Privacy Policy

Version and effective date: September 13, 2026

Who we are

Nottifai LLC operates Separalo, a non-clinical scheduling platform serving businesses and customers in the United States and Colombia. We operate from and may access information in Texas and Colombia. Contact us at [email protected] or 1079 W Round Grove Rd #300 #558, Lewisville, TX 75067, United States.

This notice covers our website, accounts, public booking pages and support. Separalo determines how account, subscription, support, security and platform-usage data is processed. Appointment businesses determine the purposes of their customer and staff processing; we process that information on their behalf. Their own privacy notices also apply. These roles do not eliminate either party's legal obligations.

Information and purposes

We process the information needed to provide, administer and secure the service:

• Account and business information, including contact details, authentication records, business profile, staff and scheduling configuration, and subscription records.
• Booking information, including the adult booking contact's name and email, selected service and staff, appointment time, status and related communications. Businesses may maintain limited operational records concerning appointments.
• Public business content, such as listings, branding, locations and contact links. Uploaded branding is publicly displayed.
• Support requests and inquiries, their contact details and the information needed to resolve them.
• Technical and security information, including browser/device details, network information, activity records, error diagnostics, and essential browser storage. Our self-hosted, cookieless analytics measures visits to public marketing and legal pages and predefined actions such as starting or completing registration, creating a business or service, progressing through booking, sharing a booking link and opening subscription checkout. Events include language, owner/customer audience and limited categories such as button placement or outcome. We remove URL queries, fragments, referrers and page titles and replace private event paths and business hostnames with generic paths and the platform hostname. We do not include names, email addresses, telephone numbers, account or booking identifiers, service names or appointment details in Umami event fields.
• Evidence of accepted terms and data authorization, including version, language and timestamp, and records of privacy requests.

We use this information to operate accounts and bookings, deliver requested service communications, administer subscriptions, answer requests, understand and improve service performance, prevent misuse, and comply with legal obligations. Stripe handles subscription payment details; Separalo does not store full card numbers. Appointment payments are made directly to the business outside Separalo. WhatsApp is not part of the current service.

We do not sell personal information or use customer booking data for advertising or AI training. Optional advertising measurement for business accounts is described below. We do not request medical information, identity documents or children's details through booking. Adults may manage appointments for dependents using the adult's contact information. Do not submit sensitive information the service does not support.

For internal product reporting, we also derive business activation milestones, time to first service or verified booking, return activity and subscription conversion/cancellation metrics from operational records. Business/account-linked milestones and subscription snapshots remain in our application backend with restricted administrator access; they are not sent to Umami. Business metric profiles are removed with business deletion, and account-linked billing analytics records are removed with account deletion. Aggregate cohort counters may remain. Required billing records held separately follow the retention rules below.

Authorization and other legal grounds

Where required, including applicable processing in Colombia, we request prior authorization for the stated purposes and retain evidence of it. Accepting a notice is not a waiver of privacy rights. Depending on the processing and applicable law, other grounds or exceptions may apply, including providing a requested service, legal obligations and permitted security interests. We do not treat a blanket statement of contractual necessity as a substitute for authorization where it is required.

Businesses must provide the notices and obtain the authority required for data they supply, including staff records. Information essential to a booking or account may be necessary to fulfill that request; unrelated promotional consent is not a condition of using the service.

Sharing and international processing

We share booking information with the relevant business and authorized staff, and use service providers to operate the platform. Our provider list describes their functions. Current infrastructure includes Convex, Railway, Resend, Stripe and Sentry; Umami analytics is self-hosted. Providers process information under applicable contracts and may have independent legal obligations for particular services.

When a business owner searches for an address, we send the typed address, selected search country and interface language to Geoapify through our backend to suggest locations. We do not forward the owner's identity or browser IP address. All address fields remain editable.

Information may be processed outside your country, including in the United States, and accessed by authorized personnel in Texas and Colombia. We use applicable contractual and other safeguards and distinguish processor transmissions from transfers to independent recipients. Business customers can review our Data Processing Agreement. Contact us for information about relevant safeguards.

We may also disclose information where lawfully necessary to comply with law, protect rights or security, or carry out a business transfer subject to applicable protections. Access is restricted according to responsibilities. Public listings and external links are visible to others; third-party websites have their own practices.

Retention and deletion

We limit retention to the relevant purpose. Our operating schedule is:

Verified deletion requests may require earlier action. Necessary billing/tax records, limited authorization evidence, disputes and legal holds may need separate retention. We restrict those records to the remaining purpose. An account associated with another active business is not automatically removed when one business closes. Backups expire through provider backup cycles and are not used to restore erased information to ordinary use; contact us for the applicable cycle. We do not promise instantaneous erasure from every backup or independent provider.

Your choices and requests

Contact [email protected] to request access, correction, deletion, applicable portability, proof of authorization, information about use, or withdrawal of authorization where available. We verify identity and authority proportionately and may need additional information. Do not send passwords or identity documents unless a secure, justified verification method has been arranged.

For booking data, the business is normally responsible for the decision; we will help route the request and assist it. You may contact Separalo directly about our own processing. We will explain applicable exceptions and available appeal or complaint channels and will not unlawfully discriminate for exercising rights.

In Colombia, consultations are generally answered within 10 business days, and complete claims within 15 business days, subject to the statutory extension and procedural rules. You may request proof of authorization, revoke it or seek suppression where available, and complain to the Superintendencia de Industria y Comercio after the applicable preliminary procedure. In the US, additional rights and response/appeal procedures depend on applicable state law and our role. Optional advertising measurement shares the identifiers described below with Meta only with your acceptance; you can decline or withdraw your choice. Our ordinary processing does not change in response to browser Do Not Track signals; we honor applicable opt-out requirements and signals where relevant.

Security, incidents and children

We use access controls, authentication, restricted administration and operational safeguards. No service is completely secure. Treat booking verification and management links as confidential. Report suspected misuse promptly. We assess incidents and provide notifications to businesses, individuals or authorities as required by the applicable law and agreements; there is no single notification deadline for every situation.

The platform is intended for adult users. If we learn that unsupported children's information has been provided, we will assess and take appropriate steps, including deletion or restriction where required. An adult booking for a dependent should provide the adult's own contact details.

Optional advertising measurement

With your acceptance of advertising, we use the Meta pixel on the landing page to measure visits and successful contact-form submissions. We also use Conversions API to measure email verification for a new business account, trial activation and the first membership payment. For ad attribution, optimization and audiences, we share advertising identifiers, browser information, and an account identifier and registration email transformed using SHA-256 (hashing); hashing does not make these data anonymous. Payment events include amount and currency, never card details. Contact-form events do not include form fields. We do not send customer booking information or mount the pixel in the dashboard or booking pages. You can reject this measurement or withdraw your choice through Cookie preferences. See our Cookie Notice and Meta’s Privacy Policy.

Cookies and changes

See our Cookie Notice for browser storage and analytics. We will communicate material privacy changes as required and request additional authorization where necessary. New wording does not retroactively authorize unrelated uses of previously collected data.