Privacy Policy

1. Who is the data controller

The controller of your personal data is AappFlow LLC, the company that operates the Direct Services platform. For any questions regarding data processing you can contact us at [email protected].

When you book an appointment with a specific business through our platform, that business becomes a separate controller of the data it needs to provide the service to you.

2. What data we collect

We collect only the data we need to enable appointment booking and operate the platform:

• Customer account data: first name, last name, phone number and/or email address.
• Security data: your password in encrypted (hashed) form and, if you enable them, passkeys used for sign-in.
• Photos: profile picture and any other photos you choose to upload.
• Booking data: the selected service, time slot, business, staff member and any notes you enter.
• Owner and business data: business name, address and location, contact details, working hours, list of services and prices, team members and their details, and business photos.
• Technical data: IP address, device and browser type, language and settings, collected for security and correct operation of the platform.
• Cookie data: described in the cookies section below.
• Usage data: pages visited and interactions. With analytics consent, a session recording of the screen (form input text is masked).

3. Purposes and legal basis of processing

We process your data for the following purposes:

• Providing the service: creating and managing your account, displaying businesses and time slots, and creating and managing bookings (performance of a contract).
• Booking notifications: sending SMS and email messages confirming, changing, reminding about, or cancelling appointments (performance of a contract and our legitimate interest).
• Authentication and security: sign-in, account protection and abuse prevention (legitimate interest).
• Customer support: responding to your questions and requests.
• Legal obligations: complying with applicable laws.
• Analytics and session recordings: understanding how the platform is used so we can improve it, including replaying consented sessions with form fields masked (consent).

4. SMS and email notifications

For booking to work, we send you transactional notifications by SMS and/or email — for example a booking confirmation, a reminder for an upcoming appointment, and notices about changes or cancellations.

These notifications are a necessary part of the booking service and are not marketing messages. To send SMS and email we use trusted communication providers, to whom we forward only the data needed to deliver the message (for example your phone number or email address and the content of the notification).

5. Who we share data with

We do not sell your data. We share it only to the extent necessary:

• With the business you book an appointment with, so it can provide the service to you.
• With technical service providers (processors): SMS and email delivery providers, hosting and data storage, and PostHog (hosted in the EU) for product analytics and session recordings after you accept analytics, who process data solely on our instructions.
• With competent authorities where required by law or to protect our rights.

6. Cookies and similar technologies

We use necessary cookies and local storage so the platform works correctly — for example to remember your language, theme (light/dark), selected currency, and to keep you securely signed in.

Optional analytics cookies and session recordings (PostHog, Google Analytics) run only after you accept analytics. Details, including how to change your choice, are in the Cookie Policy.

These necessary cookies are essential for the platform to function. You can control cookie settings in your browser, but disabling them may affect certain features.

7. How long we keep data

We keep your data while your account is active and for as long as needed for the purposes described in this policy or as required by law.

After you delete your account, we delete or anonymize your personal data, except data we are required to retain under applicable regulations.

8. Data security

We apply appropriate technical and organizational measures, including password hashing and encrypted connections, to protect your data against unauthorized access, loss or misuse. No system is completely secure, but we continuously work to improve protection.

9. Your rights

Under applicable data protection law you have the following rights:

• The right to access your data and information about how it is processed.
• The right to rectify inaccurate or incomplete data.
• The right to erasure ("right to be forgotten").
• The right to restrict processing and the right to object.
• The right to data portability.
• The right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection.

10. Children's privacy

The platform is not intended for persons under 16 years of age. We do not knowingly collect data about children. If you believe a child has provided us with their data, please contact us so we can remove it.

11. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes on the platform or via the contact details you provided. The date of the last update is shown at the top of the page.

12. Contact

For any privacy questions or to exercise your rights, contact us at [email protected].