Privacy policy

1. Who is responsible for your data

Each business using rezervaya owns the relationship with its clients and its booking data; rezervaya processes that data on the business's behalf to provide the service.

For business accounts (owners and administrators), rezervaya (operated by 3-102-947237 Sociedad de Responsabilidad Limitada) is the data controller. You can reach us at hola@rezervaya.com.

2. What data we process

If you book an appointment: your name, your WhatsApp number, the service, the date and time, and any notes you choose to add. You may also share your email address; it is optional. If you leave a review, we process your rating and your comment.

If you run a business: your email address, your business details (name, address, hours, services and prices) and your plan's billing data. Payments are processed by ONVO; rezervaya does not store card numbers.

A booking can also reach a business from a marketplace it sells through. In that case we receive from the marketplace your name, the size of your party, the trip, its date and time, the price, and any message you wrote with the booking. Your phone number and email address stay with the marketplace and do not reach us.

3. What we use the data for

To create and manage bookings, send confirmations and reminders (by email and, where enabled, WhatsApp), let you view, cancel or move your appointments, bill business plans, and keep the platform secure.

If you write to rezervaya's WhatsApp number, we pass your message on to the business you book with, so they can answer you, and we keep it in rezervaya's message log like every other WhatsApp message. If more than one business on rezervaya has your number, we do not pass the message on, and our reply tells you so.

You can stop WhatsApp messages from rezervaya at any time by replying STOP (or BAJA), and turn them back on by replying START (or ALTA).

If you share your email when booking, it is also used, with your consent, to follow up on your visit, invite you to leave a review, and send you an occasional update or offer from the business; you can opt out at any time. Reviews the business approves may be displayed publicly on its page, showing your first name only.

We do not sell personal data or use it for third-party advertising.

For business accounts, we also record which admin screens and tools are used, without any client data, to improve the product. When a business asks Rez about its bookings or clients, rezervaya may read that conversation, including client names, to improve Rez; no AI model is trained on it.

4. Combined visits

If you book a combined visit across two partnered businesses, two independent bookings are created (one at each business) and each business receives its own record with your name and number. Partnered businesses cannot see each other's calendars, prices or client lists; they only share time-slot availability while the partnership is active.

5. Service providers

We use providers that process data on our behalf: Supabase (database and authentication), Vercel (hosting and cookieless usage measurement), Resend (transactional email, and receiving booking notifications a business has forwarded to us), ONVO (payments), Meta/WhatsApp (messaging, where the business has it enabled), Sentry (error monitoring); for the Rez assistant, the DeepSeek V4.1 Flash AI model, an open model run for us in the United States by Together AI or, if it is unavailable, by Baseten, both through Vercel's AI Gateway (your questions, and for a business the bookings, clients and payments Rez reads to answer or to prepare a change, are processed to generate the answer; these hosts do not keep the data once the answer is generated and do not use it to train models; DeepSeek, the company that published the model, receives nothing); Anthropic, through the same gateway (translating a business's own description and tagline into other languages); and Microsoft, through the same gateway (a voice note sent to Rez is converted to text; neither Microsoft nor we keep the audio, and it is not used to train models). Rez keeps your conversations with it for as long as your business has an account with rezervaya, so you can go back to them. You can delete any conversation in the app at any time; a record of the changes Rez made for you is kept for at least 12 months. Conversations with Rez on WhatsApp are kept the same way but are not in the app's list; to have one deleted, write to hola@rezervaya.com. rezervaya reviews Rez conversations and their outcomes to improve how Rez answers and what it can do. No AI model is trained on them. Questions typed into the public help center are kept, without the conversation or who asked, to improve the help. Each provider processes data under its own contractual data-protection commitments.

6. Retention

Bookings and client records are kept for as long as the business keeps its account, because they form its appointment history.

If a business leaves rezervaya, whether it deletes its account or its plan ends and is not renewed, its bookings, clients and settings are kept for 12 months so it can come back, and are then permanently deleted. We keep our own billing and invoice records for the period Costa Rican tax law requires. A client who also books with another business on rezervaya keeps their record at that business. If you want your data removed sooner, write to hola@rezervaya.com and we will process the request.

7. Your rights

Under Costa Rica's Law 8968 (Protection of the Person in the Processing of their Personal Data), you may request access to, correction of, or deletion of your data.

If you are a business's client, the most direct route is the business itself (its page lists its contact details). You can also write to hola@rezervaya.com and we will route the request.

8. Cookies

We use cookies only to run the service and to measure it in a basic way.

The first kind is essential: keeping administrators signed in, and remembering preferences such as language.

The second appears when you reach a business's page through a link it shared or advertised, for example its Instagram bio, a WhatsApp message, its Google listing, a printed QR code, its own website or an online ad. In that case first-party cookies remember, for 30 days, what brought you: a short code such as “ig”, the campaign name and ad click identifier the link carried, the name of the website that linked to the page (never the page you were reading there), and the first page you opened. They never build a profile of you, and they have a single purpose: letting that business see which of its own channels and campaigns produce bookings. When you book, that information is kept with your booking, for that business alone. They are stored separately for each business, so one business never learns about your visits to another.

rezervaya does not use advertising cookies and does not share cookie data with third parties.

9. Changes to this policy

If we change this policy we will update this page and the “last updated” date. Significant changes will be communicated to businesses by email.