Hooman Khalatbari · Booking

Privacy Policy

Last updated: October 2, 2026

This policy explains how the Hooman Khalatbari booking system (the “booking system”, “we”, “us”) handles personal data when you book a music consultation, private session or masterclass with Hooman Khalatbari. The booking system is operated for Hooman Khalatbari by Rhythmitica. Questions or requests: info@hoomankhalatbari.com.

Information we collect

Booking details you give us: name, email address, and optionally phone number, country and notes, plus the service, date, time and time zone you choose.
Account and sign-in data: your email address and one-time sign-in links or codes sent to it. Sign-in sessions use strictly necessary cookies. We do not use advertising or tracking cookies.
Payment information: for payments by PayPal, PayPal processes your payment and we receive only the transaction reference and status, never your card or account details. For Persian bookings paid by bank transfer, you send a photo or PDF of your transfer receipt to our Telegram bot. We store the receipt privately, plus what is needed to check it (amount, date, transaction reference and only the last four digits of the destination card). We also store your Telegram user ID and username for the booking.
Content in your student area: messages, masterclass applications, and files or recordings shared with you.
Technical data: standard server logs (such as IP address and request time) kept for security and troubleshooting.

How we use it

To schedule, confirm, reschedule and cancel your sessions, and to hold your time slot while payment is completed.
To verify payments, issue invoices and handle refunds.
To send booking emails: confirmations, reminders 24 hours and 1 hour before a session, and notices about changes, messages and shared files.
To provide the online session itself through Google Meet (see below).
To keep the service secure, prevent abuse, and meet legal and accounting obligations.

We do not sell personal data and do not use it for advertising or profiling.

Google Calendar and Google Meet

The booking system connects to one Google account only: the instructor’s own account, with a single Google Calendar permission, “View and edit events on all your calendars” (https://www.googleapis.com/auth/calendar.events). Customers do not sign in with Google, and we never access a customer’s Google account.

We use this access only to:

create a calendar event on the instructor’s calendar when a booking is confirmed;
generate the Google Meet link for that session;
update that event when the booking is rescheduled, and cancel or delete it when the booking is cancelled.

The event contains the session name, time, booking reference, any notes you provided, and you and the instructor as attendees (name and email). We store only the event’s ID and the Meet link with your booking, and include the link in your confirmation and reminder emails. We do not read, copy or store any other events or information from the calendar.

Google Calendar data is not sold, is not used for advertising, and is not used for any purpose other than the booking functions above. It is not transferred to anyone except as needed to provide those functions (for example, the Meet link in your emails) or as required by law. The booking system’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers

We share data only with providers that run parts of the service for us, and only as needed for that purpose:

Cloudflare: hosting, database and private file storage;
Resend: sending booking emails;
Google: Calendar events and Meet links, as described above;
PayPal: card and PayPal payments;
Telegram and our automation service (n8n): receiving bank-transfer receipts and sending payment messages for Persian bookings.

Retention

We keep booking, payment and invoice records for as long as needed to provide the service and to meet accounting and legal obligations. Unpaid bookings whose payment deadline passes are cancelled. Shared files and payment receipts are stored privately and are accessible only to you (for your files) and to our staff. You can ask us to delete your data at any time, subject to records we must keep by law.

Your rights

You can ask to access, correct, export or delete your personal data, or object to its use, by writing to info@hoomankhalatbari.com. You can update your name, time zone and email preferences in your student area, and turn off reminder emails there. Depending on where you live, you may also have the right to complain to a data protection authority.

Security

Data is sent over HTTPS. Staff sign-in requires an emailed one-time code. Payment receipts and shared files are kept in private storage that is never publicly addressable. Secrets such as API keys are stored encrypted and never exposed to the browser.

Changes

If we change this policy we will update the date above, and for significant changes we will notify you by email.