Nebo Privacy Policy

Effective date: October 13, 2026
Last updated: October 13, 2026

Nebo (NeboRebook.com) is a voice booking and rebooking assistant for independent hair stylists and beauty professionals. It is run by Nebo Services LLC, based in Utah, USA ("Nebo," "we," "us"). This policy explains what information Nebo handles, why, who it is shared with, and the choices you have.

Two kinds of people are covered: - Pros: stylists and beauty professionals who use Nebo to run their bookings. - Clients: the pro's customers whose appointments Nebo books.

1. Information Nebo stores

Nebo stores its data in files on its own server, hosted by Amazon Web Services in the United States. It does not use a separate database. The server stores:

• Client book: client names (first and last if given), email addresses and phone numbers if they are given, and each client's most recent service.
• Private client notes: notes the pro writes in Setup → Clients. They can only be seen and edited in Setup. Nebo never reads them aloud, and they are never sent to the AI service, the voice service, or text messages.
• Rebooking log: for each conversation: date and time, client name, client email (if any), whether the client rebooked, the next appointment, the service, the mode used, and which calendar was used. The pro can download it as a spreadsheet.
• Settings the pro chooses, including services and calendar preferences.
• Sign-in data: the app passcode, stored only as a salted, one-way hash, plus session records.
• Connection tokens for Google Calendar and Square, if the pro connects them. These are never sent to the browser.
• Optional API key and text-message settings: an API key is stored only as a hash. GoHighLevel settings and a token are stored only if the pro turns that feature on.

On the pro's phone or browser: an unfinished conversation is kept for 15 minutes so it can pick up where it left off, along with voice preferences.

We do not sell this information, and we do not use it for advertising.

2. Microphone and voice

• Speech-to-text happens in the browser. Nebo uses the phone or computer browser's built-in speech recognition (the Web Speech API). Nebo's code does not record audio, does not upload audio files to Nebo's server, and does not send audio to any speech-to-text service of its own. Depending on the browser and device, the browser maker may process the audio under its own privacy policy. For example, Safari on iPhone and iPad uses Apple's speech recognition, and Chrome uses Google's speech services.
• Nebo receives text, not audio. The words the browser turns into text are sent to Nebo's server so it can understand the booking request. Nebo stores the results, such as names, emails, services, and appointment times (see Section 1). Nebo does not store recordings.
• Silent Mode ("Hey Nebo"): the check for the wake phrase runs in the browser, so background conversation is not sent to Nebo before the wake phrase is heard.
• Nebo's spoken replies: by default, the browser's own voice reads them aloud. If Premium voice is on, see Section 6.

3. How we use information

We use this information only to: - find open appointment times, book and confirm appointments, and rebook clients; - remember a client's details and last service so returning clients are recognized ("the usual"); - send appointment confirmations (see Section 4); - show the pro their rebooking log and results; - keep the service working and secure.

4. Google Calendar

If a pro links Google Calendar, Nebo asks for only these two permissions: - https://www.googleapis.com/auth/calendar.events: view and edit events on the pro's calendars - https://www.googleapis.com/auth/calendar.freebusy: see when the pro is free or busy

Nebo does not ask for the pro's Google profile or for broader calendar access.

What Nebo reads: busy and free times, so it can find open slots, and the primary calendar's name (which is the account's email address), so the pro can see which account is linked.

What Nebo writes: in Google Calendar mode, Nebo creates appointment events with a title, a description, a time, and an optional location. It can add the client as a guest, which makes Google send the client an invitation email. Nebo can also update the guests on, or delete, events it booked. In Square mode, Google Calendar is only read for availability. Nebo does not add or change anything there.

Limited Use. Nebo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: - Google user data is used only to show availability and create and manage the bookings the pro asks for. - We do not transfer Google user data to others, except as needed to provide this feature, to comply with the law, or as part of a merger or sale with notice to users. - We do not use Google user data for advertising, and we do not sell it. - No person reads Google user data unless the pro gives permission for a specific message or event, it is needed for security or to comply with the law, or the data is aggregated and anonymized for internal operations. - Google user data is not used to develop, improve, or train general AI or machine-learning models, and calendar contents are not sent to the AI service described in Section 6.

Google tokens are stored on the server in a file only the app can read. A pro can disconnect Google from Setup, or remove Nebo's access at https://myaccount.google.com/permissions.

Disconnecting Google in Setup asks Google to cancel Nebo's access and deletes the stored Google tokens from the server.

5. Square

If a pro connects Square, Nebo asks Square for permission to: read and create appointments; read appointment business settings; read and create customers; read the catalog of services; and read the business profile. (Square permissions: APPOINTMENTS_READ, APPOINTMENTS_WRITE, APPOINTMENTS_ALL_READ, APPOINTMENTS_ALL_WRITE, APPOINTMENTS_BUSINESS_SETTINGS_READ, CUSTOMERS_READ, CUSTOMERS_WRITE, ITEMS_READ, MERCHANT_PROFILE_READ.)

Nebo uses this to find open times, look up or create the client's customer record (by email, phone, or name), and create bookings in Square. Nebo saves Square's customer ID next to the client's name so it can find them again. Square tokens are stored on the server and never sent to the browser. Square's own privacy policy applies to data held by Square.

6. AI and voice services

• Premium voice (ElevenLabs): if Premium voice is on, the text Nebo is about to say, which can include a client's name and appointment details, is sent to that service to turn it into audio. Nothing is sent in Silent Mode, because Silent Mode speaks nothing.

ElevenLabs handles this data under its own terms and keeps it according to its own retention rules. Nebo has opted out of ElevenLabs using its data to train ElevenLabs' models.

7. Text messaging (GoHighLevel), optional

Nebo has an optional text receptionist that answers client texts through the pro's GoHighLevel account. It is currently switched off. If a pro turns it on, client text messages and phone numbers pass between GoHighLevel and Nebo so Nebo can reply and book. Each conversation's state is kept for 48 hours and then expires. GoHighLevel's privacy policy applies to data held by GoHighLevel.

8. Hosting and infrastructure

Nebo runs on an Amazon Web Services (AWS Lightsail) server in Ohio, United States. All of the site's traffic passes through Cloudflare for security and delivery, so Cloudflare handles requests and responses on their way to and from the server.

9. Who we share information with

Only the services above (Google, Square, ElevenLabs, GoHighLevel if it's turned on, AWS, and Cloudflare), and only to run Nebo. We may also share information if the law requires it. We do not sell personal information.

10. Retention and deletion

• Client records, notes, and the rebooking log are kept until the pro deletes them or closes their account. The pro can view, edit, and delete clients in Setup → Clients.
• Unfinished conversations on the phone expire after 15 minutes. GoHighLevel text conversation state expires after 48 hours.
• When a pro closes their account, their client records, notes, and rebooking log are deleted within 30 days.
• Server backups are stored on the same server and are kept for 30 days, then deleted.

Deletion requests: Pros and clients can ask us to delete their information by emailing [email protected]. Clients can also ask their stylist directly. We respond to deletion requests within 30 days.

11. Security

• The app is locked behind a passcode. The passcode is stored only as a salted scrypt hash.
• Data files and tokens are stored with owner-only file permissions (mode 600). The data folder is never served to the web.
• Client and notes pages are sent with no-cache headers.
• Connections use HTTPS.

No system is perfectly secure, but we work to protect your information.

12. Children

Nebo is a business tool for professionals and is not directed to children under 13. We do not knowingly collect children's information through Nebo. Nebo does not verify the age of clients. The pro is responsible for making sure any client they book is of an appropriate age and, where needed, has a parent or guardian's permission.

13. Your rights

Depending on where you live, you may have the right to access, correct, or delete your information. To make a request, email [email protected]. Utah residents: under the Utah Consumer Privacy Act, Utah residents may ask to access the personal information we hold about them, get a copy of it, and have it deleted, and may opt out of its sale or use for targeted advertising (Nebo does neither). Send requests to [email protected].

California residents: under the California Consumer Privacy Act (CCPA), as amended, California residents may ask to know and access the personal information we hold about them, have it corrected, and have it deleted, and will not be treated differently for making a request. Nebo does not sell or share personal information for advertising. Send requests to [email protected].

14. Changes to this policy

If we change this policy, we will post the new version on this page and update the date at the top. If a change is significant, we will tell pros in the app or by email.

15. Contact

Nebo Services LLC, 449 South 860 East, Suite C310, American Fork, Utah 84003, USA Email: [email protected]