When this applies
This agreement applies automatically, as part of the Terms of Service, whenever you use this platform to process personal data about other people: your customers, the people who book with you, the visitors to your website. You do not need to sign it separately and you do not need to ask us for a copy.
It does not cover your own account data. We are the controller for that, and the Privacy Notice is where it is described.
Where this document and the Terms of Service disagree about personal data, this one wins.
Who is what
You are the controller and we are your processor. You decide what personal data to collect, why, from whom and for how long. We hold and process it for you, on your instructions, and we make no decision of our own about it.
That also means the duties that come with being a controller are yours: a lawful basis for collecting the data, telling the people concerned what you are doing, answering them when they ask, and keeping your own record of processing. We help, as set out below, but we cannot do those for you.
Payment providers are a separate case. When your customer pays you, the provider processes their card as a controller in its own right, on its own terms, for its own obligations around fraud and financial regulation. That part of the flow is between you and them.
What we process, and why
The subject matter is the provision of the platform. The nature and purpose is storing, organising, retrieving and transmitting the personal data you put into it, so your website, the pages we host for you and your dashboard can work, including to the endpoints and recipients you configure. The duration is the life of your account, plus the retention periods in Annex 1.
Annex 1 sets out the categories of data subject and of personal data. You remain free to put other personal data into free text fields, in which case it is processed on the same terms, and choosing what goes in there is your decision.
Only on your instructions
We process personal data only on your documented instructions, including for transfers to another country. Your instructions are: this agreement, the Terms of Service, the settings you choose in your dashboard, and what you do through the API. Anything you can do in the product is an instruction.
We do not use your data for anything of our own. Not to train models, not to build a product, not to advertise, not to compile statistics we publish. The only exception is aggregate operational counts that say nothing about any person, such as how many API calls were made, which is how your usage is measured and billed.
If a law we are subject to requires us to process something otherwise, we tell you before we do, unless that law forbids us from telling you. If we think an instruction of yours breaks data protection law, we tell you and may pause that instruction until it is resolved.
Confidentiality
Everyone authorised to process your data is bound to confidentiality, and that obligation continues after their involvement ends. Access is on a need to know basis: production data is reached only to run or repair the service, or to answer something you asked about.
Every access to a payment connection is written to a log you can read in your own dashboard.
Security
We implement appropriate technical and organisational measures for the risk, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. Annex 2 lists them specifically rather than in the abstract, so that you can check them.
We may change a measure for one that is equivalent or better. We will not reduce the overall level of security.
Sub-processors
You give us general authorisation to engage sub-processors. The current ones are listed in Annex 3 and on the sub-processor page, which is the canonical list.
We will email you at least thirty days before adding or replacing one. If you object on reasonable data protection grounds within those thirty days, tell us and we will try to find another way. If we cannot, you may terminate the affected part of the service and we will refund any unused prepaid period.
Every sub-processor is put under data protection obligations no weaker than these, and we remain fully liable to you for what they do.
Helping you meet your own obligations
Some of what a data subject can ask for, you can do yourself. Your dashboard lists your customers, each with their appointments, and lets you correct a customer's name, email address, telephone number and your notes about them, download what you hold about a customer, erase a customer, cancel an appointment, read and delete a message your website's contact form received, and edit or remove your pages, services and staff. The download is one file holding the customer's record and every appointment, with the notes on both; their payment records are on your Payments screen. The API returns your appointments with each customer's name and email address, and your payment records.
Erasing a customer cannot be undone. Their name, email address, telephone number and every note about them are removed from their record and from each of their appointments, which stay in your diary and your figures without them. Payment records keep the payer's name and email address, as accounting records. You cannot erase a customer while they have an appointment still to come: cancel it first, so they are told.
For anything the tools do not reach, write to us with the request and we carry it out on your instruction, at no charge for a reasonable volume. If a data subject contacts us directly about data that is yours, we do not answer them on the substance: we tell them to contact you and pass the request on promptly.
We also help you, taking into account what we know and the nature of the processing, with security obligations, breach notification, communicating a breach to affected people, data protection impact assessments, and prior consultation with an authority.
Telling you about a breach
If we become aware of a personal data breach affecting your data, we notify you without undue delay and in any case within 48 hours of becoming aware, by email to your account address.
We tell you what happened, which categories of data and roughly how many records are involved, what the likely consequences are, what we have done and what we propose to do. Where we do not yet know something, we say so and follow up rather than delaying the first message until the picture is complete.
Notifying the authority and, where required, the affected people is your decision and your duty as controller. We will not do it in your name.
Return and deletion
While your account is open, the API returns your published content, your appointments with each customer's name and email address, and your payment records, at no charge. For a copy of anything else, including a customer's full record, write to us and we provide it in a usable form.
Deleting a website deletes its content, its appointments, its customer records and its measurement immediately. Deleting your account does that for every website and then deletes the account. Both are irreversible.
Backups are overwritten on their own cycle and data in them is deleted as that cycle turns over rather than reached into individually. Until then it is isolated and not used. Records we are required by law to keep, in particular payment and accounting records, are retained for the period the law prescribes and processed for no other purpose.
Audits and information
We make available to you the information needed to demonstrate that these obligations are met, and we allow for and contribute to audits, including inspections, by you or an auditor you mandate.
In practice: ask, and we answer in writing. An on site inspection is on reasonable notice, at most once a year unless an authority requires otherwise or there has been a breach, during business hours, subject to confidentiality, and arranged so it does not disrupt the service to other subscribers. You cover your own costs, and ours if the inspection goes well beyond answering questions in writing.
We do not hold an ISO 27001 or SOC 2 certification.
International transfers
The database and the application run in Switzerland or the European Economic Area. Each is recognised as providing adequate protection by the other, so movement between them needs no further safeguard.
DigitalOcean, LLC, which runs the servers and the database, is a company based in the United States. Backblaze, Inc., which keeps the encrypted backups, is a company based in the United States. Cloudflare, Inc., which carries requests to the service, is a company based in the United States. Cloudflare, Inc., which keeps the images you upload, is a company based in the United States. A company can be compelled by the law of the country it is based in to disclose what it stores elsewhere, so processing by it is treated as a transfer to that country and rests on the safeguards in the next paragraph.
Requests reach the service through Cloudflare, Inc., which processes each one where it arrives: worldwide, at the Cloudflare data centre nearest each visitor. Processing outside Switzerland and the European Economic Area is a transfer and rests on the safeguards in the next paragraph.
Where a sub-processor processes personal data outside Switzerland and the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses of 4 June 2021, module three, controller to processor to processor, which are incorporated into this agreement by reference and take precedence over it in case of conflict.
For data subject to Swiss law, those clauses are read with the amendments the Federal Data Protection and Information Commissioner requires: the Commissioner is the supervisory authority, references to European data protection law are read as references to Swiss, and the term data subject includes legal entities while Swiss law protects them. Where a sub-processor is certified under the EU-US or Swiss-US Data Privacy Framework, that certification applies in addition.
For the purpose of those clauses, Annex 1 below is the description of processing, Annex 2 is the technical and organisational measures, and Annex 3 is the list of authorised sub-processors.
California: service provider terms
Where the California Consumer Privacy Act applies, you are the business and we are a service provider. Personal information is disclosed to us only for the limited and specified business purpose of providing the platform.
We do not sell or share it, we do not retain, use or disclose it for any purpose other than performing the service or as permitted by the Act, and we do not combine it with personal information received from anywhere else except as the Act permits. We do not retain, use or disclose it outside our direct business relationship with you. We certify that we understand these restrictions and will comply with them.
We give the same level of privacy protection the Act requires of you, notify you if we determine we can no longer meet these obligations, and let you take reasonable steps to stop and remediate unauthorised use. The same terms apply under comparable state privacy laws, which we read as making the same demands.
Annex 1: what is processed
The parties
Controller and exporter: you, the account holder, at the details on your account. Processor and importer: BackendFree, at the contact details in the Legal Notice.
Categories of data subject
- Your customers, meaning people who book an appointment or make a payment on your website or on the booking page we host for you.
- Your staff, where you enter them so appointments can be assigned.
- Visitors to your website, where you switch on measurement.
- People who write to you through your website's contact form, where you switch on the inbox.
- Anybody whose personal data you choose to put into your page content or a free text field.
Categories of personal data
- Customers
- Email address, and where given, name and telephone number. Appointments, what was booked, with whom and when. Notes written by the customer and notes written by you about them. Whether they agreed to marketing. The price agreed.
- Payments
- Payer name and email address, amount, currency, status, refunds, and the provider's own references. No card number, expiry date or security code ever reaches this platform.
- Staff
- Name, email address, telephone number, working hours and time off.
- Contact form messages
- Name and email address, what they wrote, the page they wrote from, and any further answers your form asks for. Never their IP address or their browser.
- Images
- The images you upload, which may show people. They are public to anybody holding their address.
- Website visitors
- A daily, per site, irreversible key derived from address and user agent; a random session identifier; the time of the visit; the page path without its query string; the referring hostname; utm tags; the names of events you chose to record; a device class of desktop, mobile or tablet, and the browser and operating system by name without a version, or for automated traffic which crawler it was; and a country and a city where the network provides them. Never the IP address and never the user agent themselves, including where you report visits from your own server.
No special category data is required by the platform, and no field asks for any. If you put health, biometric or similar data into a free text field, it is processed on these terms and the additional duties that attach to it are yours.
Where you add the keys of your own Cloudflare bot check to the inbox, the token a visitor's browser receives from Cloudflare is checked with Cloudflare under your own account with them, on your instruction. Nothing else about the visitor is sent with it.
On your booking page, Cloudflare Turnstile checks under our own account with Cloudflare that a person rather than a script is booking. Its script sends Cloudflare the IP address, the browser's user agent and characteristics of the browser of whoever books, and nothing else about them is sent with the check.
Frequency, nature and purpose
Continuous, for the duration of your account. Storage, organisation, retrieval and transmission, for the purpose of providing the platform and no other.
Retention
Customer and appointment records are kept for as long as you keep them and are deleted when you delete them, the website or the account, and what names a customer is removed when you erase them. Contact form messages are deleted after 365 days, and those kept as spam after 30 days. Individual measurement events are deleted after 60 days and daily counts after 760 days. Payment records are kept as accounting records for the period the law requires. The full table is in the Privacy Notice.
An image you upload is kept until you remove or replace it, or delete the website or the account.
Annex 2: technical and organisational measures
These are the measures in place, named specifically so that you can check them rather than take them on trust.
Encryption
- All traffic encrypted in transit, with unencrypted connections redirected.
- Secrets such as payment provider credentials encrypted at rest.
What is never kept in a readable form
- API keys, which cannot be recovered from what is stored.
- Card data, which never reaches the platform.
Access control and separation
- Each account's data is separated from every other account's, and the service does not confirm that another account's data exists.
- API access is by key, and each kind of key reaches only what it needs: a key meant for public pages cannot list appointments or read payment records.
- Administrative and production access is restricted to authorised persons who need it.
- Passwordless sign-in by a single-use, time-limited code sent to the account's email address, with an optional second step by authenticator app.
- The page where a customer sees, changes or cancels a booking opens only through the link sent to that customer.
Integrity and availability
- Messages from payment providers are verified as genuine before they are acted on, and webhooks sent to your server are signed.
- Rate limits bound what a single client can do in a short window.
- Automated database backups, held encrypted, with periodic restore checks.
Data minimisation
- Visitor IP addresses and user agents are never stored.
- The pages we host for your customers are not measured, and we store nothing on their devices.
- Every record kept for an operational reason has an automatic deletion window.
Annex 3: sub-processors
The sub-processor page is the current list and forms part of this annex. At the date of this document it is:
- Stripe, for payment processing;
- Resend, for email delivery;
- Sentry, for error tracking;
- Cloudflare Turnstile, for telling people from scripts on the sign-in and sign-up forms and on your booking page;
- our network provider, for carrying every request to the service;
- our image storage provider, for the images you upload;
- our hosting provider, for the servers and the database;
- and our backup storage provider, for encrypted backups of the database.