Updated September 29, 2026
By putting your clients' data into the Service you become the one who decides the purposes of processing, and we become the one who processes on your instructions. European regulation requires those instructions to be written down. Here they are.
We process your clients' and staff data only so that the Service works: storage, display, search, calculations, and the notifications you switched on.
Processing lasts as long as your workspace exists.
Your clients: name, phone, email, booking and payment history, notes you made about them.
Guests of your public page: the same as clients, plus, when they send a request, a record of accepting your terms: the time, the IP address and browser the request came from, and the text of the accepted terms.
Your staff: name, email, role, shifts, tasks.
To process data only on your instructions, except where processing is required by law.
To keep it confidential: access is limited to us, and any contractor we bring in gets it only where needed and under a confidentiality obligation.
To help you answer your clients' requests about their rights, and to help with security of processing, breach notification and, where needed, assessing the impact.
To tell you about a data security breach without undue delay and no later than 72 hours after we become aware of it.
To tell you immediately if, in our view, your instruction breaches European or Spanish data protection law.
Workspace data is separated at the database level: access rules are enforced by the database itself, not only by the application.
Encryption in transit and at rest, access on a need-to-know basis, an audit trail for money records.
A backup of the database and files once a day: encrypted with our key before it is sent and kept for 30 days in the EU. A failure therefore costs at most one day of work. Restoring is verified by deploying a copy onto a clean database at least once a quarter — otherwise you learn that a backup is unusable on the day you need it.
The providers listed in the privacy policy. We require them to meet conditions no lower than those described here.
We give at least 30 days' notice before replacing or adding a provider. If one does not suit you, tell us before that date: we will look for an alternative, and if there is none, you may terminate the agreement and get back the unused part of your payment.
Storage is in the EU. Data leaves it only in these cases, and each depends on which features you have enabled:
Inbox — photos and documents are processed by Anthropic (United States), text and speech by Groq (United States); if Groq is unavailable, text is processed by Anthropic. Sent alongside are the venue's reference lists: room and expense-category names, the price list of extras, and up to sixty client names.
Bot replies in an enquiry channel — your guests' messages, including the phone number the model extracts from the text, are also processed by Groq (United States).
A connected Telegram channel — the guest's messages pass through Telegram's infrastructure.
Guest payments — Stripe.
A calendar link, if you have added it to an outside service: the busy times, and with guest names turned on their names as well, go wherever you added it.
Our email for correspondence with you — Zoho.
Taking backups — the GitHub environment (USA): the data passes through it unencrypted, is encrypted there, and only then leaves for European storage.
Such transfers rely on the European Commission's standard contractual clauses.
If Inbox and bot replies are off, no channel or payments are connected and you have not added the calendar link anywhere, the only thing that leaves the EU is the data the backup is assembled from, and only while it is being taken.
When you stop working with us, you choose: take your data or delete it. Export to JSON and CSV is available under "Account" at any time while the workspace is alive.
After the workspace is closed we delete working data and uploaded files within 30 days. For up to 31 days more they remain in backups (30 days of retention plus one day to erase the superseded version for good) — they cannot be forced out earlier without destroying the copies themselves — and disappear together with the last of them. We keep no copies beyond that, except what the law requires us to keep: payment records, for example.
If there is reason to doubt, we will show how we meet these conditions: answer questions and provide information confirming compliance.
Such a check may take place no more than once a year and in a way that does not disclose other clients' data.