Privacy Policy
1. Data Controller
The data controller is Individual Entrepreneur Kistanov Maxim Alexandrovich (TIN 194002418, registered 27.05.2026 by the Minsk City Executive Committee, Republic of Belarus), operating under the trade name Queny ("Queny", "we", "controller"). This Privacy Policy describes how we collect, process, store, and protect the personal data of users of queny.app, in accordance with the Law of the Republic of Belarus No. 99-Z of 07.05.2021 "On Personal Data Protection".
2. Data Received via Google OAuth and Apple Sign In
When you sign in using Google OAuth, we receive only the following data from Google: your display name, email address, and profile photo URL. When you sign in using Apple Sign In, we receive from Apple: your display name (on first sign-in only), email address (real or anonymised via Apple Private Email Relay), and a unique Apple user identifier. We do not request access to any data beyond your basic profile. This data is used solely to create and identify your account within the service.
3. Data Processed for Masters
When using the service as a master, we process: name, email address, and profile photo (from Google OAuth or uploaded manually); phone number, location address, specialty, description, and Telegram and Instagram usernames for contact (provided voluntarily for your public profile and shown on it); portfolio photos (uploaded voluntarily); schedule and service data; Telegram username (if notification integration is voluntarily enabled); payment subscription data (stored by bePaid — we retain only card type and last four digits).
4. Client Data During Booking
When booking an appointment, clients provide: name, phone number, and email address. When booking through Telegram (the «Telegram» choice in the booking form — formerly the «Fill in from Telegram» button — or the Telegram mini app), the client shares their name and phone number from their Telegram account with the Queny bot themselves; no email address is requested in that case, and booking notifications arrive in Telegram. To send them, we store the client’s Telegram account identifier and username (@username); the master the client booked through Telegram sees their @username to get in touch about the booking (the /forget command to the Queny bot erases the stored number and @username). If a client books while signed in to a Queny account, the master sees that account’s photo on the client’s card and the mark «Uses the Queny app» if the client uses the app. Registration on the platform is not required to make a booking. When the master books a client themselves, they enter the client’s name, phone number and, optionally, email address; at the master’s choice, SMS with a link to the booking page go to that number — on booking, a reminder a day before the visit asking to confirm it, on a change, reschedule or cancellation, and after the visit a request for a review (only to Belarusian mobile numbers — +375 25, 29, 33, 44, no advertising). A client who gets booking notifications by email, in Telegram or in the Queny app gets the reminder asking to confirm the visit there too. Client data is processed on behalf of masters solely for appointment management and notification purposes. At a master’s request we move their client base from another app: the master sends an export file to our Telegram support chat (clients’ names, phone numbers, email addresses, notes and past visits), we add this data to their account and delete the file right after the move — both from our devices and from the support chat. Nothing is sent to the clients; the master is responsible for having the right to share this data. Clients may request data clarification or deletion by contacting support@queny.app. If, after booking through Telegram, the client returns to the site with the bot’s «Back to booking» button, a signed «Remember me» key is stored in the browser on their device (the Telegram account identifier, the Telegram first name and an expiry of 180 days from the last booking; the phone number is not stored in the key): later bookings from that device go through without sharing the number again, and notifications still arrive in Telegram. The key can be removed on the device with «Change method» («Change» in the app) in the booking form and revoked on every device with the /forget command to the Queny bot.
5. Purposes and Legal Basis for Processing
Your data is processed for the following purposes: account authentication and management (legal basis: performance of contract); provision of service features — schedule, bookings, profile (performance of contract); sending transactional notifications about bookings via email, push, Telegram and SMS (legitimate interest / consent); verifying a user’s phone number with an SMS code — only +375 numbers (legitimate interest of the operator); sending marketing push notifications about deals and discounts from masters you have booked with — solely on the basis of your explicit consent (legal basis: consent), which you can withdraw at any time in your profile settings; processing subscription payments (performance of contract); measuring advertising performance based on anonymised visit statistics (legitimate interest of the operator); ensuring security and preventing abuse (legitimate interest); analysing service usage for improvement (legitimate interest).
6. Data Sharing with Third Parties
To operate the service, we engage the following data processors: hoster.by (LLC "Hoster.by", Republic of Belarus) — server hosting and file storage; Google LLC (USA) — user authentication via OAuth 2.0; Apple Inc. (USA) — user authentication via Sign in with Apple; Resend Inc. (USA) — transactional email notifications; Telegram Messenger Inc. (British Virgin Islands) — notifications to masters and clients via the Queny bot, receiving the phone number when booking through Telegram, the booking mini app and the support chat; Expo (650 Industries, Inc., USA) — push notification delivery to devices; bePaid (Republic of Belarus) — payment transaction processing; LLC "SMS-assistent" (sms-assistent.by, Republic of Belarus) — sending phone-verification codes and booking SMS to clients (phone number and message text); Meta Platforms Ireland Limited (Ireland) — measuring and targeting our advertising through the Meta Pixel embedded in the site's pages; Yandex LLC (Russian Federation) — website traffic analytics via Yandex.Metrica, including recording of on-page activity (Webvisor). With the exception of Meta, processors may not use your data for their own commercial purposes: Meta also processes the anonymised visit data received through the pixel for its own purposes, in accordance with its own privacy policy. We do not sell your data or share it with third parties for their own marketing. Marketing push notifications about promotions are sent by the master to their own clients through the platform — only to those who have given explicit consent.
7. Data Storage and Security
Personal data is stored on hoster.by servers in the Republic of Belarus. Profile and portfolio photos are stored in hoster.by's S3-compatible object storage in the Republic of Belarus. Security measures include: TLS/HTTPS encryption for all data in transit; OAuth 2.0 secure authentication; least-privilege access controls for the database. Master account data is retained until the account is deleted. Client data is retained within the master's account and deleted along with it.
8. Cross-Border Data Transfers
Some data is transferred outside the Republic of Belarus in connection with the following services: Google LLC (USA) — name and email during Google authentication; Apple Inc. (USA) — email during Sign in with Apple authentication; Resend Inc. (USA) — name and email when sending notifications; Telegram Messenger Inc. (British Virgin Islands) — name, phone number, Telegram account identifier and booking details when sending notifications, booking through Telegram and contacting support; Expo (650 Industries, Inc., USA) — device tokens for push notification delivery; Meta Platforms Ireland Limited (Ireland) — anonymised page-visit data via the Meta Pixel; Yandex LLC (Russian Federation) — anonymised visit and on-page activity data via Yandex.Metrica. All transfers are governed by data processing agreements ensuring an adequate level of data protection.
9. Your Rights as a Data Subject
Under the Law of the Republic of Belarus No. 99-Z of 07.05.2021 "On Personal Data Protection", you have the right to: obtain information about how your personal data is processed; request correction of incomplete, inaccurate, or outdated data; request cessation of processing and deletion of your data; withdraw any consent previously given. To exercise your rights, use the Settings section within the service or submit a request to support@queny.app — requests are handled within 15 business days. Step-by-step account deletion instructions are available on the account deletion page. Complaints may be submitted to the National Personal Data Protection Centre of the Republic of Belarus (cpd.by).
10. Cookies
The service uses three kinds of cookies and similar technologies. Technical (session) cookies are strictly necessary for maintaining your authentication session — signing in is impossible without them; they are deleted automatically upon logout or session expiry. Analytics cookies — Yandex.Metrica — collect anonymised statistics about pages visited and actions taken, including session recording (Webvisor), so that we can see which sections are used and where people run into difficulty. Advertising cookies are set by the Meta Pixel and let us measure how our advertising on Facebook and Instagram performs and show it to a relevant audience. Analytics and advertising cookies can be disabled in your browser settings or with a tracker-blocking extension — the service keeps working, except for signing in, which needs the technical cookies. Meta ad preferences are available in your Facebook or Instagram account.
11. Policy Updates
We may update this Privacy Policy from time to time. The current version is published at queny.app/privacy with the date of the latest revision. Users will be notified of material changes by email at least 7 days before the changes take effect. Continued use of the service after changes take effect constitutes acceptance of the revised Policy.
12. Contact Information
Individual Entrepreneur Kistanov Maxim Alexandrovich. Email: support@queny.app. Company details: queny.app/requisites. For data protection inquiries, you may contact us directly or submit a complaint to the National Personal Data Protection Centre of the Republic of Belarus: cpd.by.