other countries: list of all EU data protection authorities.

Changes

If we change this policy, we update the date at the top. Businesses with an account are told by email about any important change.