English Română

Privacy Policy

Last updated: 13 November 2026

This Privacy Policy explains how BHDIT SRL, which runs Lidisto ("we", "us"), uses personal data under the EU General Data Protection Regulation (GDPR). It applies to:

people who book through the booking page of a business that takes appointments, through a booking widget on that business's website, or through the Lidisto app;
people who write to the Lidisto WhatsApp assistant;
people who sign up, or work, at a business that uses Lidisto;
visitors to https://lidisto.com.

When you book with a business, that business is responsible for your client record; read its own privacy notice too.

This policy is also available in Romanian: Politica de Confidențialitate.

1. Data Controller

The data controller is the one who decides why and how personal data is used. Ours is:

Company: BHDIT SRL
Registration number: J2026027909001
Tax ID (CUI): 54575180
Registered office: Aleea Barajul Uzului 1, Sector 3, București, Romania
Email: [email protected]
Website: https://lidisto.com

BHDIT SRL runs Lidisto, including its WhatsApp assistant. We have not appointed a data protection officer; for anything about your data, write to [email protected].

What BHDIT SRL is responsible for: your Lidisto account (sign-in details and the notification choices that apply across businesses); our website and early-access list; the accounts of business owners and staff; security and abuse protection; and the Lidisto front desk (described below).

What the business is responsible for. Each business using Lidisto to manage bookings (a "Business Customer") is the data controller for its own client records: bookings, client file, answers to its questions, files, clinical record and its own assistant chats. Lidisto is then a data processor: it handles those records only on the Business Customer's behalf, under our agreement with that business.

The WhatsApp assistant. The roles depend on how you reach it:

A business's own assistant. When you chat with the assistant of one Business Customer (for example after scanning its QR code, opening its WhatsApp link, or replying to a reminder it sent you), that Business Customer decides why your booking data is used. Lidisto provides the assistant on its behalf, as a data processor.
The Lidisto front desk. Where Lidisto offers a general assistant on its WhatsApp number (the "front desk") that answers when you write without choosing a business and helps you reach the right one, BHDIT SRL is responsible for those conversations.

You can contact BHDIT SRL or the Business Customer about your data. We pass your request on to whichever of us is responsible and help to answer it.

2. What We Collect

Below, the data is grouped by what you are doing. Section 3 explains why we use it and on what legal basis.

a) When you book with a business

We handle this data for the business (see Section 1).

Your name, email address and phone number. Your date of birth, only if the business asks for it.
The service, date, time and place; your notes and your answers to the business's questions; files you upload; your booking history with that business.
If you pay a deposit: the amount and whether it was paid. Your card details go to the payment provider, not to us.
The address of the page you came from, and any campaign codes in it, are saved with the booking.
Some of it may come from the business itself, for example when its staff create or import your client record.

b) Health and other sensitive information

Some businesses, such as clinics, keep health information about you in Lidisto: answers to their questions, files you upload, and the clinical record of your visits. The business decides what it collects and is responsible for it; we store it for the business and protect the clinical notes with encryption.

Please do not send health details or other sensitive information in a WhatsApp chat with the assistant; if a business needs such information, use its booking page.

c) Your Lidisto account and sign-in

The email address or phone number you sign in with.
One-time sign-in codes, which are valid for a few minutes.
Session data, which keeps you signed in.
Your notification choices for each business.
A remembered, encrypted contact, so that the booking page can offer to continue as you on your next visit (see Section 10).
When you sign in with a phone number or email, we link your account to the client records that businesses on Lidisto hold under that number or email, so you can see your bookings with each of them. Each business sees only its own record.
Business owners and staff sign in with an email address and a password.

d) WhatsApp

This applies only if you write to the assistant or choose WhatsApp messages.

Your WhatsApp phone number.
The messages you send and the assistant's replies, with their timestamps.
The booking the assistant proposes (service, date, time, the name and email you give, answers to the business's booking questions) and whether you confirmed it.
Which business the conversation is with, and how you reached it (QR code or link, a reply to a reminder, or the front desk).
Usage counts (number of conversations and replies), used for limits.
Your WhatsApp number and the record of your choice to receive WhatsApp messages: when, which business, and the wording shown to you. If you reply STOP, a record of that, so we can honour it.

The assistant reads text only. If you send a photo, voice message or file, the assistant does not download or keep it; it only records that something was sent, together with any caption you wrote. If you share your location or type a place in the chat, it is part of your message and is kept with the conversation (Section 9).

e) If you sign up or work at a business

Your name, email address, phone number, role and permissions. Your password is stored only in hashed form, which means scrambled so that it cannot be read back.
The business's details and company data, which we look up from the company registry using its tax ID.
What you enter during signup, kept as a draft until you finish.
If you ask us to read your business's website, we read its public pages and summarise them automatically to pre-fill your account.
If a business owner invites you, the owner gives us your name and email address, and we send you an email with an invitation link.
If you accept the Terms for a business: the time, the version you accepted, your IP address and browser, your name and email address, and the business's name and tax ID, kept as proof of the acceptance.

f) When you visit our website

Technical data: your IP address, browser and device, the pages requested, and error reports.
A bot check on forms.
If you join our early-access list: your email address, with your IP address and browser at sign-up.

g) When you write to us

The message you send and our reply.

We need a legal reason, called a legal basis, for each use of your data. These are ours:

Purpose	Legal basis
Your account, sign-in and notification choices; answering you in the assistant and making the booking you confirm (including through the front desk)	Contract, including steps you ask for before one (Art. 6(1)(b))
Running a business's bookings, reminders and client records	On behalf of the business, which chooses its own legal basis; see its notice
WhatsApp booking messages	On behalf of the business, based on your consent (Art. 6(1)(a)), which you can withdraw at any time
Early-access list	Your consent (Art. 6(1)(a)), which you can withdraw at any time
Business signup and accounts for owners and staff	Contract (Art. 6(1)(b))
Keeping proof that a business accepted the Terms (time, version, IP address and browser of the person who accepted)	Contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)): being able to show, if there is a dispute, which version of the Terms a business accepted, when and by whom
Security, bot checks, abuse limits, error logs, making sure a reply reaches the business that wrote to you, and respecting a STOP	Legitimate interest (Art. 6(1)(f)): keeping the service secure and available, preventing fraud and abuse (including limits on how many messages one person can send), fixing faults, making sure a reply reaches the business that sent you a message, and respecting your request to stop WhatsApp messages from every business (a STOP) and being able to show that we did
Answering messages you send us, and inviting the colleagues a business owner names	Legitimate interest (Art. 6(1)(f)): answering you, and adding to a business account the people its owner invites
Keeping records the law requires (accounting, answering authorities and GDPR requests)	Legal obligation (Art. 6(1)(c))

Where a business keeps health information, it relies on its own legal basis, such as providing care under professional secrecy or your explicit consent. Its notice tells you which.

Do you have to give us your data? To make a booking we need your name and a way to reach you; without them we cannot make it. Without a phone number or email address we cannot send you a sign-in code. To create a business account we need your name, email address, a password and the business's details; without them we cannot open the account. Everything else is optional, and using the WhatsApp assistant is always optional.

4. How We Use Your Data

Create and confirm your bookings.
Send notifications about your booking (confirmation, reminders, schedule changes) by email and SMS. Confirmations, reminders and notices that a booking was not accepted also go by WhatsApp if you chose it for that booking.
Let you sign in to your Lidisto account or the app with a one-time code.
Provide intake forms and store the answers for the Business Customer who scheduled the booking.
Set up and run business accounts, including the company lookup and the website pre-fill.
Send emails about Lidisto to people who joined the early-access list. You can stop them at any time by replying or by writing to [email protected].
Respond to support requests and resolve issues.
Comply with legal obligations.
Detect and prevent abuse.
Answer your questions and make the bookings you confirm through the WhatsApp assistant (Section 6).

Automated decisions. We do not make decisions about you by automated means that have legal or similarly significant effects. The assistant is an AI, but it only prepares a booking; you make it by confirming.

5. SMS and WhatsApp Notifications

When you provide your phone number in the booking form, we send you SMS about your booking and your sign-in, through an SMS provider that works on our behalf. These messages are:

sign-in codes;
booking confirmations, reminders and changes.

We do not send advertising SMS. You can stop SMS at any time by writing to us at [email protected]. Opting out does not affect bookings already confirmed; the Business Customer may contact you by other means.

WhatsApp. Booking confirmations, reminders and notices that a booking request was not accepted are sent on WhatsApp, through Meta's WhatsApp service, only if you chose WhatsApp when you booked. The booking form shows a short sentence saying that by choosing WhatsApp you agree to receive these messages, and we record your choice (when, which business, and the wording shown). We do not send marketing on WhatsApp. You can stop these messages at any time: switch WhatsApp off in your account, tell the business or us at [email protected], reply STOP to a WhatsApp message, or block the number in WhatsApp. If the business uses the assistant, we note your number with that business so that a reply reaches it. The note is used for 7 days (see Sections 6 and 9).

Replying STOP stops WhatsApp booking messages from every business on Lidisto to your number, until you write START.

6. The WhatsApp Assistant

What it is. Some Business Customers let you book through a chat assistant on WhatsApp. It is an AI system, not a person: every conversation starts with a message saying so. It is there for questions about that business and its bookings only, and it politely refuses other topics. The assistant never writes first: it only answers when you write to it, or when you reply to a booking message. Booking reminders come from the business through Lidisto, not from the assistant. If you want to talk to a person, the assistant gives you the business's phone number. The front desk, where it is used, is also an AI system.

What it can do:

tell you about the business's services, prices, opening hours and address, as the business has chosen to show them on its booking page;
look up free times;
prepare a booking for you and show you a summary;
show you your own upcoming bookings with that business;
send you a link to the business's booking page.

What it cannot do:

book anything without you. It can only prepare a booking. The booking is made only after you tap the Confirm button (Confirmă in Romanian chats) under the summary, and the summary is valid for 15 minutes. If the business approves bookings by hand, your booking stays pending until it does;
take payments. Nothing is paid in the chat. If a service needs a deposit, the assistant sends you a link to the booking page;
cancel or change an existing booking, or pass a message to the business. For that, contact the business directly.

Who can see the conversation. The business you are talking to can read its conversations with you: its owner sees them, including your WhatsApp number and messages, on the owner page of the Lidisto web app. Staff of the business without owner rights cannot. Authorised BHDIT SRL staff may open a conversation only to give support or fix a problem.

Where your messages go.

WhatsApp (Meta). Your messages travel through WhatsApp, a service of Meta, under WhatsApp's own terms and privacy policy. Meta handles them before they reach us and after we send a reply.
The assistant runs on servers of a hosting provider that works for us. Conversations are stored there.
The AI model. The replies are written by an AI language-model provider acting on our behalf, under a data processing agreement. It may process data outside the European Economic Area, with the safeguards in Section 8. Your conversations are not used to train AI models.
Lidisto receives what is needed to answer and to book: your WhatsApp number, the name and email you give, the answers to the booking questions, and the time you chose. A booking made this way is a normal booking with the business and is marked as made through the assistant.

Location. A place you type or a location you share is part of the conversation and is kept with it.

How we route your messages. We use one WhatsApp number for all businesses. To send your message to the right business we use the business's link or code, a booking message a business has just sent you, or the conversation already running. One business's assistant never sees your bookings or details held by another business.

How long we keep it. See Section 9. In short: a conversation is deleted 90 days after its last message.

You do not have to use it. You can always book through the business's booking page or by contacting the business directly. You can stop at any time by no longer writing to the number.

7. Recipients

We share your data only with these recipients, listed by type:

The Business Customer whose booking page, app booking or assistant you used.
Hosting and server management providers, which run and manage our servers and run the assistant.
A network and security provider, which delivers our website, protects it against attacks and bots (including a bot check on forms), and encrypts the connection, and so handles web traffic data such as your IP address and the pages requested.
An email provider, to deliver emails, and an SMS provider, to deliver SMS.
Meta (WhatsApp), to deliver WhatsApp booking messages and the WhatsApp assistant's messages.
An AI language-model provider, which runs the WhatsApp assistant (see Section 6) and reads the public pages of a business's website when the business asks us to pre-fill its account.
A payment provider, which processes deposits, when a business asks for a deposit. Payment details are entered on the payment provider's own form and go to it; Lidisto does not see your card number.
An error-monitoring provider, which receives technical reports when something goes wrong.
A calendar service, only if a member of the business's staff connects their own calendar: your name, the service, the booking time and the booking reference are copied to that calendar.
An address search service, which receives the address you type while you set up a business on Lidisto.
A company registry lookup service, which receives the business's tax ID during signup.
Authorities, where required by law.

Providers that process data on our behalf are bound by a data processing agreement consistent with GDPR. You can ask us for the current list of providers at [email protected].

8. International Transfers

Some of our service providers may process data outside the European Economic Area. In that case the transfer is covered by an adequacy decision of the European Commission (for the United States, the EU-US Data Privacy Framework) or by Standard Contractual Clauses. You can ask us for details at [email protected].

9. Retention

Booking and client records kept for a business: kept as long as the business keeps them, and for up to 5 years after your relationship with it ends, or longer if healthcare or accounting law requires. The business can delete them earlier.
Deposit and refund records: kept as financial records of the business, for as long as the law requires.
Sign-in codes: expire after a few minutes.
Technical logs: retained for up to 12 months.
Records of your WhatsApp choice: kept until you withdraw your choice, plus 3 years. A STOP is kept until you write START, so that it is honoured.
Business signup drafts: deleted 30 days after your last change, and at most 90 days after you started.
Website pre-fill results: deleted after 7 days.
Early-access list: kept until you ask us to stop.
WhatsApp assistant conversations: a conversation is deleted automatically 90 days after its last message. This covers its messages, booking summaries waiting for your confirmation, delivery records and the platform's record of incoming WhatsApp messages. Your stored WhatsApp number is deleted once no conversation or pending summary uses it and you have not written for 90 days. Monthly usage counts, with no message content, are kept for limits.
Routing notes (which business recently sent a booking message to your number): used for routing your reply for 7 days; the platform never stores such a note for more than 90 days.
Lidisto's copy of a booking prepared by the assistant (confirmed or not): the proposal is valid for 15 minutes; Lidisto deletes its copy automatically about 7 days after the booking is used or the proposal expires.
Bookings made through the assistant: kept like any other booking (see above).
Your Lidisto account, and accounts of business owners and staff: kept while you use them; deleted within 30 days of your request (Section 12), except the record of an acceptance of the Terms (next point). When a business closes its account, the business's data is deleted as the Terms (Section 18) say.
Records of a business's acceptance of the Terms (time, version, IP address and browser, the name and email address of the person who accepted, the business's name and tax ID): kept while the business has an account and, after it is closed or the person's account is deleted, for as long as a claim under the Terms can be brought (the limitation period, generally 3 years).
Invitations to join a business: the link is valid for 7 days; the invitation is deleted once it is used or withdrawn.
Messages and requests you send us: kept as long as needed to answer you and to show how we handled a request, and at most 3 years after it is closed.
Invoices we issue to businesses, once we charge for Lidisto: kept as accounting law requires.

After the retention period, data is permanently deleted or fully anonymised.

10. Cookies

Cookies are small files that a website saves in your browser. We use cookies and similar storage in your browser. Each item below is needed for the service to work, remembers a setting you chose, or makes your next booking quicker; none is used for analytics or advertising:

What	Why	How long
Session cookie and security token	Keep you signed in; protect forms	2 hours after your last activity
Sign-in details of business owners and staff, stored in the browser	Keep you signed in to the admin	Until you sign out
Returning-visitor cookie	Set after you book or confirm a code, so that on your next booking the page can offer to continue with your saved contact (shown partly hidden). You can remove it with "It's not me" (Nu sunt eu) on the booking page	30 days
Signup draft	Lets you continue setting up a business	30 days
Language and theme	Remember your language and light or dark mode	Language cookie: up to 1 year. The copy kept in your browser: until you clear it
Bot check on forms	Blocks automated abuse (set by our network and security provider)	Short
Payment form	Fraud prevention by the payment provider, only on the deposit step	As set by the provider

If a booking page is shown inside a business's own website, the same cookies are used there.

We use no analytics or advertising cookies. If we add them, we will ask for your consent first. The WhatsApp assistant uses no cookies. The Lidisto app keeps your sign-in on your phone and has no analytics or advertising tools.

11. Your Rights

Under GDPR, you have the right to:

Access: obtain a copy of the personal data we hold about you.
Rectification: correct inaccurate or incomplete data.
Erasure: request deletion of your data ("right to be forgotten"), subject to legal retention.
Restriction: limit how we process your data.
Portability: receive your data in a structured, machine-readable format, where we use it based on your consent or a contract.
Objection: object to processing based on legitimate interest (see below).
Withdraw consent: at any time, without affecting prior lawful processing.
Lodge a complaint: with the Romanian data protection authority, ANSPDCP (https://www.dataprotection.ro/), or with the data protection authority of the EU country where you live or work, if you believe your rights have been violated.

To exercise any of these rights, email [email protected]. We answer within one month. If a request is complex we may extend this by up to two more months, and we will tell you why.

For your booking records with a business, we pass your request to that business, as described in Section 1.

For the WhatsApp assistant, include the WhatsApp number you wrote from and, if you know it, the business you talked to. We may ask you to confirm that you use that number before we send you a copy of a conversation or delete it. For conversations with a business's own assistant, we pass your request to that business. Every conversation is deleted at the latest 90 days after its last message.

Your right to object

You can object at any time to our use of your data based on legitimate interest (Section 3). We then stop unless we have compelling reasons or need the data for a legal claim. To object, email [email protected].

12. Account deletion

You can request the deletion of your Lidisto account and associated data at any time, in the app or by email. The page Delete your account explains each way.

How to ask:

In the Lidisto app: Account, then Delete account.
Or send an email to [email protected] from the address linked to your account, or include the phone number you booked with.
We may ask you to confirm the request, for example with a code sent to that phone number or email, before we delete anything.
We confirm receipt and complete the deletion of what we hold within 30 days.

What gets deleted:

Your Lidisto account and sign-in details, sessions, and notification choices.
For each business where you have a client record: we ask the business to delete it, or we delete it on the business's instruction.
WhatsApp conversations are deleted 90 days after their last message (Sections 9 and 11).

What may be kept:

What a business must keep by law, for example a clinic's medical records.
Records of your WhatsApp choice (Section 9).
If you accepted the Terms for a business: the record of that acceptance (Section 9).
Security logs, until they expire (Section 9).

Emails. If you only want to stop emails from the early-access list, reply to one of them or write to [email protected]. Emails about a booking you made, such as confirmations and reminders, have no unsubscribe link; to stop them, write to [email protected].

13. Children

Lidisto is not directed to children under 16. If a Business Customer offers services to minors, a parent or legal guardian makes the booking.

14. Security

We apply these measures:

connections are encrypted;
access is limited to authorised people, by role;
passwords are stored only in hashed form;
clinical notes are encrypted in the database;
uploaded files are not publicly accessible.

15. Changes to This Policy

We update the date at the top. For important changes we also tell you in the app or by email where we can.

16. Contact

For any privacy question or to exercise your rights:

Email: [email protected]
Postal: BHDIT SRL, Aleea Barajul Uzului 1, Sector 3, București, Romania