Namyt Privacy Policy

Effective date: October 5, 2026

1. Who processes your data

The data controller is Individual Entrepreneur (FOP) Kateryna Pertsiukh (Ukrainian: Перцюх Катерина Анатоліївна), Ukrainian taxpayer registration number (RNOKPP) 3181812284, registered address: 9 Davydovskoho Lane, Apt. 21, Poltava, 36004, Poltava Oblast, Ukraine ("Namyt", "we", "us"). This Policy applies to the @NamytBot Telegram bot, the Mini App running inside it, and the namyt.com website.

Questions about this Policy or exercising your data rights: hello@namyt.com.

2. Two categories of data subjects

Namyt processes data belonging to two different groups of people, at different volumes and on different legal grounds.

Consultant — a registered user who has connected a Google Calendar. We receive data about them the first time they start the bot, and subsequently as they use the Service.

Guest — a person who books a meeting through a Consultant's link. A Guest does not register and does not complete a separate consent form: by using the Mini App to book a meeting, they thereby agree to the processing described below, which is necessary to carry out that booking. The volume of data about a Guest is far smaller than for a Consultant, and is limited to what Telegram passes along when the Mini App opens, plus the booking event itself.

Answers to a Consultant's questions. The Consultant decides what data to ask for and is responsible for it being necessary for the meeting. For these answers the Consultant is the data controller and Namyt acts as a processor on the Consultant's behalf: it stores the answers with the booking, shows them to the Consultant in the Mini App, in the bot message, and in the description of the event on the Consultant's Google Calendar, and deletes them together with the booking or on the Guest's request. Namyt does not use these answers for its own purposes and does not add them to the activity log. A Consultant may not use Namyt to ask for health data, racial or ethnic origin, religious or political beliefs, or passport and payment data (Terms of Service, Section 11).

3. What data we process and why

Consultant data:

Namyt does not receive or store full card details: they are entered on the plata by mono (or Paddle) page and are handled solely on its side under its own policy. Only the masked card number (last digits), the name and country of the issuing bank, and the payment status are returned to us.

Guest data:

We ourselves do not ask a Guest for an email address, phone number, or any data beyond what Telegram provides. The exception is answers to questions that a Consultant has added to their own booking page: the Consultant controls their content, and before sending, the Guest is shown that the Consultant will see the answers.

Activity log (Consultants and Guests). Namyt keeps a log of actions in the Service in its own database: opening the Mini App and the source of the visit, the steps of a booking, granting or declining permission to message, delivery of reminders and taps on their buttons, signing in to the account area on the website, and changes in subscription status. The log holds only technical identifiers (including the Telegram id), values from a fixed list, numbers, and time. We do not record names, usernames, message texts, meeting titles, IP addresses, or browser data (user-agent) in it. The purpose is running the Service, finding and fixing errors, and improving the Service; the legal basis is Namyt's legitimate interest. The log is not shared with third parties, is not used for advertising, and we do not connect any third-party analytics tools for it.

4. Legal basis for processing

This section describes the grounds at a substantive level, in the logic of GDPR and Ukraine's Law "On Personal Data Protection".

For a Consultant: performance of a contract (delivering the Service they have voluntarily joined); for geo-blocking, security, and checking payment conditions, Namyt's legitimate interest; and for payment and accounting records, compliance with tax and accounting law of Ukraine (retention periods in Section 9).

For website visitors: consent (Google Analytics cookies in the EEA, the United Kingdom, and Switzerland) and Namyt's legitimate interest (in other countries).

For a Guest: performance of the action they themselves initiated (booking a meeting through a link they opened), treated as contract performance at the moment of booking, plus Namyt's and the Consultant's legitimate interest in the meeting actually happening and being reminded about. A Guest does not sign a separate consent checkbox — the act of booking itself completes the minimal operation this processing supports.

This processing is based on the performance of a contract (GDPR Art. 6(1)(b)), so a separate consent checkbox is not required.

5. Google Calendar data: use, limits, and scope justification

This section is addressed in particular to Google's app verification review.

We use data obtained through the Google Calendar API only to:

1. determine free and busy time ranges in the Consultant's connected calendar and build a grid of available slots for the Guest from it;
2. create an event on the Consultant's calendar when a Guest confirms a booking, including generating a Google Meet link if the Consultant has chosen automatic video-meeting creation, and the Guest's answers to the Consultant's questions in the event description;
3. update or delete that event if the booking is cancelled by either party;
4. show the Consultant details of upcoming events Namyt created, on the Service's main screen.

We do not use Google Calendar data to serve advertising, to assess creditworthiness or insurance risk, to transfer it to third parties for marketing purposes, or for any purpose not directly tied to delivering the scheduling feature the Consultant themselves turned on.

Justification for the specific permissions (scopes) requested:

Limited Use. Namyt's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Human access to Google Calendar data. Namyt staff (currently, only the Service's owner) do not manually review the contents of Consultants' calendars, except: (a) with the Consultant's explicit consent when they contact support; (b) where necessary to investigate a violation of these Terms or Policy, or abuse; (c) to comply with a direct legal requirement. In all other cases, data is processed automatically without human review.

6. Telegram data: signing and verification

Data coming from Telegram (initData for the Mini App, message data for the bot) is cryptographically signed by Telegram; Namyt verifies this signature on its server before trusting the content, to rule out forged requests.

7. Permission to message a Guest (requestWriteAccess)

After a booking is successfully created, Namyt may show the Guest, once per session, Telegram's native prompt requesting permission to send them direct messages. The purpose is singular: sending the booking confirmation and reminders 24 hours and 1 hour before the meeting.

If the Guest declines:

• the booking remains valid, and the event on the Consultant's calendar has already been created;
• the Guest sees an "Add to your calendar" button (a Google Calendar template link that works without authorization and without giving Namyt any access to the Guest's own calendar) — that calendar can then remind the Guest of the meeting instead;
• the Guest can return to the same link at any time to see their booking — identified by their Telegram id, no password required;
• if they reopen the Mini App and permission is still missing, they see one manual "Enable reminders" row — not an automatic pop-up; we do not re-trigger Telegram's native prompt on our own;
• the Consultant sees a note on the booking card reading "guest did not enable reminders" and can message the Guest directly if they are already in a conversation.

Messaging permission is used for no purpose other than confirmations and reminders for the booked meeting.

8. Who we share data with

We do not sell personal data. Data is shared only with the service providers needed to run the Service:

We do not share data with advertising networks and do not use Consultant or Guest data for targeted advertising.

9. Retention

• Consultant account: retained while the account is active. After account deletion (Terms of Service, Section 13), data is deleted within 30 days, accounting for time needed to purge backups.
• Google OAuth tokens: deleted immediately upon disconnecting the calendar or deleting the account.
• Guest data: retained as long as an associated booking exists (so the Guest can return via their link and cancel); deleted along with the associated Consultant's account deletion, or on the Guest's direct request.
• Guest answers to a Consultant's questions: retained together with the booking and deleted together with it, and also on the Guest's request at hello@namyt.com.
• Web analytics data (Google Analytics): cookies — up to 2 years; event data in Google Analytics — 14 months.
• Activity log: retained while the Consultant account the events belong to exists, but no longer than 24 months from the date of the event. It is deleted together with the account; a Guest's events are also deleted on the Guest's request at hello@namyt.com.
• Payment and accounting records: at least 3 years (1095 days) under Article 44.3 of the Tax Code of Ukraine; for the MVP (mono only, Ukrainian counterparties), this 3-year period applies. It extends to 5 years (1825 days) under Article 44.3.2 if a non-resident is party to the payment (e.g., Paddle as Merchant of Record, at the later stage).

10. Your rights

Regardless of whether GDPR applies to you, we extend the same rights to all users: obtaining a copy of your data; correcting inaccurate data; deleting your data (for a Consultant, via the account-deletion screen; for a Guest, on request at hello@namyt.com); restricting or objecting to processing; receiving your data in a portable, machine-readable format. To exercise any of these rights, write to hello@namyt.com.

If you are in the EU and believe your rights have been violated, you have the right to lodge a complaint with your country's data protection supervisory authority. For data subjects in Ukraine, that authority is the Ukrainian Parliament Commissioner for Human Rights (Ombudsperson), acting under Ukraine's Law "On Personal Data Protection" — complaints can be filed via the official site ombudsman.gov.ua, at hotline@ombudsman.gov.ua, or via the hotline at 1678.

11. International data transfers

Google, Telegram, Paddle, and Cloudflare process data on servers located outside Ukraine, including in the EU and the US. Google, Cloudflare, and Paddle publish standard data processing agreements (DPAs) incorporating the EU Standard Contractual Clauses (SCCs) for transfers outside the EEA.

12. Cookies and website analytics

On the public pages of namyt.com (home, pricing, help, legal pages) we use Google Analytics 4, a web analytics service from Google, to understand where visitors come from and which pages they open. GA4 sets the cookies _ga (distinguishes visitors, 2-year lifetime) and _ga_<identifier> (keeps session state, 2-year lifetime) and sends Google the cookie identifier, the page address, the time of the visit, and technical data about the device and browser. Google Analytics' advertising features (Google signals, ads personalization, linking to Google Ads) are turned off. Event data in Google Analytics is kept for 14 months.

Consent. If you visit the website from a country in the European Economic Area, the United Kingdom, or Switzerland, Google Analytics is switched on only after you consent in the cookie dialog; until then, no Google Analytics cookies are set. For visitors from other countries, including Ukraine, Google Analytics runs on the basis of Namyt's legitimate interest in understanding how the website is used. You can change or withdraw your choice at any time via the "Cookie settings" link in the website footer.

The account area at account.namyt.com, the Telegram bot, and the Mini App do not use Google Analytics or any other third-party analytics; the activity log (Section 3) is kept on our side. We use Google Search Console only to check how the website is indexed: ownership is verified with a DNS record, and it adds no code to the website.

After you sign in with Telegram, the website sets a technical (session) cookie or a similar record to remember that you are signed in. It is strictly necessary for the account area and subscription payment to work, is not used for tracking, and does not require consent.

A strictly technical cookie or localStorage entry used only to remember the chosen interface language does not require consent, as it is strictly necessary for the site to function.

13. No service to Russia and Belarus

We deliberately do not provide the Service to individuals in the Russian Federation or the Republic of Belarus (Terms of Service, Section 10), and accordingly do not intend to process their personal data on an ongoing basis. If such a case is detected, the account is blocked, and any further processing of the associated data is limited to what is necessary to enforce this restriction and keep a record of the block.

14. Children

The Service is not intended for anyone below the minimum age Telegram itself requires for use of its services (currently 13), and Consultant accounts are not intended for anyone under 18. We do not knowingly collect data from such individuals, and we perform no age verification for a Guest. Where a Consultant's own practice involves minors (e.g., a tutor or therapist), responsibility for obtaining any required parental or guardian consent rests with the Consultant, as the party actually interacting with that client — Namyt is only the technical booking intermediary.

15. Security

Data is transmitted over encrypted channels (HTTPS/TLS). Namyt does not store card payment data; it is handled by the payment providers.

16. Changes to this Policy

We may update this Policy. We will notify you of material changes the same way described in the Terms of Service, Section 16.

17. Zoom Integration & API Data Compliance

Namyt offers an optional integration with Zoom, authorized by the user through Zoom's OAuth flow (user-managed app), using the scopes meeting:write:meeting (create a meeting) and meeting:delete:meeting (delete a meeting). This section describes, specifically and exhaustively, what Namyt accesses through the Zoom API, why, and how that data is handled.

Data Collected. Through the Zoom integration, Namyt receives and stores only: OAuth tokens (access token and refresh token) used to authenticate with the user's Zoom account; and the metadata of each meeting it creates — the Zoom Meeting ID and the Join URL, needed to share the link with participants and to delete the meeting later. Namyt does not access, collect, record, process, or store meeting content, audio, video, transcripts, chat messages, participant rosters, or personal data of meeting attendees.

Purpose of Processing. Data obtained through the Zoom API is used exclusively to automatically generate the conference link when a booking is confirmed, and to automatically delete that meeting room when the corresponding slot is cancelled. There is no secondary use of this data of any kind — no analytics, profiling, advertising, or product improvement unrelated to this function.

Data Security & Storage. All Zoom authorization tokens are stored encrypted at rest in a secured database.

Third-Party Sharing & AI Training. Data obtained through the Zoom API is never shared with or sold to third parties, is never used for advertising, and is never used to train machine learning or artificial intelligence models.

Data Retention & Deletion. Zoom tokens and meeting identifiers are deleted immediately upon any of the following: (a) the user disconnects the Zoom integration in Namyt's settings; (b) Namyt receives a deauthorization webhook event from Zoom; (c) the user deletes their Namyt account; or (d) Namyt receives a data deletion request at hello@namyt.com.

18. Contact

Questions about this Policy or the processing of your data: hello@namyt.com.