Privacy Policy

1. Who we are

The controller of the personal data described in this policy is CODEVO, obrt za računalne i druge usluge, vl. Ivan Babić, Krotovica 16, 10040 Zagreb, Croatia, OIB (Croatian tax ID) 00448210519 (“we”). Appointa is the name of the product; it is provided by CODEVO, which also operates the appointa.hr pages.

For any privacy question, write to [email protected]. We have not appointed a data protection officer because we are not required to.

2. Who this policy covers and who the controller is

• Business users and buyers (owners, managers and staff of salons and other businesses using Appointa, and private persons, companies and sole traders who buy paid plans and SMS packages): we are the controller for account and billing data and for communication with us.
• Clients of a business (people who book appointments): appointment data, contact details, notes, form answers and the invoices the business issues to you are processed on behalf of the business, which is the controller. Send questions and requests about that data to the business; if you contact us, we will forward them. For the data of your user account in the Appointa app (sign-in, profile, favourite businesses, notifications on your device) we are the controller.
• Visitors to appointa.hr.
• Business contacts we approach to offer the service (see section 3).

3. What data we process, why and on what basis

User account. Name, e-mail, phone (if you enter it), your password as a hash (scrypt), Google or Apple sign-in details and two-factor sign-in settings. The purpose is creating the account and signing in; the basis is contract (Art. 6(1)(b) GDPR).

Business and billing. Business name, contact details, opening hours, services and staff; subscription and payment data; billing details: whether you buy as a private person or as a company or sole trader, for a private person the full name, address and country, and for a company or sole trader its name, registered address, country and OIB (Croatia), VAT identification number (other EU countries) or tax number (countries outside the EU) if you enter it, together with the billing e-mail. We do not ask for a private person’s OIB. The buyer’s country is also our proof of the place of supply for tax purposes. You enter your card details directly with Stripe; we never see or store them. We issue and fiscalise invoices in our own system, Codevo Fiskal, on servers in the EU. In doing so we send the Croatian Tax Administration the invoice data (number, date and time, amount, payment method and our OIB), without a private person’s name or e-mail address; for an invoice to a company or sole trader we also send the buyer’s OIB where the law requires it. The purpose is providing and charging for the service and issuing and fiscalising invoices; the basis is contract and legal obligation (Art. 6(1)(b) and (c)).

Proof of acceptance and buyer statements. Which document and version someone accepted, when, from which IP address and with which browser. We record in the same way the choice of “company or sole trader” in the billing details, by which the buyer declares that it is buying for its business, and a consumer’s statement requesting that a subscription or SMS package starts immediately. The purpose is proving the contract and the statements made and establishing and defending legal claims; our interest is being able to prove what was agreed. The basis is legitimate interest (Art. 6(1)(f)).

Withdrawal from the contract (consumers). When you withdraw from a purchase (in the app, on the Withdrawal page, with the form, by e-mail or by post), we record your name, e-mail address, the business and the purchase the withdrawal concerns, the content of the statement, the date and time of receipt and, when you send the statement in the app or on the withdrawal page, the IP address and browser. We send a confirmation of receipt to your e-mail address without delay, and then record the refund. After a purchase we also send a consumer a purchase confirmation by e-mail with their statement, the Terms of Service and the model withdrawal form. The purpose is carrying out the withdrawal, proving that we received and carried it out, and the confirmations we must give a consumer on a durable medium, as required by the Croatian Consumer Protection Act; the basis is legal obligation (Art. 6(1)(c)).

Communication with us. Messages sent by e-mail, through the contact form or through in-app support. Questions you ask the AI assistant are sent to the model provider (Anthropic) to generate the answer; we do not store assistant conversations. The basis is contract or legitimate interest. We enter written complaints in a record of complaints (who made the complaint and when, its content, the confirmation of receipt and our reply), as required by the Croatian Consumer Protection Act; the basis is legal obligation.

Technical records. Request logs (method and path, the signed-in user’s e-mail, a truncated IP address and the browser), error logs and traffic statistics with a truncated IP address. The purpose is security, preventing abuse and fixing errors; the basis is legitimate interest.

Visit statistics. For visit statistics we use Plausible Analytics, which runs on our own server (stats.codevo.hr) in the EU, so visit data does not go to third parties. On all appointa.hr pages, including businesses’ booking pages and the admin area, we record the page visited, the page the visit came from, the type of browser, operating system and device, and the country derived from the IP address. The IP address and browser details are used only to compute an identifier that changes every day, so unique visitors can be counted without cookies. We do not store the IP address, and the key used to compute the identifier is deleted after 24 hours, so the statistics can no longer be linked to you afterwards. The purpose is understanding how Appointa and the pages are used and which content interests visitors; the basis is legitimate interest (Art. 6(1)(f)). We replace record identifiers in page addresses with a generic placeholder and do not record pages whose address carries a secret code (such as links from e-mails and invitations).

Analytics and advertising (only with consent). Once you accept cookies in the banner, Google Analytics 4 loads (on all pages, including businesses’ booking pages and the admin area) and so does the Meta Pixel (on appointa.hr pages and sign-up pages). We then also record where you came from (UTM tags, ad click ID, landing page). For business users who sign up or subscribe, we also send Google and Meta a conversion event with a hash of the e-mail address and user ID. The basis is consent (Art. 6(1)(a)), which you can withdraw at any time (section 4).

Business contacts (sales). We keep data about businesses we approach (name, industry, city, phone, e-mail, owner’s name, data from public registers) and notes of conversations in an internal CRM. We record a call only with the other person’s consent at the start of the call. We turn the recording into text on our own server and send the text to the model provider Anthropic to produce a note. The basis is the legitimate interest of direct marketing to businesses; you can object at any time and we will stop contacting you.

Data of a business’s clients. As a processor for the business we process names, contact details, appointments, notes, form answers (which may include health data), messages, reviews and the invoices the business issues through Appointa, send notifications by e-mail, SMS and push, and deliver invoices to clients in the app or by e-mail. The business determines the purposes and basis; the terms are set out in the Data Processing Agreement.

A business’s invoices to its clients (fiscalisation). A business on the Pro or Premium plan can issue invoices to its clients through Appointa. The invoices are issued and fiscalised by the Codevo Fiskal software, which we also produce and maintain, on servers in the EU. We process the taxpayer details the business enters (OIB, name, address, e-mail) to provide that service; the basis is contract. We process the data on invoices and their fiscalisation (items, amounts, payment method, the name and e-mail of the client the invoice is issued to, and the name and OIB of the employee who issues it) on behalf of the business as its processor, under the Data Processing Agreement and the Terms addendum — fiscalisation. We send the data of every invoice, including the business’s OIB and the OIB of the employee who issues it, to the Croatian Tax Administration because the Fiscalisation Act requires it. Appointa does not store the FINA certificate or its password; the certificate’s private key is kept encrypted in Codevo Fiskal and used only to sign the business’s invoices.

The purchase and invoice details are needed to conclude the contract and issue invoices; without them we cannot sell you a paid plan, extra seats or an SMS package.

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you. The only automatic consequences are those in the contract, such as a business moving to Starter when its subscription ends.

4. Cookies and similar technologies

Necessary cookies always work and need no consent:

• the sign-in session (appointa.session_token, 7 days, extended as you use the service) and two-factor sign-in cookies (10 minutes, or 30 days for “remember this device”);
• your choice in the banner (appointa.consent, 180 days);
• language (NEXT_LOCALE), display theme (appointa.theme, 1 year) and the selected location in the admin area (appointa_location_id, 1 year).

Cookies with consent: Google Analytics (_ga, _ga_*), Meta (_fbp, _fbc) and where you came from (appointa.attribution, 30 days).

Visit statistics (section 3) work without cookies and store nothing on your device, so they need no consent.

You give or refuse consent in the banner, and you can change your choice or withdraw consent at any time via the “Cookie settings” link at the bottom of the page: the banner shows again and you can choose “Decline”. Withdrawal does not affect the lawfulness of processing before it. Choosing “Decline” also deletes the recorded origin from our servers and stops conversion events. You can also delete cookies in your browser.

The mobile apps use no advertising tools. Store builds include Firebase Crashlytics, which sends Google crash reports without a user identifier. The apps load fonts from Google’s servers, so Google sees the device’s IP address when they do.

5. Recipients

We share data only with providers that help us deliver the service, to the extent their task requires:

Recipient	Purpose	Location
Hetzner Online GmbH	Servers, database and backups	EU
Cloudflare, Inc.	DNS, attack protection, forwarding e-mail to [email protected]	Global
Resend	Sending e-mails	USA
Infobip	Sending SMS messages (only if the business uses them)	EU
Google (Firebase Cloud Messaging, Crashlytics, Fonts)	Push notifications, crash reports, fonts in the apps	Global
Apple Inc.	Push notifications on iOS devices, Sign in with Apple	Global
Google (sign-in, Gmail)	Sign in with Google; the [email protected] mailbox	Global
Stripe	Card payments for subscriptions and SMS packages	Global
Anthropic PBC	AI assistant; notes from sales calls	USA
Google (Analytics 4, Ads) and Meta Platforms	Measuring visits and ads, only with consent	Global
YouTube (Google)	Videos on appointa.hr pages; loads only when you start a video, and video thumbnails load from Google’s servers	Global
Croatian Tax Administration	Fiscalisation of our invoices and of the invoices businesses issue through Appointa, a legal obligation	Croatia

We do not sell data and do not use it to train AI models.

6. Transfers outside the EU

Some of these recipients also process data outside the European Economic Area, mainly in the USA. Transfers are based on the European Commission’s adequacy decision (EU–US Data Privacy Framework) for recipients certified under it, and otherwise on the European Commission’s standard contractual clauses. You can ask for a copy of these safeguards at [email protected].

7. How long we keep data

• User account: as long as it exists. When you delete your account in the app, we remove your name, phone and profile picture, sign out all devices and anonymise your data held by businesses. For complete deletion of the remaining data (such as the account e-mail address), write to [email protected]; we complete it within 30 days.
• Invoices and payment records: until 10 years after the end of the year they relate to (up to about 11 years).
• Invoices businesses issue to clients through Appointa: at least 11 years, also after the business turns fiscalisation off or stops using Appointa. Deleting a client’s user account removes only the link between the invoice and that account; the invoice stays in the business’s records.
• Proof of acceptance and buyer statements: for the duration of the contract and 5 years after it ends, or, if a dispute arises, until it is resolved.
• Withdrawal requests: 5 years from the withdrawal; refunds and related invoices are kept like other invoices.
• Complaints: one year from receipt, or, if a dispute arises from the complaint, until it is resolved.
• Other correspondence with us: for the duration of the contract and 5 years after it ends; if you have no contract with us, one year from your last message.
• Request logs and traffic statistics: 90 days (deleted by month, so at most about 120 days). Error logs: 1 year.
• Where you came from (with consent): until you withdraw consent.
• Visit statistics: the key used to count unique visitors for 24 hours; the statistics, which after that cannot be linked to you, for as long as Appointa exists.
• Answers to a business’s forms: deleted automatically 24 months after the appointment.
• Sales call recordings: 30 days from the call; the text and notes until you object or we no longer need them.
• Backups: daily database copies are kept for 21 days and system copies for at most 6 months. Copies of the data in Codevo Fiskal, where invoices are issued and fiscalised, are kept for at most 13 months. An additional copy of files (photos, logos, recordings) is not rotated automatically; we delete data from it on request.

Data we must keep by law is not deleted before the legal period ends, even at your request; until then we only store it and do not use it for other purposes.

8. Your rights

You have the right:

• to access your data and receive a copy;
• to have inaccurate data corrected;
• to erasure, for example when the data is no longer needed, when you withdraw consent or when the processing is unlawful;
• to restriction of processing;
• to data portability for the data we received from you, in a common machine-readable format;
• to object to processing based on legitimate interest;
• to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

We always honour an objection to direct marketing.

Send your request to [email protected], if possible from the e-mail address of your user account. If we cannot confirm that the request is yours, we will ask for further confirmation. We reply without undue delay and at the latest within one month; for complex requests we may extend this by two more months and will tell you so. Exercising your rights is free of charge. For data held by a particular business (appointments, notes, forms), send your request to that business; if you send it to us, we will forward it without delay.

If you believe we process your data in breach of the law, you can lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or with the supervisory authority of the EU member state where you live or work or where the alleged breach took place. You can contact us first and we will try to solve the problem, but you do not have to.

9. Security

We protect data with technical and organisational measures: encrypted traffic (TLS), attack protection through Cloudflare, a firewall and key-only server access, separation of data per business, user roles, password hashing, two-factor sign-in, logs of sensitive actions and regular backups. The full list of measures is in the Data Processing Agreement.

10. Changes to this policy

The version and effective date are shown at the top of the page. We announce material changes by e-mail and in the app before they take effect.