Privacy policy

Effective 9 October 2026 · Last updated 9 October 2026 This policy explains what information Naiiman collects, why, who it is shared with, how long it is kept and what you can do about it. It covers this website (naiiman.app) and its waitlist, the Naiiman booking app at app.naiiman.app, and the messages we send you on WhatsApp, by SMS and by email. 1. Who we are Naiiman (نعيماً) is a booking platform for barbershops, hair salons and beauty studios in Lebanon. It is operated by Gabriel Chammas, Beirut, Lebanon, who is responsible for the information described here. Questions about this policy, or requests about your data: support@naiiman.app. 2. The waitlist on naiiman.app When you join the waitlist we store: - your Lebanese mobile number; - your email address, if you choose to give it; - the area you picked, and whether you signed up to book or as a shop owner; - the language of the page you used; - the description your browser sends of itself (its user agent, cut to 200 characters); - a keyed hash of your network address, never the address itself, so we can spot one source signing up over and over. We use this to tell you when Naiiman opens in your area and, if you own a shop, to contact you about listing it. Nothing else. Each signup attempt is also counted for one hour to limit repeated attempts from the same network. 3. The booking app Account details Your full name and preferred language. Customers sign in with a mobile number, which we confirm by sending a one-time code on WhatsApp or by SMS, and may add an email address. Shop owners, team members and administrators sign in with an email address and a password; we keep only a one-way hash of the password, never the password itself. Sign-in and security records When you sign in we store a session: a hash of the session token, your browser's user agent (cut to 255 characters), a keyed hash of your IP address (not the address itself), and when the session was created, last used and expires. One-time sign-in codes, password-reset links and email-verification links are stored only as hashes, with the phone number or email address they were sent to, a hash of your IP address and an expiry time. We also count failed sign-in attempts to stop password guessing. Bookings For each appointment: the shop, the barber, the services, the date and time, the price, the payment method you chose, any payment reference you type after paying by Whish or OMT, the note you write to the shop, and the booking's status, including cancellations (with your reason, if given), late cancellations and no-shows. When a shop enters a booking for you, it records the name and phone number it was given. Shops can also keep a private note on a booking. Reviews, favourites and photos Your star rating and written comment, the shop's reply and any moderation decision; a review is shown publicly with your name. The shops you save as favourites. Photos are uploaded by shop owners (shop, service and team photos, banners) and are re-encoded on our server, which removes metadata such as camera details and GPS position. Notifications and activity Messages about your bookings and account are kept in your in-app notification list. Bookings you create, and actions taken by shop owners and administrators, are logged with who did what and when, a hash of the IP address and the user agent. Location If you tap “use my current location”, your browser asks your permission, and the coordinates are placed in the search address to sort shops by distance. They are not saved to your account, but they can appear in our web server's request logs. Server logs The app's web server logs each request, including its IP address. 4. WhatsApp, SMS and email We send messages only to a number or address you gave us, and only about things you started: signing in, a booking, or joining the waitlist. - Sign-in codes on WhatsApp, or by SMS, when you sign in with your phone number. - Booking messages: confirmations, reminders, changes and cancellations for your appointments, on WhatsApp or by SMS. - Account emails: email verification, password resets and account notices. - Waitlist: a message on WhatsApp, SMS or email when we open in your area or, for shops, about listing yours. We do not send advertising from other companies, and we do not sell or rent your number or email address. Messages on WhatsApp are delivered through the WhatsApp Business Platform run by Meta Platforms. To deliver them, Meta receives your phone number and the content of the message, and tells us whether it was delivered and read. Meta handles that information under WhatsApp's own privacy policy (https://www.whatsapp.com/legal/privacy-policy). How to stop them. In the app you can choose SMS instead of WhatsApp for booking messages. For waitlist messages, reply asking us to stop or write to support@naiiman.app and we will remove you. You can also block our number in WhatsApp at any time. Sign-in codes are only sent when you ask for one. For every message sent by WhatsApp, SMS or email we record the number or address it went to, whether it was delivered (and, on WhatsApp, read), and any error. 5. Cookies and visits This website sets no cookies. Visits may be counted with Cloudflare Web Analytics, which uses no cookies and does not follow you across other sites. The pages load their fonts from Google Fonts, so Google receives your IP address and browser details when a page loads. The booking app uses only the cookies it needs to work: your login session (naii_session), a security token (naii_csrf, 7 days), your language (naii_locale, 1 year) and your chosen area (naii_area, 1 year). There are no advertising or analytics cookies. 6. Who else sees your data - The shop you book with sees your name, phone number, booking details and note. A shop only sees the contact details of customers who booked with it. - Other people see your name beside any review you write. - Meta Platforms (WhatsApp), Twilio (SMS) and Resend (email) receive your phone number or email address and the message content so they can deliver it. - Cloudflare hosts this website and stores the waitlist, and may sit in front of the app to protect it. - DigitalOcean hosts the booking app and its database. These providers act on our behalf and only for these purposes. Some of them process data outside Lebanon. We do not sell your data. We do not process card payments and hold no card details: you pay the shop directly, in cash or by Whish or OMT. We will disclose information if Lebanese law requires it. 7. How long we keep it - Waitlist signups: until you ask us to remove yours, or until the waitlist is closed after launch, whichever comes first. Signup-attempt counts: one hour. - Login sessions: until they expire (30 days after last use) or you sign out. Expired and signed-out sessions are deleted about every 15 minutes. - One-time sign-in codes: valid for 5 minutes and deleted a day after they expire. Password-reset links (valid 60 minutes) and email-verification links (valid 48 hours) are also deleted a day after they expire. - Rate-limit counters, under hashed keys: one hour at most. - Delivery records: the number or address is stored masked (for example •••456) and cleared entirely after 30 days. - Web server logs of the booking app: 30 days. - Account details, bookings, reviews, favourites, notifications and activity records: until your account is deleted. 8. Your choices In your account you can change your name, email address and language, and choose whether booking messages come on WhatsApp or by SMS. From the same page you can download a copy of your data, sign out on every device and delete your account. Deleting an account erases your name, phone number, email address and password, signs you out everywhere, cancels your upcoming bookings, and removes your favourites and notifications. If you own a shop, the shop goes offline and its upcoming bookings are cancelled. Past bookings and star ratings stay with the shops for their records, shown as “Deleted user”, without your notes or review text. Activity records stay but no longer name you. To see, correct or delete your waitlist signup, or anything else we hold, write to support@naiiman.app from the number's owner or the email on file and we will act on it. 9. Security Connections are encrypted. Passwords, sign-in codes and session tokens are stored only as one-way hashes, IP addresses only as keyed hashes, and access to the data is limited to the people who run Naiiman. No system is perfectly secure, and if a breach affects your data we will tell you. Naiiman is not meant for children under 13, and we do not knowingly collect their information. 10. Changes and contact If we change this policy we will update this page and the date at the top. If a change matters, we will also tell you in the app or by message before it takes effect. Gabriel Chammas, Naiiman, Beirut, Lebanon · support@naiiman.app