Privacy Policy.

We hold 2 kinds of information: details about the businesses that use Rillo, and the records of the customers who book with them. The first is ours to look after. The second belongs to the business, and we only handle it in order to run the service for them.

We do not sell data. We do not use customer records for advertising. We do not send marketing messages to the customers of the businesses that use Rillo.

Transvo provides Rillo. For information about the businesses that use Rillo, such as the person who signs up and the business’s payout details, Transvo is the data controller.

For customer records, the business is the data controller and Transvo is a data processor acting on its instructions. If you are a customer and want your record changed or removed, ask the business you booked with. If they cannot help, write to us and we will assist them.

Our contact details, including our postal address, are in section 15.

From the businesses that use Rillo:

Account details: name, email address, phone number and role, and a confirmation at signup that the person opening the account is 18 or over.

Business details: trading name, address and location, what is being booked (appointments, tables, rooms or similar) and its price, and tax registration status.

Payout details: the bank or mobile money account you nominate to receive customer payments, and the account holder’s name as Paystack returns it when the account is verified.

Usage and technical data: pages requested, times, browser and device type, and IP address, recorded in server logs.

About the customers who book, given by the customer when they book or entered by the business:

Identity and contact details: name, phone number, email address, and any note recorded with the booking.

Booking details: the date or time booked, what was booked, and the record of charges and payments, with Paystack’s reference for each payment. Card numbers and mobile money PINs are typed into Paystack’s checkout and never reach us.

For rooms and stays, whether the customer agreed to receive text messages.

From people who ask for a demo or join our newsletter: the details they type into the form.

To provide the service you signed up for, which is the substance of our agreement with you.

To take payments for bookings through Paystack, and to match each payment to its booking.

To keep the service secure, to investigate faults, and to prevent misuse.

To meet our own legal and accounting obligations, which is why some records outlive an account.

To contact you about the service. Notices about outages, security and fees are part of the service and are not marketing.

To send product news by email to business owners and newsletter readers. A business owner is added when they sign up, and anyone can leave with one click from any of these emails. Customers of businesses are never added.

Rillo only sends text messages about a customer’s own booking. It does not send marketing texts to customers, and does not let a business use it for bulk marketing.

For rooms and stays, such as hotels, guest houses, apartments and hostels, the customer is asked first: an unticked box when they book, or the business recording the answer they gave in person. Without a yes, no text is sent, and the business cannot send one. The answer is recorded as yes, no or not asked, and the customer can change it at any time by telling the business.

For other bookings, such as appointments and tables, texts about the booking go to the number the customer gives when they book.

We use a small number of service providers, and only to run Rillo:

Hosting and database: our infrastructure providers, who store the data at rest and in transit under contract.

Payments: Paystack, which processes every online payment. With each payment it receives the amount, the booking reference, the business’s name, and the customer’s name and email address, so the payment can be matched to the booking. Card and mobile money details are given to Paystack directly. Paystack also verifies the payout account a business nominates and settles money straight to it. Rillo never holds that money (see our Terms of Service).

Messaging: our SMS or WhatsApp sender, which receives a customer’s number and message only when a message is actually sent.

Email delivery: our email provider, which sends account, receipt and booking emails on our behalf.

Newsletter: our email list provider, which holds the name and email address of business owners and newsletter readers. Customer records are never sent to it.

Maps: Google, which receives what a business types into the address search during setup, to find its location. Customer records are never sent to it.

Visit counts: our hosting provider’s analytics, described in section 13.

Continuity storage: a spreadsheet service operated under our own account, which holds the contact register described in section 7.

We do not share your data with anyone else unless you ask us to, or unless we are required to by law. If we are required to disclose data by a lawful request, we will tell you where we are permitted to.

Separately from the main database, Transvo keeps a register of customer contact details. It exists for one reason: so that a business whose account is lost, closed in error or broken by a fault can be given back the contacts it trusted to Rillo.

It holds only these fields: the date the record was made, the business’s trading name and account identifier, and the customer’s name, phone number and email address. It holds no booking, payment, financial, health, identity document or free text data.

A record is queued for the register by the database itself when a customer record is created, so no way of booking can miss it. Its contents are read when it is sent, not when it was queued, so a correction made before then is the version kept.

The register is a spreadsheet in an account controlled only by Transvo, reached by a dedicated credential limited to that one document. It cannot be reached from Rillo, from any business’s account, or from the public internet.

For this register Transvo remains a processor for each business, not a controller. It is not used for analytics, profiling, marketing or anything other than giving a business back its own contacts.

Our main database and application servers are in the United Kingdom. Some service providers, such as our email and text message senders, may handle data in other countries. Where data crosses a border, we rely on contracts requiring those providers to protect it to the standard that data protection law requires.

Each kind of data has its own rule. Where a period is given, it runs from the event named, not from when the data was collected.

Customer records and bookings: kept while the business’s account is open. They are the business’s own records.

Financial records: payments, charges and the ledger are kept while the account is open, and afterwards for as long as tax and company law require. They are never edited or deleted, only corrected by a reversing entry. So a request to delete is met by deleting the customer record the entries point to, which leaves the amounts but not the person.

The activity log: kept while the account is open. The database refuses edits and deletions to it, including from the account that made the entries, so the record of who did what cannot be rewritten.

The contact register in section 7: kept while the matching customer record exists. Deleting a customer record removes its queued entry automatically. A row already sent to the register is removed by hand on request, and a request under section 11 covers both.

Passwords and sign-in sessions: kept while the account exists. Passwords are stored only as salted one-way hashes, which nobody, including us, can turn back into the password.

Server error records: a rolling window of the latest entries, older ones discarded automatically. Used only to find faults.

Rate limiting counters: these hold only a one-way hash of a network address, and are cleared on a schedule once their window has closed.

When a business closes its account, it can export its data for at least 30 days. After that, the account and everything under it are deleted: its staff records, customer records, bookings and register entries. Data the law requires us to keep is kept only as long as required, then deleted.

Access is controlled by role, so a front-of-house account cannot reach the financial records. Data is encrypted in transit. Passwords are never stored in a readable form, and a member of staff sets their own password rather than being given one.

The database enforces separation between businesses at its own level, not only in the application, so a fault in the software cannot show one business another business’s bookings.

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant data protection authority as the law requires, and we will tell you what we know rather than waiting until we know everything.

Under data protection law you may ask us to tell you what data we hold about you, to correct it if it is wrong, to delete it where we have no continuing reason to hold it, and to stop processing it in certain circumstances.

To ask for any of this, including deletion, write to support@userillo.com with enough detail for us to find your record. For a customer, that usually means the business you booked with and roughly when. A deletion is made in the main database and in the contact register in section 7, and where a financial record cannot lawfully be deleted, the customer record it points to is deleted instead. We will respond within the time the law allows. If you are not satisfied, you may complain to the data protection authority where you are based.

Rillo is for businesses and their adult customers, not children. Opening a business account means confirming you are 18 or over, because it puts you into a commercial contract and lets you take payments through it. We do not knowingly collect personal data from children, and a booking made through Rillo is understood to be made by an adult.

The application uses cookies that are necessary for it to work: keeping you signed in, remembering which business you are viewing, and remembering interface preferences such as your last chosen view. The sign-in cookie is set for the whole userillo.com domain, so the dashboard and the website recognise the same session.

We count visits to the website and the application with Vercel Web Analytics. It sets no cookies and does not identify you: it records the page visited, the site you came from, and your country, browser and type of device.

We do not use advertising cookies, and we do not track visitors across other websites.

We will update this page when what we do changes, and we will change the date at the top. Where a change materially affects how we handle your data, we will tell you directly rather than relying on you noticing.

Email: support@userillo.com

Post: Transvo, MNJ Square, Ashale Botwe, Accra, Ghana

Hours: Monday to Saturday, 8am to 8pm GMT