Version: 0.2-tervezet · Dated: 2026-10-02
Privacy Notice
Data processing by the operator of the [PRODUCT NAME] platform (the Operator as controller)
DRAFT for legal review. Version 0.1, 2026-10-02. English translation of Adatkezelési tájékoztató; if the texts differ, the Hungarian text prevails. Not final, not legal advice.
[FOR THE LAWYER: ...]is the English form of the Hungarian[JOGÁSZNAK: ...]marker (open question or missing data); the full list, the assumptions and the statement-to-code table are in the README. The text describes the code state of 2026-10-02 (main a71f768). Where operation is still under development the text says so.
1. The controller
[FOR THE LAWYER: the Operator's company name, registered office, company registration number, tax number, e-mail and postal address. The owner fills these in.] Data protection officer: [FOR THE LAWYER: whether appointment is mandatory; if so, contact details. If not, the data protection contact e-mail.]
2. What this notice covers and what it does not
2.1. What it covers. Personal data that the Operator processes in its own right, as controller, in connection with providing the [PRODUCT NAME] service: the persons who register and run the salon (the Subscriber's representatives, the account owners), billing and contact persons, persons who contact support, and the data of the Operator's platform users (Operator staff).
2.2. What it does not cover. The data of salons' Guests and staff is processed by the Operator on behalf of the salon as processor. That is governed by the salon's own privacy notice and the Operator-salon Data Processing Agreement (Data Processing Agreement). If you are a salon's guest, please turn first to the salon to exercise your rights.
3. The processing activities
Legal bases refer to Article 6(1) GDPR. [FOR THE LAWYER: confirm every legal basis, in particular the balancing test for the legitimate interests under point (f) and the role of Users' (staff) account data.]
| # | Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|---|
| 3.1 | Registration and creating the account | e-mail address, the registrant's name, the salon's name and identifier, the salon's public telephone number, trade, time zone, the one-way (argon2id) hash of the password, the hash of the confirmation link | steps before concluding a contract, performance of a contract (b) | the confirmation link is valid for 24 hours; on confirmation the pending-registration row is deleted. An expired, unconfirmed row is deleted today only if the person tries again; there is no automatic sweep. [FOR THE LAWYER: development task; introducing a sweep] |
| 3.2 | Operating and securing the account | name, e-mail address, telephone number (if provided), role, the hash of the password and PIN, the encrypted form of the two-step verification secret and the hashes of recovery codes, last sign-in time, hashes of session and login-link tokens | performance of a contract (b); protection of the system (f) | while the account exists; sessions are deleted after expiry (staff session: at most 12 hours, expires after 30 minutes of inactivity); hashes of expired login-link tokens are not deleted automatically today [FOR THE LAWYER: development task]; fate of the account after termination: section 5 |
| 3.3 | Performing the service contract | the salon's Plan, state of subscription and its dates (end of trial, state changes), SMS credit movements | performance of a contract (b) | during the contract and afterwards for the accounting retention period where the item is tied to a document; [FOR THE LAWYER: retention period] |
| 3.4 | Invoicing and bookkeeping | the salon's name, the invoice number, period, amount and payment state; billing data (company name, tax number, address, invoice e-mail) once introduced; payment data | legal obligation (c) (accounting and tax rules); performance of a contract (b) | for the period required by law. [FOR THE LAWYER: the exact period and legal source; code comments assume 8 years for accounting documents, this is not a legal opinion.] Today the invoice is made manually with the system's own numbering; registration does not yet ask for customer data |
| 3.5 | Sending system messages | the recipient's e-mail address and name, the content of the message (registration confirmation, password reset, login link; later welcome, trial expiry, invoice, payment reminder, suspension notice) | performance of a contract (b) | rows of the message log are deleted after 365 days by default |
| 3.6 | Support and troubleshooting | the content of the enquiry, the data of the salon and account concerned; for support access the reason, duration, the start of the access and (on exit, sign-out or termination) its end, and the partial log marking of individual operations performed in it (Data Processing Agreement, Annex 2, item 14) | performance of a contract (b); troubleshooting and service security (f) | [FOR THE LAWYER: retention period; the product has no support channel today, so where and how long enquiries are stored is not yet defined] |
| 3.7 | Operational and security logging | who performed what operation and when (log row: actor type and identifier, action, object concerned), Operator (platform) actions and support access, the log of background jobs and backups | legitimate interest (f): service security, accountability, establishing legal claims | there is no automatic deletion rule for the audit log today; [FOR THE LAWYER: retention period] |
| 3.8 | Abuse protection | sign-in and registration attempts, whose IP-bound counters live in process memory (not in the database) | legitimate interest (f) | until the process restarts, at most the window length (minutes); for the hosting and front-proxy logs see section 4 |
| 3.9 | Legal claims, official requests | data needed to establish or defend a legal claim | legitimate interest (f); legal obligation (c) | until the claim is time-barred [FOR THE LAWYER: to be completed] |
| 3.10 | The Operator's platform users (Operator staff) | name, e-mail address, hash of the password, last sign-in, sessions, the log of Operator actions | legitimate interest (f); performance of the employment/engagement contract | during the relationship and afterwards [FOR THE LAWYER: to be completed] |
3.11. Marketing. The Operator does not currently send marketing messages to Subscribers and the product has no function for it. If this changes, separate consent or another suitable legal basis is needed and this notice will be amended. [FOR THE LAWYER: if the Operator later sends a customer newsletter.]
3.12. Cookies and browser storage. The cookies and browser storage set by the platform are listed in the Cookie Policy.
3.13. Sale, advertising use and profiling. The Operator does not sell Subscribers' personal data, does not use it for advertising, and does not build profiles of Subscribers beyond what is needed to perform the contract. [FOR THE LAWYER: the owner decides; to be confirmed. The code has a churn-score module not wired into the product (lib/tenant-health); if it goes live, this point and section 8 must be amended.]
3.14. Signing in with Google. The platform allows staff and guests to sign in with their Google account. Google transmits the following data to the Operator: the e-mail address associated with the Google account, its verification status (email_verified), and the public name on the account. The Operator does NOT store the profile picture. The Operator does NOT store the Google account identifier (sub); sign-in is based solely on the verified e-mail address: staff and guests sign into their existing account, and during registration the Google-verified e-mail address serves as proof of address ownership. The purpose of the processing: identifying the user and enabling sign-in. The legal basis: performance of a contract and steps at the data subject's request (Article 6(1)(b) GDPR). Retention: the data received from Google is NOT stored separately beyond the existing account data (name, e-mail address). Recipient: in the sign-in flow, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) acts as an independent controller; Google's processing is governed by Google's Privacy Policy (https://policies.google.com/privacy). [FOR THE LAWYER: confirm the full scope of data, the legal basis (especially for guests), the retention and Google's status as an independent controller. The non-storage of the Google identifier is a technical decision from which the absence of later account linking follows — the lawyer should assess the legal implications. The text describes the code state of 2026-10-08; the feature is not available to users before the Google Cloud Console go-live.]
4. Recipients, processors and transfers to third countries
4.1. The Operator's processors and recipients. The Operator uses the following providers for its own processing. [FOR THE LAWYER: for every provider the name, registered office, place of processing and whether a data processing agreement exists; the owner fills these in.]
| Service | Purpose | Data | Status |
|---|---|---|---|
| Hosting and infrastructure provider | running the application, database and backups | all data stored in the Operator's system | [FOR THE LAWYER: name, registered office, data-centre location. The repository records only that the application runs on Coolify in a Docker container (docs/05-deploy.md), not the provider.] |
| Outgoing e-mail (SMTP) provider | delivery of system messages | the recipient's e-mail address and name, the message content | [FOR THE LAWYER: choice of provider and sender domain is still open (D1, D11); the guide mentions MXroute as an example, not as a decision] |
| Stripe | card collection of the platform fee | the Subscriber's representative's and billing data, payment data (card data is handled by Stripe, the Operator does not see it) | planned (D4), not integrated in the current wave [FOR THE LAWYER: independent controller or processor] |
| Számlázz.hu | issuing the platform's own invoices | billing data | planned (D5), not integrated in the current wave |
| Accountant, legal and other advisers | bookkeeping, legal representation | billing and contract data needed for the task | [FOR THE LAWYER: identification] |
4.2. Authorities. The Operator transfers data to authorities where required by law.
4.3. Transfers to third countries. [FOR THE LAWYER: which of the providers in 4.1 process data outside the European Economic Area (for example Stripe, the e-mail provider), and on what appropriate safeguard (adequacy decision, standard contractual clauses). The repository does not contain this, and the location of the Operator's hosting is not recorded either.]
4.4. Logs outside the application. The hosting provider's and the front proxy's (Traefik according to the code) own logs may contain IP addresses and request data. [FOR THE LAWYER: the operator fills this in; their retention and configuration is decided on the hosting side, the repository does not record it.]
5. Retention periods and the fate of data after termination
5.1. When the contract ends, the account stays read-only and exportable for 90 days, after which the Operator anonymises or deletes the personal data; invoices and accounting documents and the necessary logs are kept for the period required by law (Terms, clause 8). [FOR THE LAWYER: which data concerning the Subscriber's representatives is kept, for how long and on what basis. Automatic anonymisation is written (lib/tenant-exit/anonymise.ts, anonymiseTenant(), runTenantAnonymisation()); deletedAt is set at the end of anonymisation (anonymise.ts:208).]
5.2. The background job regularly deletes expired sessions and password-reset tokens, as well as expired mobile session tokens.
6. Data security
The Operator protects data with technical and organisational measures appropriate to the risk. In their present state these are: one-way (argon2id) hashes of passwords and PIN codes; session tokens stored only as hashes; the two-step verification secret and third-party service keys stored with AES-256-GCM encryption; separation between Subscribers through application filtering and the database's row-level security (RLS); HSTS and further security headers towards the browser (Content-Security-Policy, Referrer-Policy, X-Content-Type-Options, Permissions-Policy); limiting of sign-in attempts; Operator actions on the platform performed with a stated reason and an audit log. The detailed, verified list is in Annex 2 of the Data Processing Agreement. [FOR THE LAWYER: two-step verification on the Operator side does not exist today; encryption of backups and disk encryption cannot be proven from the repository, so we do not claim them here.]
7. Data subjects' rights
7.1. You are entitled to: request information about the processing of your data and access to it; request rectification; request erasure where the legal conditions are met; request restriction of processing; object to processing based on legitimate interest; request portability where processing is based on contract; withdraw consent at any time where processing is based on consent.
7.2. You may submit your request at the contact given in section 1. The Operator responds substantively within one month at most. [FOR THE LAWYER: method of identification; relation of an erasure request to accounting retention.]
7.3. Remedies. You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or go to court. [FOR THE LAWYER: verify the authority's and court's contact details; for foreign Subscribers, the local supervisory authority.]
8. Automated decision-making
The Operator does not currently use decision-making based on profiling. Some changes in the account's state (switch to the Free plan after the trial, past-due and suspended states) happen automatically by a scheduled background job, on the basis of payment events. [FOR THE LAWYER: whether these steps count as automated decisions with legal effect under Article 22 GDPR; if so, the necessary safeguards and the possibility of human intervention. Lifting a suspension is currently a manual Operator action.]
9. Data of salons' guests
If you are a salon's guest (you booked on the salon's online booking page, or the salon recorded your data), the salon is the controller of your data. The salon's privacy notice tells you how it processes your data, and you can exercise your rights there. The Operator accesses this data only on the salon's behalf, as processor. If such a request reaches the Operator, it forwards it to the salon concerned and does not fulfil it on its own.
10. Amending the notice
The Operator may amend this notice; it notifies the Subscriber in advance of material changes. Earlier versions are available on request. [FOR THE LAWYER: notice period.]
Changelog
- 2026-10-08 — Section 3.14 (Signing in with Google): DRAFT — awaiting lawyer approval.