Privacy policy

[COMPANY NAME / SOLE TRADER NAME], [ADDRESS] — contact: [CONTACT EMAIL].

[DATA PROTECTION OFFICER, IF ONE IS APPOINTED]

For the data of registered professionals (account, profile, subscription), we are the controller.

For the data of clients who book on a professional's page, the professional is the controller: we process it on their behalf, as a processor, only to run the service. [DATA PROCESSING AGREEMENT (DPA) — TO BE MADE AVAILABLE TO PROFESSIONALS]

• Account: email address; when signing in with Google, the name and identifier of the Google account.
• Public profile: display name, page address, trade, bio, location, photo, contact options (email, phone, WhatsApp), social links, language, time zone and page appearance.
• Offers: titles, descriptions, prices, durations, photos, paid add-ons and the questions asked to clients.
• Calendar: availability, closures and blocked slots.
• Clients and bookings: the client's name, email and phone number, their message and answers to the offer's questions, the date, time, time zone and language of the booking, the professional's internal notes, waitlist entries, and the history of bookings and cancellations.
• Subscription: Paddle customer and subscription identifiers, subscription status and dates. No card details: those stay with Paddle.
• Session payments, if the professional turns them on: the identifier of their Stripe or PayPal account, payment amounts and statuses. No card details.
• Professionals' sign-in history: date, method (email link or Google), browser and system family (for example "Chrome · Windows", never the full browser signature) and the IP address cut down to its network, which does not point to a specific device.
• Abuse protection: when a booking is made, the IP address and email are used to limit the number of requests; these counters are erased automatically after about 24 hours.

• Providing the service: public page, bookings, confirmation and reminder emails — performance of the contract.
• Managing the subscription and billing — performance of the contract and legal accounting obligations.
• Securing accounts and preventing abuse: sign-in history, request limits — legitimate interest.
• Answering support requests — legitimate interest.

We do not use data for advertising and we do not sell it.

We rely on the following providers, who only process data to deliver their service to us:

• Supabase — database, authentication and file storage. Servers in the European Union (Ireland).
• Resend — sending emails (sign-in links, confirmations, reminders). [SERVER LOCATION]
• Paddle — subscription payment and invoicing, as reseller and Merchant of Record; Paddle is also the controller of its own processing.
• Vercel — hosting and delivery of the site. Headquartered in the United States.
• Google — only if you choose "Continue with Google" to sign in.

When a professional takes payment for sessions online, the client's payment is handled by Stripe or PayPal, on the professional's own account and under their own privacy policies.

Some of these providers may process data outside the European Union. These transfers are covered by [SAFEGUARDS — STANDARD CONTRACTUAL CLAUSES, DATA PRIVACY FRAMEWORK: TO BE CHECKED FOR EACH PROVIDER].

• Account, profile, offer, client and booking data: for as long as the account exists.
• After an account deletion request: 30 days, during which the account can be reactivated on request, then permanent erasure.
• Accounts whose trial ended without a subscription: [RETENTION PERIOD].
• Sign-in history: kept for the whole lifetime of your account, deleted along with it.
• Abuse-protection counters: about 24 hours.
• Accounting and billing records: [LEGAL RETENTION PERIOD].
• Technical backups: [BACKUP RETENTION PERIOD].

[IF THE GDPR APPLIES] You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions for what happens to it after your death.

Professionals can change most of their data directly from their dashboard, and delete their account from their settings. For anything else, write to [CONTACT EMAIL]; we reply within one month.

If you booked with a professional, contact them first: they are the controller of your data. You can also write to us and we will pass your request on.

You can lodge a complaint with [COMPETENT SUPERVISORY AUTHORITY].

The site only uses cookies it needs to work: session cookies that keep a professional signed in, and one cookie that remembers the chosen language. No advertising or analytics cookies.

Paddle's checkout window, when opened, may set its own cookies.

This policy may change as the service evolves. The date at the top of the page shows the latest update; significant changes are emailed to professionals.