← Home

Privacy notice

1. Controller

The controller for data processing on this platform is Filippos Kagkiouzis, Würzburger Straße 2, 60385 Frankfurt am Main, Germany, email: hello@bookry.de, phone: +49 157 31317011. For the booking data of a salon’s clients, that salon is the controller; the platform acts as a processor under Article 28 GDPR.

2. What we process

When an appointment is booked: name, email address, phone number, the chosen service, the appointment, the chosen language and an optional note. For a salon account: email, name, password as a hash, and sign-in timestamps.

Technically we also hold: a waiting-list entry (email, date, wanted service) if you join one; notes a salon records about a client; a block entry if a salon excludes someone from online booking; and a counter against automated access that derives an encrypted value from the IP address (the address itself is not stored there). The hosting provider additionally keeps server logs, as any web server does. If a technical error occurs, including in the browser, it is noted there with page, time and browser type; email addresses, phone numbers and links containing access keys are removed first. The operator receives an email notification with the same cleaned details. Passwords never appear in any log.

3. Purposes and legal bases

Processing serves the performance of the booking and its administration (Article 6(1)(b) GDPR), compliance with legal obligations (point (c)) and our legitimate interest in a secure, working service (point (f)).

Review requests: if a salon has switched this on, you receive one email on the evening of your appointment asking you to share your experience on Google, at most once in 90 days. The legal basis is the salon’s legitimate interest in feedback (Article 6(1)(f) GDPR) together with Section 7(3) of the German Unfair Competition Act; you are informed of this when booking. You can object at any time via the link in each of these emails. We store whether the email was sent and whether the button was tapped; after an objection only an encrypted value of your address, so you are not asked again. What you write on Google is processed by Google under its own responsibility.

4. Recipients and processors

We use the following processors, each under an agreement pursuant to Article 28 GDPR:

  • Vercel Inc., USA — running the application, in its Frankfurt am Main data centre.
  • Neon, LLC (a Databricks company), USA — database, stored in Frankfurt am Main (AWS eu-central-1).
  • Resend (Plus Five Five, Inc.), USA — sending emails. Sending servers are in the EU; the provider processes administration and logs in the USA.
  • IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany — domain and forwarding of emails sent to hello@bookry.de.
  • Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland — billing of salon subscriptions (salons only, not their clients). Stripe processes payment details such as card or account numbers on its own pages; Bookry only receives the plan, status and invoice data. Stripe is itself the controller for fraud prevention and its legal obligations.

Appointments and client data are stored in the EU. Because these providers are based in the USA, access from the USA, for example for maintenance or following an order by authorities, cannot be ruled out. Any such transfer is covered by the EU Standard Contractual Clauses (Article 46(2)(c) GDPR) and, where the provider is certified, by the EU-US Data Privacy Framework (Article 45 GDPR).

5. Retention

We keep data for as short a time as possible and as long as necessary:

  • Appointments and client records: as long as the salon needs them, then deleted on the salon’s instruction. Tax-relevant records follow statutory retention periods.
  • Waiting-list entries: until notification, at the latest after 30 days.
  • Files a salon uploads for the moving service (e.g. a client or price list from its previous provider): until the move is done, at the latest after 30 days.
  • Counter against automated access: until its counting window ends (at most one hour), deleted at the latest by the next daily clean-up.
  • Server logs at the hosting provider, including error reports: per their policy, typically a few days up to 30 days. We keep no error database of our own.
  • Salon account: until cancellation, then 30 days to export, then deletion.
  • Invoices and accounting records for salon subscriptions: ten years (§ 147 AO, § 257 HGB), stored at Stripe.
  • Contact requests via the home page: 12 months, then deletion.
  • Sign-in sessions and password reset links: until they expire (session 30 days, link one hour).

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. Contact hello@bookry.de. You may also lodge a complaint with a data protection supervisory authority, normally the one where you live or where the controller is established.

7. Cookies and local storage

We use no tracking and no advertising cookies, so there is no consent banner. Strictly necessary are: a session cookie for signing in to the salon area, and a cookie for the chosen language of that area. Your browser additionally remembers your light or dark preference on your own device. None of this leaves your device.

8. No third-party content

Fonts, images and scripts are served from our own servers. Opening the public pages makes no connection to Google Fonts, font networks, map services or social networks. Your IP address is therefore not passed to any third party. Only if you tap “Google Calendar” after a booking does Google’s page open; Google’s privacy policy governs what it collects.

9. Processing on behalf of salons

Salons are controllers for their clients’ data; we act on their instructions. The agreement under Article 28 GDPR is public: data processing agreement. It becomes part of the contract when a salon registers.