Privacy Policy

1. Introduction

PLWebsites ("we", "us", "our") operates Clienteka, a cloud-based service business management platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our service.

We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection laws.

2. Data Controller

3. Data We Collect

We collect the following categories of personal data:

Account Information

• Full name and email address (required for registration)
• Password (stored in encrypted/hashed form)
• Language preference and account settings

Business Data

• Salon/business information (name, address, phone, email)
• Client records (names, contact details, visit history, notes)
• Appointment and scheduling data
• Invoice and payment records

Technical Data

• Browser type, device information, and IP address
• Cookies for authentication and language preferences
• Usage patterns and error logs for service improvement

4. How We Use Your Data

• Providing and maintaining the Clienteka service
• Managing your account and authentication
• Processing payments through Stripe (our payment processor)
• Sending essential service communications (password resets, account notifications)
• Improving the service based on usage patterns
• Complying with legal obligations

5. Legal Basis for Processing (GDPR Art. 6)

• Contract performance — Processing necessary to provide the service you signed up for (Art. 6(1)(b))
• Legitimate interests — Service improvement, security, and fraud prevention (Art. 6(1)(f))
• Legal obligation — Tax and accounting requirements, law enforcement requests (Art. 6(1)(c))
• Consent — For optional features like marketing communications, which you can withdraw at any time (Art. 6(1)(a))
• Product analytics for signed-in customers — Understanding how the app is used so we can improve it, based on our legitimate interest (Art. 6(1)(f)). This does not depend on your cookie choice, because it requires no storage on your device.

6. Third-Party Services

We share data with the following third-party services, which have their own privacy policies:

• Stripe — Payment processing. Stripe handles all credit card data directly and is PCI DSS compliant. We never store your card details.
• MongoDB Atlas — Database hosting. Your business data is stored securely in MongoDB Atlas cloud infrastructure.
• Amazon Web Services (AWS S3) — File storage for uploaded images and documents.
• Vercel — Application hosting and content delivery.
• PostHog — Product analytics, hosted in the EU. Helps us understand how the app is used.
• Sentry — Error monitoring, so we can find and fix crashes.
• Resend — Delivery of transactional emails (account verification, password reset).

7. Cookies

We keep cookies to a minimum. Essential ones are always active; analytics cookies are set only if you accept them:

• Authentication cookies — To keep you logged in securely
• Locale cookie — To remember your language preference (EN/PL)
• Consent cookie — Remembers whether you accepted or refused analytics (essential)
• Analytics cookies — Set only after you accept. If you refuse, we switch to a cookieless mode that stores nothing on your device. Session recording runs on our public marketing pages only, never inside the app.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within a reasonable timeframe, except where we are required by law to retain certain records (e.g., invoices for tax purposes under German tax law). Business data entered by you (client records, appointments, invoices) is stored for the duration of your account and deleted upon account closure, subject to legal retention requirements.

9. Your Rights Under GDPR

As an EU/EEA resident, you have the following rights regarding your personal data:

• Right of access — Request a copy of all personal data we hold about you
• Right to rectification — Request correction of inaccurate data
• Right to erasure — Request deletion of your data ("right to be forgotten")
• Right to restrict processing — Request that we limit how we use your data
• Right to data portability — Receive your data in a machine-readable format
• Right to object — Object to processing based on legitimate interests

To exercise any of these rights, contact us at info@plwebsites.de. You also have the right to lodge a complaint with your local data protection authority.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including: encrypted data transmission (HTTPS/TLS), password hashing using bcrypt, JWT-based authentication with HTTP-only cookies, role-based access control, regular security updates, and cloud infrastructure with enterprise-grade security.

11. Children's Privacy

Clienteka is not intended for use by children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated policy will be posted on this page with a revised date. Continued use of Clienteka after changes constitutes acceptance of the updated policy.

13. Contact Us