Privacy policy

1. Overview: Terminy in two roles

Controller (Art. 4 (7) GDPR): we are the controller for data that arises with us directly — visits to this website, cookies, enquiries via the trial form, accounts of salon owners (administrator accounts) and contract and billing data.

Processor (Art. 28 GDPR): we are the processor for the data of the customers of the salons that use our platform — such as appointment bookings, digital loyalty cards and chat messages via WhatsApp or Instagram. The controller of this data is the respective salon; we process it solely on the salon's instructions as a processor within the meaning of Art. 28 GDPR.

If you are a customer of a salon, please contact the salon first with any questions about your data. You can also contact us at any time (info@terminy.net) — we will forward your request to the salon and assist with carrying it out.

2. Controller

Company

Terminy

Data protection requests

info@terminy.net

General contact

info@terminy.net

Further company details can be found in the Imprint.

3. Hosting and infrastructure

The website and the platform run on Google Cloud / Firebase. Our contractual partner is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have deliberately chosen storage locations within the European Union:

• Database (Cloud Firestore): Europe multi-region (eur3)
• Server functions (Cloud Functions): Frankfurt am Main (europe-west3)
• File storage (Cloud Storage): Europe region
• Server-side rendering of the website (Cloud Run): Belgium (europe-west1); static content is delivered via the global content delivery network of Firebase Hosting
• Sign-in and user management (Google Cloud Identity Platform / Firebase Authentication)

When you access the website, technically necessary data (IP address, time, page requested, browser type) is processed in server logs in order to deliver the page and ensure security (Art. 6 (1) (f) GDPR). These logs are generally deleted after no more than 30 days and are not combined with other data.

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, provides DNS resolution for terminy.net and acts as content delivery network and protection against attacks for the salon applications under subdomains of terminy.net and under the salons' own domains; this website itself is not delivered via Cloudflare. When the salon applications are accessed, Cloudflare processes IP addresses and technical connection data. Transfers to the USA are safeguarded by EU standard contractual clauses and Cloudflare's certification under the EU-US Data Privacy Framework.

Transactional emails (e.g. booking confirmations, reminders, acknowledgements of trial requests) are sent via Amazon Simple Email Service (SES) of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, from the Frankfurt am Main region (eu-central-1).

The font of this website is served from our own server; no connection to Google Fonts is established when the page loads. Data processing agreements pursuant to Art. 28 GDPR are in place with all providers named above.

4. Cookies and local storage

This website uses only technically necessary cookies and local storage (language selection, your cookie choice) on the basis of Section 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR. We currently use no analytics or marketing tools. Details of each entry and how to change your choice can be found in our Cookie policy.

5. Contact and trial request

When you submit a request via the “Try for free” form, we process the data you enter there: salon name, contact email address, phone number (optional), city/country, number of locations, your message (optional) and the language you selected.

The purpose is to answer your request and set up a trial account (Art. 6 (1) (b) GDPR — pre-contractual measures). The request is stored in our database in the EU and forwarded by email to our mailbox info@terminy.net; you receive an automatic acknowledgement.

If no contract is concluded, we delete the request no later than 12 months after the last contact. The same applies to requests you send us by email, phone or WhatsApp.

6. Salon accounts, contract and billing

For salons using the Terminy platform we process, as controller: the salon's master data (name, address, locations), administrator account data (name, email address, phone number, login credentials, role, login times), contract and plan data, booked add-on features, billing and payment data (invoices, payment status, bank details for bank transfers) and logs of administrator actions for security and traceability.

The legal bases are performance of the contract (Art. 6 (1) (b) GDPR), statutory retention obligations (Art. 6 (1) (c) GDPR) and our legitimate interest in secure operation and protection against misuse (Art. 6 (1) (f) GDPR).

We store this data for the duration of the contract; invoices and accounting records beyond that for the commercial and tax retention periods (generally 8 to 10 years). After the contract ends, the salon account and all associated customer data are deleted — see Data deletion.

7. Booking and loyalty-card platform for salons (processing on behalf)

Salons use Terminy to run online appointment booking, digital loyalty cards (loyalty points, VIP tiers, vouchers), check-ins, reminders and — where enabled — chat channels with their customers. The controller of this customer data is the respective salon. Terminy processes the data as a processor (Art. 28 GDPR) solely on the salon's instructions.

Categories of data processed (depending on how the salon uses the platform):

• Master data: name, email address, phone number, preferred language, sign-in method
• Booking data: appointment, service, staff member, location, cancellations, no-shows
• Loyalty card: loyalty points, visit history, VIP tier, vouchers, date of birth (for birthday offers)
• Voluntary photos and text where the salon offers AI features such as style advice or price estimation (see AI style advice and price estimation)
• Revenue and visit data per appointment where the salon has connected its point-of-sale software App TT (see Point-of-sale software App TT)
• Chat messages and media via WhatsApp or Instagram (see Meta integration and AI receptionist)
• Technical data (device/browser, timestamps) to the extent required for operation

Technical and organisational measures: strict separation of data per salon (each salon sees only its own data), server-side access rules, encrypted transmission (TLS), encryption at rest at Google Cloud, logging of sensitive operations and automated checks for data mixing between salons.

Retention: as instructed by the salon; at the latest when the salon account is deleted, all associated customer data is deleted. Customers can request deletion of their account from the salon or from us at info@terminy.net (see Data deletion). The sub-processors we use are listed under Recipients and sub-processors.

8. AI style advice and AI price estimation (OpenAI)

Salons can offer further AI features in their loyalty-card app: style advice, for which you voluntarily send photos of your nails and text messages, a price estimate based on a photo, and machine translation of free-text entries (for example the reason for cancelling an appointment) for the salon team.

Provider used: OpenAI, L.L.C. (USA) or OpenAI Ireland Ltd. (Ireland) as contracting entity for the EU (“GPT” models via the OpenAI API). The data transmitted comprises the photos and text you send and the salon's information required for the respective feature (for example services and prices).

Access and OpenAI's role: these features generally run via an OpenAI API key provided by the salon itself; OpenAI is then the salon's processor, but the data is transmitted via our servers in the EU. Where a feature is provided via our own OpenAI access, OpenAI is our sub-processor. In both cases the OpenAI Business Terms including the Data Processing Addendum and EU standard contractual clauses (Art. 46 (2) (c) GDPR) apply. OpenAI does not use data transmitted via the API to train its models and generally retains it for up to 30 days for abuse monitoring. Processing takes place in the USA.

Legal basis and storage: use is voluntary and takes place at your request; the legal basis on the salon's side is Art. 6 (1) (b) GDPR. On our side, the photos and text you send are processed in the EU and deleted at the latest when your customer account is deleted.

9. Meta integration (WhatsApp / Instagram)

Salons can connect their WhatsApp Business account and/or their Instagram account to Terminy so that messages from their customers arrive in Terminy and are answered from there — by the salon team or by the AI receptionist (see next section). The salon sets up the connection itself via Meta's official sign-in flows (WhatsApp Embedded Signup or Instagram Login); Terminy receives an access token limited to that salon.

Data we receive from Meta: phone number (WhatsApp) or Instagram account ID and username, profile name, timestamp, message content (text), images and other media sent, delivery status, and technical identifiers of the message and the account.

Purpose: answering customer enquiries, booking, rescheduling and cancelling appointments via chat, and linking to the salon's loyalty card. The legal basis on the salon's side is generally Art. 6 (1) (b) GDPR (initiation and performance of the service contract) or Art. 6 (1) (f) GDPR (customer communication).

Storage: messages and media are stored in our database and file storage in the EU. The salon's access tokens are stored exclusively server-side in the EU and cannot be retrieved from end devices. We delete chat messages after 180 days and media after 90 days. When the connection is disconnected, the access tokens are deleted immediately.

Meta's role: for WhatsApp, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, acts as the salon's processor within the WhatsApp Business Platform (WhatsApp Business Data Processing Terms). For Instagram direct messages, Meta is an independent controller for processing within the Instagram platform; Meta's privacy policy applies. Which further data WhatsApp or Instagram process about you (e.g. metadata, device information) is determined by Meta; neither the salon nor Terminy has any influence on this.

Terminy does not use the data received via Meta for its own purposes or for advertising and does not pass it on to third parties — except for the processing by Anthropic described in the section AI receptionist, if the salon has enabled the AI receptionist.

10. AI receptionist

Salons can enable the “AI receptionist”: an AI assistant then answers incoming chat messages automatically, provides opening hours and prices, checks available slots and books, reschedules or cancels appointments at the customer's request. The assistant identifies itself as an AI at the start of each conversation. You can ask to speak to a person at the salon at any time — for example by writing so in the conversation; the conversation is then handed over to the salon team.

Provider used: Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA (“Claude” models). The data transmitted to Anthropic comprises the content of the conversation (message text and, where applicable, images sent), the information provided by the salon (services, prices, rules), the customer's name and the appointment data relevant to the request (available times, existing appointments). Contact details such as phone numbers are transmitted only where required for the specific operation.

Contractual basis and data protection: we use Anthropic via its commercial API under the Anthropic Commercial Terms of Service including the Data Processing Addendum and EU standard contractual clauses (Art. 46 (2) (c) GDPR). Anthropic does not use the transmitted data to train its models and generally deletes inputs and outputs within 30 days. Processing by Anthropic takes place in the USA; processing outside the EU cannot currently be ruled out for this service.

Legal basis: the AI receptionist is enabled by the respective salon. The legal basis is Art. 6 (1) (b) GDPR (handling your appointment request) and Art. 6 (1) (f) GDPR (the salon's legitimate interest in responding quickly to enquiries, including outside opening hours). No automated decision with legal effect within the meaning of Art. 22 GDPR takes place; appointments are booked only at your explicit request and can be corrected by the salon team at any time.

Storage: conversations with the AI are stored in the EU like all chat messages (see Meta integration). The salon may add general information about services or rules derived from conversations to its knowledge base; personal notes about individual customers are stored only when initiated by the salon team.

Cost and abuse protection: to limit costs and misuse we record, per salon, the number of AI requests and the computing units (tokens) consumed — without message content. We retain this usage data for billing purposes.

11. Point-of-sale and revenue software App TT (where connected by the salon)

Salons can connect Terminy to the point-of-sale and revenue software “App TT” so that visits checked in via Terminy are recorded automatically in their revenue records. While the connection is active we transmit per visit: the customer's name, the services provided and amounts, redeemed loyalty points or vouchers, the currency, the staff member who performed the service and the location. Phone numbers, email addresses and chat content are not transmitted.

App TT runs in a separate Google Cloud project whose server functions operate in the us-central1 region (Iowa, USA). The transfer is encrypted and safeguarded by the Google Cloud Data Processing Terms, EU standard contractual clauses and Google LLC's certification under the EU-US Data Privacy Framework. The salon remains the controller of the revenue data; it is stored in App TT as instructed by the salon, with revenue records kept for the commercial and tax retention periods.

12. Legal bases at a glance

13. Recipients and sub-processors

Beyond this, we disclose personal data only where we are legally obliged to do so (e.g. to authorities) or where you have consented. No data is disclosed for advertising purposes.

14. Transfers to third countries

The core infrastructure of the Terminy platform (database, server functions, file storage, sign-in) is located in the EU. Transfers to the USA take place with Cloudflare (technical connection data of the salon applications), with Anthropic (AI receptionist, only if enabled by the salon), with OpenAI (AI style advice and price estimation, only if offered by the salon), with the point-of-sale software App TT (only if connected by the salon), via the global CDN of Firebase Hosting (static content of this website) and, where applicable, with Meta in the context of WhatsApp and Instagram. They are safeguarded by EU standard contractual clauses (Art. 46 (2) (c) GDPR) and — where the respective provider is certified — by the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

15. Retention periods

• Server logs: generally up to 30 days
• Trial requests without a contract: up to 12 months after the last contact
• Salon accounts: contract term; invoices and accounting records for the statutory periods (generally 8 to 10 years)
• Salon customer data: as instructed by the salon, at the latest until the salon account is deleted
• Chat messages: 180 days; chat media: 90 days
• Data at Anthropic (AI receptionist): generally up to 30 days
• Data at OpenAI (AI style advice, price estimation): generally up to 30 days
• Revenue data in the point-of-sale software App TT: as instructed by the salon; revenue records for the statutory retention periods
• AI usage data (counters without content): for the duration of the billing retention periods

16. Your rights

Towards the respective controller you have the right to:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, contact info@terminy.net — for data processed by a salon as controller, preferably the salon; we support the salon in fulfilling your request. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular the authority at your place of residence or at the controller's registered office.

How to delete chat conversations, loyalty cards or entire salon accounts is described step by step under Data deletion.

17. Data security

We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access: encrypted transmission (TLS), server-side access rules per salon, execution of sensitive operations only via verified server functions, restriction of access to tokens and keys to the server environment, and regular automated checks of data separation. Our services are not directed at children under 16.

18. Changes to this privacy policy

We update this policy whenever the platform, the service providers used or the legal requirements change. The current version is always available at https://terminy.net/legal/datenschutz; the date at the top of the page shows when it was last updated.