Privacy

Last updated 12 October 2026

Who this covers

BLIV. LTD operates mybliv.com. This explains what we do with personal data: both yours, if you run a business on Bliv., and your customers', which we hold on your behalf.

Two different roles

When you sign up, we decide how your account data is handled. For that we are the data controller.

When your customers book with you, that information is yours. You decide what to collect and why; we only store and process it so your business works. For your customers' data you are the controller and we are your processor. If one of your customers asks to be deleted, they should ask you, and you can do it from their customer card with Erase on request.

What we hold

For you: your name, email address, business details, opening hours, services, prices and anything you write into the product.

For your customers: their name, email address, phone number where given, their bookings, any notes or answers they provide when booking, and, for appointments at their own address, that address. Reviews they leave, and their loyalty history with you.

A business's chat assistant

A business can have an AI assistant on its website, booking page and link in bio that answers questions from what the business has published and told it. It knows nothing about other customers or bookings.

We keep the questions you type and the answers you get for 30 days, for the business to read, then delete them. We don’t keep your name, network address or device with a chat. Your network address is used only to limit how many questions can be asked. If you choose to send a question on to the business, the name and email you give go to them as an enquiry. Please don’t type health or other sensitive details into the chat.

Card details

We never see them. Card payments are handled entirely by Stripe, on their own pages, and the money goes directly to your own Stripe account rather than passing through us. We store only what Stripe tells us afterwards: an amount, a reference and whether it succeeded.

Google Calendar, if you connect it

Connecting Google is optional and nothing else depends on it. Bliv. asks Google for one permission over your calendar: permission to create, update and remove events. It also reads your email address, so we can show you which account you connected.

We use it for one thing: when you confirm a booking, we put that appointment on your calendar, move it if the booking moves, and remove it if the booking is cancelled. Only events Bliv. made are ever changed. Where the booking is an online one, we ask Google to attach a Google Meet link to that event, because a Meet link cannot be created any other way. It exists only as part of a calendar event. That link is then included in the confirmation email your customer receives.

The permission Google grants technically allows reading your events as well as writing them. We do not read them. Nothing in Bliv. fetches, lists or stores the appointments already in your calendar, and your calendar's contents are never shown to us or to anyone else.

What we store is the token Google gives us so we can keep doing this without asking you again, the email address of the connected account, and, against each booking, the id of the event we created and the meeting link. Nothing else from Google is kept.

What we send to Google is the appointment: the service, the time, your customer's name and email address, and any note left when booking, so the event on your calendar is useful rather than blank. That is your customer's data and you are its controller, as above. Your customer is not added as a guest on the event, so Google does not email them; their confirmation comes from Bliv.

Disconnect at any time under Settings, Google Calendar. We delete the token immediately and ask Google to revoke it. Appointments already on your calendar stay there. They are your diary, and removing a fortnight of bookings because you disconnected an integration is not ours to do.

How we protect it: everything passes between your browser, Bliv. and Google over encrypted connections (HTTPS). The token is kept in a locked table in our database, which our host encrypts at rest. It can only be read by Bliv.’s own server when it updates your calendar. It is never sent to your browser, to your staff or to anyone else, and no person at Bliv. reads it. We never sell Google data, never use it for advertising, and never use it to train AI models. If you disconnect, the token is deleted and we ask Google to revoke it straight away. If you delete your business or account, the same happens once the 14-day window to undo has passed.

BLIV. LTD's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram, Facebook and TikTok, if you connect them

Connecting these accounts is not switched on yet. When it is, it will be optional, and this is how it will work.

What we read: the connected account’s name, id and profile picture, and for Instagram whether it is a business or creator account, because only those can be posted to. We do not read your messages, your followers, other people’s posts or anything you have posted without Bliv.

What we post: only the posts you choose, with the words you approve, at the time you choose, to the account you connected. For TikTok we send the video to your TikTok drafts, and you post it yourself. We never post on our own, and we never post to WhatsApp.

What we keep: the access token each platform gives us, so we can post when you ask without asking you to sign in every time, and the link to each post once it is live. Tokens are encrypted before they are stored, kept only on our servers, never sent to your browser, and refreshed before they expire.

Disconnect at any time in Settings. We delete the token straight away and ask the platform to revoke it. Posts already published stay on your account. To have everything we hold from these platforms deleted, see data deletion.

Who else processes it

Supabase stores the database, hosted in the EU. Netlify serves the application and any custom domain. Stripe processes payments. Resend delivers email. Anthropic powers the assistants (the one in a business's dashboard, and the chat on its pages), and text sent to them is processed to generate a reply and is not used to train their models. Google, only if you connect your calendar, and only as described above. Meta (Instagram and Facebook) and TikTok, only once connecting is switched on and you connect them.

We do not sell personal data, and we do not share it with anyone for advertising.

How long we keep it

While your account is open, and for as long as you keep it. Chats with a business’s assistant, and the questions it couldn’t answer, are deleted after 30 days.

Erase a customer and their details, notes, form answers, messages and reviews go at once, and their uploaded photos within 30 days. Their past bookings, payments, invoices and orders stay with no name, email, phone or address on them, because a business has to keep its money records for tax.

Delete a business, or your whole account, in Settings. For 14 days it is hidden, takes no bookings and can be undone. Then we delete it for good: customers, bookings and websites at once, photos and files within 30 days. Download your data first if you need it. We email you when the 14 days start and when it is done.

What we keep afterwards: the financial records (payments, refunds, invoices, sales and gift card balances) for 6 years, because UK businesses must keep them that long. They are kept with no customer names, emails, phone numbers or addresses on them, none of your own details, and nothing else of the business. After 6 years they are deleted. We also keep a short record that the deletion happened, with no customer details in it, and a list of addresses that asked not to be emailed, so they are not emailed again. Stripe keeps its own records of card payments under its own policy.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Most of this you can do yourself: Download everything and the two delete options are in Settings. Or write to support@mybliv.com from the address on your account, and we will reply within one working day and complete the request within one month.

If you are a customer of a business on Bliv, ask that business: they decide what happens to your data. If you write to us instead, we will pass your request to them and tell you we have.

If you are unhappy with how we have handled a request, you can complain to the Information Commissioner's Office.

Cookies and what we measure

Your browser keeps a few things that only make the pages work for you: your session while you are signed in, your basket, your answers so far while you set up a business, and small choices such as a pop-up you closed or light or dark mode. None of it identifies you or is sent to anyone else. There is no advertising tracking and nothing that follows you from site to site.

On Bliv’s own pages (this site, not a business’s website, booking page or shop) we ask whether we can count your visit. Only if you accept, Google Analytics sets its cookies (named _ga) to count visits and which pages are read, with adverts, personalisation and Google signals off, and without the part of an address after the page name. Your answer, yes or no, is kept in your browser for six months, and you can change it at any time from Cookie settings at the foot of every page; saying no removes Google’s cookies.

We count visits to our public pages, and signed-in owners opening their dashboard, in aggregate: how many visits each kind of page had on each day, and how many different people made them. To tell people apart within a day we keep a one-way scrambled code made from your internet address, browser details and a random value that changes every day and is then deleted, so the code cannot be traced back to you once the day is over or matched across days; the codes are deleted after two days and only the totals are kept. Your address itself is never stored. This uses no cookies. We do the same for each business on Bliv, on its behalf: how many visits its website, booking page and shop had, how many went on to book, and which of a few kinds of site sent them, so the business can see whether its site is working. A link from one of the business’s own social posts adds one to that post’s daily count, and one more if a booking is finished in the same visit; the post’s short tag is kept in that browser tab only.

If a friend’s referral link brought you to Bliv, opening it adds one to a daily count for that link, and nothing about you. Only when you choose to set up your business is the link’s short code kept in your browser, so it is still there after you confirm your email; it is removed once your business is set up. The friend sees your business’s name and how far it has got, never your email.

The same goes for a link in one of Bliv’s own posts: opening it adds one to a daily count for that post, and its short tag is kept in your browser so that, if you set up a business, we know which post brought you. The tag is removed once your business is set up.

If something breaks, the page sends an error report to Sentry, our error service, hosted in the EU: what went wrong, on which page and how long pages took to load. It does not include your IP address, what you typed or a recording of your screen.

When you start setting up a business and give your email, we note how far through setup you get, so we can help you finish. Your browser keeps a number for that sign-up until your business is set up, or for 30 days if it isn’t. Before you give your email, nothing is noted.

Once you have given your email and we have made your website, we keep a small preview of it with your sign-up: your business name, colours, headline and one photo. We use it only to show you your site in one reminder email if you don’t finish. It is deleted when your business is set up, or after 30 days.

Inside Bliv, when you are signed in, we note which parts of the app your business opens, so we can see what is used and what is not.

To improve Bliv, we also send PostHog, a product analytics service that stores its data in the EU, counts of what business owners do in the app: that a service was added or a campaign sent, and which areas are opened. It is tied to your account and business by their ids, and never includes your customers, their details or anything you write. Only signed-in business owners are counted, never staff or anyone visiting a business’s site, and nothing is stored in your browser for it. You can turn it off in Settings, under Account.

Getting in touch

General questions: hello@mybliv.com. About your data, or if you are stuck: support@mybliv.com. A real person reads both.