Privacy policy

This policy explains how AllBooking (https://allbooking.eu) processes the personal data of salon owners and staff, website visitors of the platform, and people who write to us.

1. Who is responsible for the data

The platform operator is Intseo7 OÜ, registration code 14238521, address: Sutste 50-17, e-mail: [email protected].

Salon client data (name, phone, e-mail, bookings) is processed by the salon itself — it is the controller, and we process this data on its behalf under a data processing agreement. How the salon uses this data is described in the privacy policy on the salon's website; please contact the salon with questions about it.

2. What data we process

• account: name, e-mail, phone, language, password hash, two-factor sign-in settings;

• salon: name, address, contacts, invoicing details, plan, invoices and payments;

• support requests and emails you send us;

• technical data: sign-in and activity log, IP address hash, error reports, necessary cookies.

3. Purposes and legal basis

• to provide the service under the contract with the salon: accounts, booking, salon website, notifications (Art. 6(1)(b) GDPR);

• to issue invoices and keep accounting records (Art. 6(1)(c) GDPR);

• to protect the service from abuse, find errors and respond to requests (legitimate interest, Art. 6(1)(f) GDPR).

We do not sell data, do not use it for advertising, and do not make automated decisions based on it.

4. Who receives the data

We engage providers who process data on our behalf and under contract:

• hosting provider — application servers and databases in the EU;

• file storage (S3-compatible) — logos, photos, documents;

• SMTP2GO — sending emails;

• Cloudflare — DNS, attack protection, Turnstile verification, connecting salon domains;

• Sentry — application error reports;

• AI service (Groq or Anthropic) — translation and generation of public salon texts; clients' personal data is not sent there;

• Stripe, PayPal, EveryPay — subscription payments;

• Vonage — SMS notifications, if the salon connected its own Vonage account.

If a provider is located outside the EEA, transfers are made under the European Commission's standard contractual clauses or another basis under Chapter V GDPR.

5. How long we keep data

• account data — for as long as the account exists; deleting a salon does not delete the account;

• salon data — for as long as the salon is in use. A salon is deleted at the owner's request, when access ends, or if it has not been used for longer than the period set in the terms of use; after that, deletion can be cancelled within 30 days, and then the salon data is deleted;

• invoices, credit notes and payment documents — 7 years, as required by accounting law, including after the salon is deleted;

• logs and technical data — for a limited period needed for security;

• data is removed from backups as they rotate, no later than 30 days.

6. Cookies

We use only necessary cookies: for sign-in, language, display theme and form protection. There are no advertising or analytics cookies, so consent for them is not requested.

7. Your rights

You can request access to your data, its correction, deletion, restriction of processing, portability, and also object to processing based on legitimate interest. Write to us at [email protected]; we will respond within a month.

If you believe we are violating your rights, you can file a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or with the supervisory authority of your country.

8. Changes to the policy

We may update the policy. The date of the current version is indicated on this page; we will notify salons in advance of material changes.