Who we are
Trimbl is a booking and business-management service operated by Zalek Labs Ltd, registered in England and Wales, company number 17414810. Our registered office is 66 Paul Street, London, England, EC2A 4NA. You can contact us about privacy at hello@trimbl.app or by writing to that address.
This notice applies when you visit Trimbl, manage a business workspace, or arrange an appointment with a business using our service. Zalek Labs Ltd is the controller of information used to operate our website and platform accounts, administer subscriptions, provide support and protect the service.
The business providing your appointment is the controller of its customer records, services, appointment notes and communications. Trimbl processes those records on its behalf to provide the booking and management tools. The business is responsible for explaining its own use of your information, including any marketing or sensitive information it collects. Contact it using the details on its booking page; you can also contact us and we will help direct your request.
The information we use
The information involved depends on the features you use. We receive it from you, the business managing your appointment, and the sign-in, messaging and payment providers you interact with. A business may enter customer records or invite staff before those people create a Trimbl account.
Fields marked as required are needed to provide the relevant account, booking or verification feature. Without them, we may be unable to provide that feature. Optional preferences and photos can be left blank. A phone number and verification are needed for text messages; they are not permission to send marketing.
| When you use Trimbl to… | Information involved |
|---|---|
| Manage a business | Name, email, sign-in details, business contact information, staff profiles and roles, invitations, working hours, services, logos and subscription records. Password accounts store a password hash. |
| Book an appointment | Name, email, phone number when provided, chosen business, professional, service, time, price, booking status and history, and booking or customer notes entered by you or the business. |
| Personalise your visit | Optional appointment preferences, service choices, consultation briefs, saved preferences, and photos or captions you submit. |
| Join a waiting list or group visit | Availability windows, service and professional preferences, price limits where provided, offers, responses and group-booking participation. |
| Receive messages | Contact destination, verification and reminder preferences, consent and opt-out records, message content, sending attempts, provider references and delivery or failure information. |
| Use the website or ask for support | Session and request information, device/browser information received by hosting providers, security and error records, support correspondence and attachments. The application uses hashes derived from IP addresses, request context and a time window to limit repeated requests. |
Why we use it
We use information to provide workspaces, staff access, diaries and booking pages; verify access; arrange and manage appointments, consultations, waiting lists and group visits; deliver requested communications; administer subscriptions; answer support requests; and investigate delivery, security or service issues.
For processing where Zalek Labs Ltd is the controller, the following grounds apply. Where we process a business’s customer records on its instructions, that business determines and explains its own lawful basis.
| Purpose | Our legal ground |
|---|---|
| Provide an account or subscription you contract for, and respond to related requests | Performance of our contract with you, or steps you request before entering it. |
| Operate business/staff accounts, provide support and maintain service records where an organisation is our customer | Our legitimate interests in delivering and administering the service for that organisation and its authorised users. |
| Protect accounts, prevent abuse, troubleshoot, maintain reliability and handle disputes | Our legitimate interests in a secure, reliable service, preventing misuse and establishing or defending legal claims. We consider the effect on the people concerned. |
| Meet applicable tax, accounting, regulatory and lawful disclosure requirements | Compliance with our legal obligations. |
| Optional communications or processing for which we ask permission | Consent where required. You can withdraw it using the available preferences or by contacting us. Appointment service messages and return-visit preferences are separate. |
Appointment preferences and suggestions
You may choose to share preferences such as a quiet appointment, step-free access or having each step explained. Free-text notes and photos can also reveal sensitive information. Share only what is necessary for the service, avoid unnecessary medical details, and ask the business how it handles any sensitive information it requests. Businesses must have an appropriate lawful basis and, where needed, an additional legal condition for processing sensitive information.
Return-visit suggestions use completed appointment dates, intervals set by the business and availability. The business dashboard highlights tasks such as unfinished records, pending consultations and customers who may be due another visit. These suggestions do not automatically book an appointment or make decisions with legal or similarly significant effects about you.
Maps and external services
A shop’s embedded Google map connects to Google when you select “Show Google map”. Google then receives the browser request, including information such as your IP address, needed to display the map. A directions link opens Google’s service separately. Google handles those requests under its own privacy notice.
External links and provider-hosted sign-in or payment pages are governed by the relevant provider’s privacy information. This notice describes Trimbl’s handling of information.
Where information is processed
Trimbl’s application and database are hosted in Frankfurt, Germany. Our email-delivery configuration uses Resend’s Ireland region. These hosting choices do not mean that all provider processing, support access or backups remain in the UK or European Economic Area.
Our providers operate internationally, including in the United States. Where a transfer of personal information outside the UK or EEA requires safeguards, applicable provider data-processing terms provide mechanisms such as an adequacy decision or standard contractual clauses with the UK addendum where required. The mechanism depends on the recipient and service. You can contact hello@trimbl.app for information about the safeguards relevant to your information and how to obtain a copy.
Cookies and browser storage
Trimbl uses essential session cookies to maintain sign-in and customer verification, and a security cookie to protect form and account actions. Sign-in sessions have a configured 12-hour cookie lifetime; verified customer access to a shop also expires after 12 hours.
Browser storage can remember your theme, motion and transparency preferences. During Google or Apple sign-in, a draft in that browser tab can preserve your business name, name and industry, or booking service and date choices. That draft is valid for 20 minutes; expiry does not necessarily clear the stored value at that instant. It contains no password or provider token and does not reserve an appointment slot.
You can clear cookies and site storage in your browser. This can sign you out or remove saved preferences and unfinished choices. It does not delete records held by Trimbl or a business. Embedded maps and provider pages can use their own cookies when you choose to open them.
How long information is kept
We keep information for as long as it is needed for the purpose described in this notice, taking account of the account or business relationship, instructions from the business, legal obligations, outstanding issues and the need to establish or defend legal claims. The criteria below apply where a single fixed period would not fit the different types of records.
Cancelling an appointment changes its status; it does not erase its history. Signing out, clearing cookies or removing Google/Apple authorisation does not delete an account. You can request deletion by contacting us or the business. Some records may need to be retained for a legal requirement or an unresolved claim; we will explain any applicable limitation.
Temporary social sign-in attempts expire after ten minutes. A verified first-time business signup has a separate ten-minute window to finish its business details. Completing or replacing that continuation clears its pending identity result; expired data is cleared when the continuation is checked or another sign-in flow starts. These security time limits do not determine the retention of accounts or appointment histories.
| Records | Retention criteria |
|---|---|
| Platform accounts and linked sign-in identities | While needed to provide the account and access. After closure, only information needed for outstanding administration, legal obligations, security or claims should remain. |
| Business-held customer, appointment, consultation and photo records | According to the business’s instructions, service and record-keeping needs and applicable obligations. The business should explain its retention approach. Contact it or us about deletion. |
| Messages, preferences and opt-out evidence | While needed to deliver and troubleshoot messages, honour your current choices and demonstrate those choices. A suppression record may need to remain to prevent unwanted messages. |
| Billing, support, security and audit records | For the relevant accounting or legal obligation, investigation, support matter, security need or potential claim. |
| Backups | Until replaced or removed under the relevant provider’s backup cycle. Removal from active records does not necessarily remove every backup immediately. |
Your message and account choices
You can update the profile information and message preferences offered in your private notebook. Text reminders require phone verification and an enabled preference. Return-visit email and text preferences are separate from reminders about an existing appointment.
Where reply-enabled SMS is available, replying STOP disables texts for that number across businesses using Trimbl’s shared messaging service. You can also change preferences in your notebook. Replying START at the provider does not itself re-enable your Trimbl reminder preferences. A message already delivered cannot be recalled. Ordinary replies to automated texts are not a staffed support inbox; contact the business directly for appointment questions.
You can remove an uploaded private photo from your notebook when it is not attached to a consultation. For a consultation-linked photo, contact the business about removal. For other corrections, account closure or deletion requests, contact hello@trimbl.app or the relevant business.
Your privacy rights
Depending on the circumstances and applicable law, you can ask to access your information, correct inaccurate information, erase information, restrict its use or receive information in a portable form.
You have the right to object to direct marketing at any time. You may also object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
Email hello@trimbl.app with your request, or contact the business responsible for the records. We may need proportionate information to verify identity before disclosing or changing records, and may need to involve the business. Avoid sending identification documents until they are requested. We will respond within the applicable legal time limit, normally one month, and explain any lawful extension or reason a right cannot apply in full.
You can complain to the UK Information Commissioner’s Office (ICO), or your local data-protection authority where applicable. You do not have to contact us first, although we welcome the opportunity to resolve a concern.
Changes to this notice
We may update this notice as the service or its data handling changes. The date at the top identifies the current version. Where a change materially affects how your information is used, we will provide an appropriate notice through the service or another suitable channel.
Before using Google account information for a new purpose or accessing additional Google data, we will explain the change and ask for your consent.
A question about your information?
Email hello@trimbl.app and tell us how we can help.
Google and Apple sign-in
Google and Apple sign-in are optional alternatives where offered. You authenticate with the provider directly; Trimbl does not receive your Google or Apple password.
Google: we request openid, email and profile permissions. We use your verified email address, stable account identifier and display name when supplied. We do not request access to Gmail messages, Google Calendar, Google Contacts or Google Drive. Although Google may return a profile-picture address, Trimbl does not save or display it.
Apple: we receive a stable account identifier and verified email address. Apple may provide your name the first time you authorise Trimbl. If you choose Hide My Email, we receive Apple’s relay address instead of your personal email address.
We use these details to create the account or customer profile you request, recognise you on later visits, or connect a provider to an account you have already verified. Your provider email may also be your account, business or booking contact for related service messages and billing. For a new business it initially becomes the business contact email: review it before publishing your booking page because published business contact details are public.
We store the provider identifier, email recorded when connected, the relevant account or shop-customer link, and whether Apple supplied a private relay address. Provider access and refresh tokens are discarded after the sign-in exchange. Short-lived security records verify and complete the redirect.
If you are new to Trimbl, we temporarily keep the verified identity on our server while you add your business details. That continuation is linked to the browser session that completed sign-in and is valid for ten minutes. Your identity is not placed in a registration link or saved in browser storage. Completing setup creates your account and draft workspace; it does not publish the business.
A matching email alone does not link an existing account. First sign in or verify your booking email, then connect the provider from your settings or private notebook. Using an Apple relay address separately can create another customer profile.
You can remove Trimbl’s authorisation in your Google or Apple account settings. That does not itself delete Trimbl records or end an existing Trimbl session. Sign out separately and contact us or the relevant business if you want records reviewed or deleted.