Privacy policy

1.Data controller

Atlas Lejon AB, the Swedish company behind Bokelle, decides the purposes and means of the processing described here. For any question about your data, or to exercise your rights: info@atlaslejon.se.

2.The data we process

We collect only what it takes to book an appointment and give it back to you afterwards:

• •Identity and contact: name, phone number, email address, preferred language.
• •Account: identifier, creation date, the secret word used by the voice assistant (stored in unreadable form).
• •Bookings: business, service, date and time, status, and any rating you leave.
• •Use of the service: favourites, businesses viewed recently, chosen language and city.
• •Location: if you allow it, your device's approximate position, to rank results by proximity. The permission can be withdrawn from your browser.
• •Reviews: your rating, your comment and the first name shown beside it.
• •Technical: IP address, device type and security logs, generated simply by loading a page.

3.Why, and on what basis

Every processing operation answers to a specific purpose and a legal basis:

• •Carrying out your booking and letting you find, change or cancel it — performance of the contract.
• •Sending confirmations, reminders and cancellation notices — performance of the contract.
• •Running the voice assistant and giving it the context it needs (your favourites, your past bookings) — performance of the contract and legitimate interest in a service that works.
• •Securing the service and preventing fraud and fictitious bookings — legitimate interest.
• •Publishing verified reviews — legitimate interest in a trustworthy marketplace.
• •Improving the product from aggregated usage statistics — legitimate interest.
• •Meeting our accounting and legal obligations — legal obligation.
• •Accessing your location — consent, withdrawable at any time.

4.The voice assistant

When you call the assistant, your voice is streamed to our voice technology provider, which transcribes it and produces the spoken reply. That processing is what allows the assistant to understand you.

• •The microphone activates only with your permission and stops the moment you hang up.
• •So that it can suggest relevant places, the app passes the assistant your account context: first name, city, favourites and past bookings. Never your secret word in the clear, never payment data.
• •Your contact details reach a business only when a booking is actually saved.
• •Bokelle keeps no audio recording of your calls.

5.What the business receives

The business you book receives what it needs to welcome you: your name, your phone number, your email where given, the service chosen, the slot and any note you added. It does not receive your history at other businesses, your favourites or your location. From that transfer onwards, the business is responsible for the data it holds about you.

6.The providers who help us

We rely on a small number of processors, each under contract and limited to the following:

• •Supabase — database hosting, authentication and photo storage.
• •Vercel — hosting and delivery of the site.
• •ElevenLabs — voice processing for the assistant.
• •Mapbox — map tiles and turning an address into coordinates.
• •Stripe — business subscriptions. No consumer payment passes through Bokelle, so no customer banking data is processed.
• •Our email delivery provider — appointment confirmations and reminders.

7.Transfers outside the European Union

Bokelle serves the Moroccan market from a European company, so data necessarily moves between Morocco, the European Economic Area and, for some providers, the United States. Those transfers rely on the European Commission's standard contractual clauses or on an adequacy decision, together with the usual technical measures — encryption in transit and at rest.

8.How long we keep it

We keep nothing “just in case”. The periods are these:

• •Account and profile: for as long as the account exists, then erased on deletion.
• •Bookings: three years after the appointment, so a complaint can be followed up and a history exists.
• •Published reviews: for as long as they are online; on account deletion they are anonymised rather than removed, so the business's rating is not distorted.
• •Technical and security logs: twelve months.
• •Accounting records for business subscriptions: the period required by applicable law.

9.Your rights

Over your personal data you hold the following rights, exercisable from your profile or by email to info@atlaslejon.se. We answer within one month.

• •Access: obtain a copy of the data we hold about you.
• •Rectification: correct data that is inaccurate or incomplete.
• •Erasure: delete your account and the data attached to it, subject to what the law requires us to keep.
• •Restriction: freeze a processing operation while a challenge is resolved.
• •Objection: object to processing based on our legitimate interest.
• •Portability: receive your data in a machine-readable format.
• •Withdrawal of consent: for location in particular, without affecting what was processed beforehand.

10.Complaining to an authority

If our answer does not satisfy you, you can lodge a complaint with a supervisory authority: in Morocco, the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP); in the European Economic Area, the authority of your country of residence or, for Sweden, the Integritetsskyddsmyndigheten (IMY). We would obviously rather you wrote to us first.

11.Cookies and local storage

Bokelle uses no advertising cookie and no third-party tracker for profiling. What we place on your device is strictly functional:

• •A session cookie, to keep you signed in.
• •A cookie remembering which business is shown in the professional area, for owners who run several.
• •Local storage holding a sign-up in progress, so you do not have to start it again.

12.Security

Traffic is encrypted in transit, access to the database is partitioned by row-level rules, and the secret word is never stored in the clear. No system is infallible: in the event of a breach likely to create a high risk to your rights, we will tell you and the competent authority within the time limits the regulation sets.

13.Children

Bokelle is not aimed at children and we do not knowingly collect their data. An appointment for a minor is booked by a parent or guardian, under their account and their responsibility. If you find that a child has given us data, write to us and we will delete it.

14.Changes to this policy

This policy changes as the service does. Any substantial change — a new purpose, a new processor — is flagged on the site and, if you have an account, by email. The date at the top of the page tells you which version is in force.