1. Who the controller is
Vassweb s. r. o., Company ID (IČO) 56921021, registered office at Školská 981/36, 931 01 Šamorín, registered in the Commercial Register of the Trnava District Court, Section Sro, Insert No. 59422/T (“we”). Contact for data protection questions: podpora@terminuj.com.
- Data of Terminuj users (owners, admins and staff of businesses, enquirers from the contact form): we are the controller.
- Data of the businesses’ clients (people who book an appointment through Terminuj): the controller is the business (salon) they book with. We are its processor under Art. 28 GDPR — we process the data only on its instructions under a data processing agreement, and we do not use it for our own purposes or sell it. The business can download its clients’ data at any time (Clients → Download everything).
- Measurement of visits to public pages (home page, pricing, business pages /t/…; only with your consent, Vercel Web Analytics): we are the controller, not the business — only we see the aggregate visit counts of the Terminuj service, and we do not link them to booking data.
2. What data we process
Users (owner, admin and staff of a business):
- E-mail (authentication)
- Name + phone (optional — profile)
- Language + time zone (locale)
- Marketing opt-in (newsletter)
- IP address + User-Agent (audit log — security)
- Source of the business’s sign-up: campaign parameters from the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the promo code and whether it was a click on a Meta or Google ad (without the click identifier) — to measure the effectiveness of our advertising (legitimate interest, Art. 6(1)(f) GDPR). No cookies; kept for as long as the business exists.
- Sign-in security (if you turn it on): the PIN only as a one-way hash, the public key of Face ID / fingerprint (passkey) and the device name; signed-in app devices (name, platform, notification token); browser notification subscriptions (push service address, browser type)
- Invited team members: e-mail and role from the invitation
Enquirers from the form on the Terminuj website: company, name, e-mail, phone, industry, number of people, message, link source (UTM) and a truncated IP address (/24) — to reply to the enquiry (Art. 6(1)(b) GDPR, steps prior to entering into a contract).
Clients of businesses (who book an appointment) — processed by us as the business’s processor:
- Name, e-mail, phone (booking flow)
- Booking history (dates, services, prices)
- Optional note with the booking
- Team tags and notes (added by the business, not visible to the client)
- Record of the booking being made (audit log): e-mail, IP address, browser type (User-Agent) and the source you came from (UTM parameters from the link, if the link contained them)
2a. Visitor measurement — only with your consent (Vercel Web Analytics)
If you allow the Analytics category in the cookie bar, we count visits to the public pages of Terminuj (home page, pricing, help, legal pages and business pages /t/…) using Vercel Web Analytics from our hosting provider Vercel Inc. Measurement does not run in the signed-in management area, on the page of a specific booking or in the booking window embedded on a third-party website. The tool does not use cookies, stores nothing on the device and does not create a profile.
When a page is viewed, the following is recorded: the time, the page address (parameters other than the campaign tag are removed before sending), where you came from, the device type, operating system, browser and approximate location (country, region, city). A visitor is distinguished only by a temporary fingerprint (hash) of the request, which is discarded after 24 hours; the IP address is not stored with the records. We only see aggregate visit counts, not individual people.
Controller: Vassweb s. r. o. (also on a business’s page — the business does not receive these statistics); Vercel Inc. is our processor. Legal basis: your consent — Art. 6(1)(a) GDPR and § 109(8) of Slovak Act No. 452/2021 Coll. on electronic communications (the script sends data from the browser, so it needs consent even without cookies; EDPB Guidelines 2/2023, para. 33). You can withdraw your consent at any time via “Cookie settings” in the page footer; withdrawal does not affect measurement carried out before it.
2b. Terminuj mobile app
The app is for businesses and their teams. No account is created in it. When you sign in, we process the account’s e-mail; the password is not stored in the app, only a sign-in token remains in the phone’s secure storage. When a new booking is made, we process the client’s name, e-mail and phone and the note entered by a member of the business’s staff, in order to manage the business’s bookings.
The app contains no third-party advertising or analytics, does not track you across apps and does not read your location, contacts or photos from the phone. You can request deletion of your account in the app under Settings or by e-mail to podpora@terminuj.com.
2c. Free-trial protection (one trial per business)
The free trial is available to each business only once. To prevent it from being obtained repeatedly, we process the following when a business signs up:
- Company ID (IČO) — we verify it in the public register (Register of Legal Entities of the Statistical Office of the Slovak Republic; for a Czech IČO, the ARES register); we pass only the IČO to the register.
- The business’s phone number — we verify it with an SMS code (the SMS is sent by the SMS provider listed in section 5).
- IP address and device data that the browser sends by itself (browser and system type, language). We store nothing on the device and read nothing from it by script.
We do not keep the phone number, IP address, network or device data in readable form, only as a one-way cryptographic fingerprint (HMAC with a secret key), together with the IČO and the date of sign-up. If a fingerprint matches a previous trial, we flag the business and a person reviews it — nothing is blocked automatically. If the IČO has already had a trial, the business is created without a trial.
Legal basis: legitimate interest in preventing misuse of the trial (Art. 6(1)(f) GDPR, Recital 47). We keep the record for 12 months from sign-up and then delete it automatically (even if you delete the business earlier). You can object to this processing (Art. 21 GDPR) at podpora@terminuj.com.
2d. Google Calendar and other calendars
- The owner or an admin of a business connects the business’s Google Calendar themselves in Settings → Calendar; a staff member connects their own Google Calendar themselves (or the owner or an admin does) on the staff member’s calendar page. Access is granted on the Google screen (calendar.events, calendar.freebusy). Without that we never access Google Calendar. Event times from a staff member’s calendar block only that staff member’s slots, and we write only their bookings into it.
- We read only the times of events in the connected calendar (start, end, whether an event is "busy" or "free", cancelled or declined) — not titles, descriptions, locations or attendees. We use the times only so that clients are not offered slots when the owner is busy; we do not store them in our database, they stay in server memory for a few minutes at most.
- We write the business’s bookings into the connected calendar (service, client’s first name and initial, status, link to the dashboard) and update or delete them when a booking changes or is cancelled. We never write the client’s e-mail, phone or note to Google. For this client data we act as the business’s processor (section 1).
- Access tokens from Google are stored encrypted (AES-256-GCM). The business can disconnect at any time in Settings → Calendar (we revoke access at Google and delete the tokens) or in its Google Account (myaccount.google.com/permissions). Events we already created stay in its calendar until it deletes them.
- We do not use Google user data for advertising, do not sell it, do not transfer it to others (except where required by law) and do not use it to train AI models. People on our team do not read it unless the business explicitly asks us to (support), or where needed for security or required by law.
- Apple and other calendars: a business can save the address of its calendar in ICS format (e.g. an iCloud public calendar). We store the address encrypted, download the calendar about every 10 minutes and use only event times, as with Google. In the other direction, the private booking subscription link (without client e-mails or phones) is created, rotated or revoked by the business in Settings → Calendar.
- Apple iCloud Calendar (two-way, from 6 November 2026): the business or a staff member enters their Apple ID and an app-specific password (created at appleid.apple.com, not the regular Apple ID password). We store the password encrypted (AES-256-GCM) and use it only to connect to the iCloud server (CalDAV): we read event times of the chosen calendar (as with Google, without titles or notes) and write bookings into it (same content as with Google). Disconnecting in Settings → Calendar deletes the password; you can revoke it completely at appleid.apple.com. Processing on Apple’s side is governed by Apple’s iCloud terms.
- Microsoft Outlook / Microsoft 365 (two-way, from 6 November 2026): access is granted on the Microsoft screen (Calendars.ReadWrite, offline_access, account e-mail). We store the tokens encrypted, read only event times (start, end, busy/free, cancelled) and write bookings (same content as with Google). Disconnecting in Settings → Calendar deletes the tokens; you can fully revoke access at account.microsoft.com → Privacy → Apps and services. Microsoft may process data outside the EU under its own terms (standard contractual clauses).
- Legal basis: performance of the contract with the business (Art. 6(1)(b) GDPR); for client data, the instructions of the business as controller (Art. 28 GDPR).
Terminuj's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. Purposes of processing
- Providing the booking service (contractual basis, Art. 6(1)(b) GDPR)
- Accounting and tax obligations (legal basis — § 35(3) of Slovak Act No. 431/2002 Coll. on accounting)
- Security (audit log) — legitimate interest, Art. 6(1)(f)
- Preventing misuse of the free trial (IČO, verified phone, IP address and device fingerprints, section 2c) — legitimate interest, Art. 6(1)(f)
- Overview of booking sources for the business (UTM parameters in the audit log) — legitimate interest, Art. 6(1)(f)
- Marketing (newsletter and offers) — only with consent (you turn it on in My account)
- E-mails about the free trial to the business’s contact e-mail (welcome, day-3 tip, 4 days and 1 day before the end, after the end, congratulations on the first booking) — performance of the contract and legitimate interest, Art. 6(1)(b) and (f); tips and reminders (day 3, 4 days before the end, first booking) include a one-click unsubscribe link in every e-mail (§ 116(15) of Slovak Act No. 452/2021 Coll.)
- Internal overview of businesses for Vassweb — every opening is logged (e-mail, IP address, browser) for security reasons and deleted after 365 days; legitimate interest, Art. 6(1)(f)
- Aggregate visitor statistics for public pages (Vercel Web Analytics) — only with consent, Art. 6(1)(a) GDPR (section 2a)
4. Retention periods
- Invoices (accounting documents): 10 years from the end of the year in which they were issued (§ 35(3) of Slovak Act No. 431/2002 Coll.). Even after a business is deleted, we keep them in the archive until the end of this period and then delete them.
- Bookings and data of the business’s clients: for as long as the business’s account exists. For a client with no booking or visit for 36 months, we anonymise the name, e-mail, phone and notes; bookings that ended before this period lose their notes. The booking record (date, service, price) remains without personal data.
- Record of account activity (audit log): 365 days (for security reasons)
- Record of the creation of the business and acceptance of the Terms and Conditions (version, time, IP address, browser type): for the duration of the contract; it ceases when the business is deleted
- Record of the booking being made (audit log): 365 days, then we delete it — including the client’s e-mail, IP address, browser type and UTM parameters
- Unfinished business set-up wizard: at most 30 days from the last change; once the business is created, we delete it immediately
- Team invitations: 30 days after expiry or cancellation
- Record of your choice in the cookie bar: 4 years (without IP address)
- Free-trial record (IČO and fingerprints of the phone, IP address, network and device, section 2c): 12 months from the business’s sign-up, then we delete it
- Webhook delivery records: 90 days
- Records of notifications sent: 90 days
- Enquiry from the form on the Terminuj website: at most 12 months from sending or handling (whichever is later), then we delete it. Earlier on request.
- Visitor measurement (only with consent): the visitor fingerprint (hash) for 24 hours, after which Vercel discards it; only aggregate counts without IP addresses remain.
- Deletion of a business: 7 days to restore it, after which we permanently delete all its data (except invoices in the archive). If the owner has no other business, we also delete their user account and sign-in.
- User account: for as long as you use it; deletion on request (Art. 17 below) or together with the deletion of the last business.
5. Recipients of data
We do not sell data. It is processed only by the following providers of ours (sub-processors under Art. 28 GDPR), each only to the extent of its task:
- Supabase — database and sign-in; data stored in the EU (Frankfurt)
- Vercel — application hosting; the server runs in the EU (Frankfurt). Only with your consent, also measurement of visits to public pages (Vercel Web Analytics, section 2a) — Vercel Inc. (USA) may also process it in the USA
- Resend — sending e-mails (confirmations, changes and reminders of bookings, sign-in e-mails)
- Stripe — payments for the Terminuj subscription (Stripe Checkout payment gateway and portal)
- Cloudflare, Inc. (USA) — protection of forms against bots (Cloudflare Turnstile) on sign-in, the booking form and the enquiry form: processes the IP address and technical browser data only to tell a human from a bot
- Upstash, Inc. — abuse-protection counters (only a fingerprint of the IP address, a few minutes to days) and the record of your choice in the cookie bar (without IP address, 4 years)
- Apple, Google and Mozilla push services — delivery of encrypted notifications to the dashboard installed in a browser or phone (they cannot read the content)
- Google (Google Ireland Ltd. / Google LLC) — only if the business itself connects its Google Calendar (section 2d): bookings are written to its own Google account and the times of its events are read
- BulkGate (TOPefekt s.r.o., Šumperk, Czech Republic) — SMS confirmations, changes and reminders of bookings, if the business turns them on
Several of these providers are companies based in the USA. Where data could be accessible outside the EU/EEA, the transfer is protected by standard contractual clauses under Commission Decision (EU) 2021/914 or by the EU–US Data Privacy Framework.
6. Your rights (GDPR Art. 15–22)
- Art. 15 — access: download a copy of all your data in Account → Personal data export (/dashboard/account/export) or request it by e-mail
- Art. 16 — rectification: edit your profile in My account or write to support
- Art. 17 — erasure: e-mail to podpora@terminuj.com. We will handle it within 30 days (Art. 12(3)).
- Art. 18 — restriction: you can request restriction of processing
- Art. 20 — portability: download your data via /dashboard/account/export (JSON + CSV format)
- Art. 21 — objection: you can object at any time to processing based on legitimate interest (security log, booking and sign-up sources, trial protection) at podpora@terminuj.com; you can turn off marketing e-mails in Account → Marketing e-mails or via the link in the e-mail
- Art. 22 — automated decision-making: we do not make decisions with legal or similarly significant effects automatically. We only automatically assess whether the IČO has already had a free trial (section 2c); in that case the business is created without a trial. If you disagree, write to podpora@terminuj.com — a person will review it
Providing an e-mail address is a requirement for entering into the contract (we cannot create an account without it); other profile data is voluntary.
Clients of businesses exercise these rights with the business (salon) that is the controller of their data. If you send us a request, we will forward it to the business without undue delay and help it deal with it (Art. 28(3)(e) GDPR).
7. Cookies
Without consent we use only strictly necessary cookies and browser storage: the business’s sign-in (Supabase) and the dashboard lock with Face ID / PIN (only after sign-in), your choice in the cookie bar, the light or dark mode you chose (only if you change it) and the contact details from your last booking, only if you tick “Remember my details” when booking. We remember the link parameters (UTM) for the next page only with your consent (Analytics). Cloudflare Turnstile bot protection is loaded on sign-in and in forms and processes technical browser data only to tell a human from a bot (section 5). We do not use analytics or advertising cookies. Only with your consent (Analytics category) do we measure visits to public pages without cookies using Vercel Web Analytics (section 2a); you can withdraw consent via “Cookie settings” in the page footer. The full list with purposes and retention periods is in the Cookie policy.
8. Cross-border processing
Both the database (Supabase) and the application server (Vercel) are in the EU (Frankfurt). Outside the EU/EEA (USA), data may be processed by: Stripe, Resend, Cloudflare, Upstash, Vercel Inc. (measurement only with your consent, section 2a), Google (the business’s connected calendar, section 2d). The transfer is protected by the EU–US Data Privacy Framework (Commission Decision (EU) 2023/1795) where the recipient is certified under it, otherwise by standard contractual clauses (Decision (EU) 2021/914). We will send you a copy of the safeguards on request.
9. Complaints
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). In Slovakia, this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR):
dataprotection.gov.sk
Galvaniho 7/B, 821 04 Bratislava
10. Changes to this notice
This notice may be updated. We will inform you of material changes by e-mail 14 days in advance. Version of this document: 1.5 (effective from 6 November 2026; 1.4 and 1.3 from 1 November 2026; 1.2 from 22 October 2026; 1.1 from 20 October 2026; 1.0 from 7 June 2026).