Moshtar Book Privacy Policy
This policy explains which personal data Moshtar processes when you use Moshtar Book or visit moshtar.com, why we do so, and what your rights are.
Effective date: 10 November 2026 · Nederlandse versie · Version française
1. Who we are
Moshtar Book is a booking platform offered by:
No Shit Sherlock BV Broekkouter 54 9200 Dendermonde, Belgium Company number BE 1008.511.077 info@moshtar.comIn this policy, "Moshtar", "we" and "us" refer to this company. A "provider" is a business that uses Moshtar Book to let its customers book its offering, and a "user" is a person who logs in to the back office of a provider.
2. Our two roles
- Controller. We are responsible for the personal data of providers, their users and visitors of moshtar.com that we process to run our own business: accounts, sign-ups, security and communication about the service.
- Processor. The data of a provider's customers (for example bookings, contact details, delivery addresses and payments) is processed on behalf of that provider. The provider is the controller for that data and explains its processing in its own privacy statement on its booking website. We only process that data on the provider's instructions, as set out in the processing terms in our Terms of Service.
3. Which data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Sign-up: company name, Moshtar address, email address, password (stored only as a secure hash), default language, and the time and version of your acceptance of these terms | Creating your account and recording that you accepted our terms | Contract |
| Waitlist: the email address you leave on moshtar.com, and when you confirmed it | Letting you know when Moshtar Book opens for new customers, when the demo is ready and what it costs | Consent, confirmed by clicking the link in our email (double opt-in) |
| Users: name, email address, role, password hash, two-factor authentication data (authenticator app, passkeys, recovery codes) and login times | Giving access to the back office and keeping it secure | Contract; legitimate interest (security) |
| Business details of the provider: name, address, VAT number, contact details, logo, brand style and website texts | Showing the booking website, documents and emails of the provider | Contract |
| History: which user changed what and when | Traceability, support and security | Legitimate interest |
| Technical data: IP address, browser and server logs | Preventing abuse (for example limiting sign-ups per IP address), solving errors and securing the platform | Legitimate interest |
| Connections the provider sets up: Google Ads, a payment provider (Mollie or Stripe), its own AI key or its own mail server | Making the connected features work | Contract |
| Emails and support questions you send us | Answering you and providing support | Contract; legitimate interest |
We do not sell personal data, we do not use it for advertising profiles, and we do not send you newsletters without your consent. We only send emails that are needed for the service, such as the confirmation of your sign-up and security notifications. If you put yourself on the waitlist, we only email you about the launch of Moshtar Book; every email has a link to unsubscribe, after which we delete your address.
4. Data we receive from Google
A provider can connect its own Google Ads account to Moshtar Book to create and manage search campaigns for its offering. An administrator of that provider does this by signing in with Google and granting Moshtar Book access.
What we access
- We request a single permission:
https://www.googleapis.com/auth/adwords(manage your Google Ads campaigns). We do not request access to your Gmail, contacts, files, calendar or Google profile, and we never see your Google password. - With that permission we receive an access token and a refresh token, the list of Google Ads accounts the signed-in Google account can access (account ID and name), and for the campaigns created through Moshtar Book their settings (budget, targeting, ad groups, ads and keywords) and their results (impressions, clicks, cost and conversions).
How we use it
- To let the administrator choose which Google Ads account to connect.
- To create, change, pause and resume the search campaigns that the administrator starts in Moshtar Book, and to keep them in line with the provider's offering (for example pausing an ad for an item that is no longer on the website).
- To show the results of those campaigns in the provider's back office.
Moshtar Book only touches campaigns it created itself. It does not read or change other campaigns in the account, and it never creates Google Ads accounts or pays for advertising: the provider pays Google directly.
How we store and protect it
The refresh token is stored encrypted on our servers in the European Union. It never appears in the browser, in logs, in error messages or in exports. Campaign IDs, the approved ad texts and keywords are stored with the provider's account so the back office can show and manage them.
Sharing
We do not sell data received from Google APIs and do not share it with anyone, except with the service providers that host Moshtar Book (see section 5), when the law requires it, or to protect against fraud and abuse. We do not use it for advertising, to build user profiles or to train AI or machine learning models, and we never send it to an AI model. Our staff do not read it, unless the provider asks us to for support, it is needed for security or to investigate abuse, or the law requires it.
Keeping and deleting it
We keep the token as long as the Google Ads account stays connected. When an administrator clicks Disconnect in Moshtar Book, we first pause the campaigns of Moshtar Book (unless they choose otherwise) and delete the stored token. When a provider's account is deleted, all of this data is deleted with it. You can also revoke Moshtar Book's access at any time on myaccount.google.com/permissions; disconnecting in Moshtar Book does not do this for you, because the same Google login may also be used by another provider.
Limited Use
Moshtar Book's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Who receives the data
We use these service providers (sub-processors). Each of them only receives what it needs for its task and is bound by a data processing agreement.
- Microsoft Azure (Microsoft Ireland Operations Ltd): hosting, database and file storage, in a data centre in the European Union; Azure Maps for addresses, distances and routes.
- Amazon Web Services (Amazon Web Services EMEA SARL): sending emails via Amazon SES, in the EU region Stockholm.
- Google: only when a provider connects Google Ads (see section 4).
- Anthropic: only when a provider connects its own Anthropic API key, for automatic translations and ad text suggestions. Only texts the provider writes itself are sent: the texts of its offering, website texts such as the home page and frequently asked questions, uploaded terms and conditions, and for ads also its business name and service area. Never customer data or data from Google. This happens under the provider's own agreement with Anthropic.
- Mollie or Stripe: only when a provider connects its own account for online payments. The provider's customers then pay the provider directly; Moshtar never holds the money.
- VIES of the European Commission: checking an EU VAT number.
We also share data with authorities when the law requires us to.
6. Transfers outside the European Economic Area
Moshtar Book is hosted in the European Union. Some services a provider can choose to connect (such as Anthropic, Stripe or Google) may process data in the United States. Those transfers rely on the EU-U.S. Data Privacy Framework or on the standard contractual clauses of the European Commission.
7. How long we keep data
- A sign-up, confirmed or not: 24 hours. A confirmed sign-up has by then become an account.
- An address on the waitlist: until you unsubscribe or Moshtar Book opens and we have let you know. An address you do not confirm: 7 days.
- Account, user and business data: as long as the account exists. After the account ends, we delete it within 90 days, unless the law requires us to keep something longer (for example invoices: 7 years).
- Technical logs: at most 90 days, unless they are needed to investigate an incident.
- Data we process for a provider: as the provider decides, and at the latest until 90 days after the end of its account.
8. Security
We protect data with encrypted connections (HTTPS), mandatory two-factor authentication for every user, strict separation of the data of each provider, encrypted storage of secrets such as tokens and API keys, and a history of changes. No system is perfectly secure; if a data breach affects your rights, we will inform you and the authorities as the law requires.
9. Cookies on moshtar.com
moshtar.com only uses cookies that are strictly necessary: to keep you logged in, to protect forms against misuse and, during the connection with Google Ads or a payment provider, to check that the answer belongs to your request. We do not use analytics or advertising cookies on moshtar.com. The booking website of a provider has its own cookie and privacy statement.
10. Your rights
You have the right to access, correct and delete your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. Email us at info@moshtar.com. We answer within one month. If you are a customer of a provider, please contact that provider first: we will help them answer your request.
You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be) or with the authority in your own country.
11. Children
Moshtar Book is meant for businesses and is not intended for children under 16.
12. Changes
We may update this policy when our service or the law changes. We will announce important changes in the back office or by email before they take effect. The effective date at the top always shows the current version.