1. Who is responsible
The controller for data relating to businesses, Sutempo account users and website visitors is the publisher of Sutempo (Lorenzo Mira Mateo, in a personal capacity, company being incorporated). For any question about personal data, contact: contact@sutempo.com.
For the data of end customers (people booking with a business), the business is the controller and Sutempo acts as processor, under thedata processing agreement. If you are a customer of a business using Sutempo, first address your requests to that business; we assist it in responding.
2. The data we process
Accounts and businesses
- Identity and contact: name, email address, Google or Apple identifier if you choose that sign-in method (we receive neither your password nor access to your Google or Apple account beyond your identity).
- Business: business name, locations, opening hours, services, prices, team, published text and images, settings.
- Sign-in: session tokens, IP address and browser at sign-in, one-time codes (stored as hashes), configuration change log.
- Payment: your connected Stripe account identifier and status. Sutempo stores no card numbers or bank details. Subscription billing uses Stripe.
End customers (on behalf of the business)
- Identity and contact: name, email, phone if requested by the business, language.
- Appointments: services, dates, location, practitioner, status, notes left when booking, attendance history.
- Payments: amounts, deposits, refunds and Stripe references (never card numbers).
- Consents and preferences: marketing consent, email unsubscription, opting out of review requests.
- Customer portal: access tokens, emails sent and their delivery status.
Website visitors
The public website (home, pricing, legal pages) sets no cookies and includes no audience measurement tool. The hosting provider keeps technical logs (IP address, requested page, timestamp) for security purposes.
3. Purposes and lawful bases
| Purpose | Data | Lawful basis |
|---|---|---|
| Providing the Service: account, calendar, booking page, appointment emails, customer portal | Account, business, end customers, appointments | Performance of the contract (business); business’s instructions (end customers) |
| Online payments into the business’s Stripe account | Amounts, payment references | Performance of the contract; business’s instructions |
| Security: sessions, abuse detection, rate limiting of attempts, audit log | Sign-in, IP, log | Legitimate interest (securing the Service); legal obligation |
| Subscription billing and accounting | Identity, invoices | Performance of the contract; legal obligation |
| Support and Service communications (price changes, incidents, updates) | Email, content of correspondence | Performance of the contract; legitimate interest |
| Review requests and communications from businesses to their customers | Customer email, appointment | Consent or legitimate interest, assessed by the business; one-click unsubscribe |
| Improving the Service | Aggregated, anonymised statistics | Legitimate interest |
We carry out no profiling, no automated decision-making producing legal effects, and no sale of data.
4. Retention periods
| Data | Retention period |
|---|---|
| Business account and business data | For the lifetime of the account, then immediate deletion at the business’s request (see section 7); otherwise, 12 months after the last sign-in, following two email reminders |
| End customers, appointments, notes | According to the business’s instructions; deleted or anonymised at its request, and in any event with the business |
| Sign-in codes, invitations, appointment management links | Codes: 10 minutes; invitations: 7 days; management links sent with an appointment confirmation: until a few days after the appointment, then purged |
| Sessions | Up to 7 days of inactivity |
| Configuration change audit log | Limited period, without customer content once their data has been erased |
| Sent email log (recipient, status) | Limited period, deleted with the business |
| Invoices and accounting records | 10 years (legal obligation) |
| Hosting provider’s technical logs | Limited period set by the hosting provider, without customer content |
| Database backups | Limited period, overwritten through rotation; deleted data disappears from backups at the next rotation |
5. Subprocessors and recipients
Your data is accessible only to people who need it to operate the Service, and to the following providers, bound by contracts and confidentiality commitments:
| Subprocessor | Registered office | Role | Location and safeguards |
|---|---|---|---|
| Vercel Inc. | 340 S Lemon Ave #4133, Walnut, CA 91789, United States | Hosting the application and pages, code execution, technical logs | European Union (Frankfurt region) for execution; transfers governed by the Data Privacy Framework and standard contractual clauses |
| Neon Inc. | 2261 Market Street #4459, San Francisco, CA 94114, United States | PostgreSQL database: all application data, encrypted at rest, backups | European Union (Frankfurt region, eu-central-1); standard contractual clauses |
| Stripe Payments Europe, Ltd. | 1 Grand Canal Street Lower, Dublin 2, Ireland | Customers’ online payments into the business’s Stripe account (Stripe Connect), refund management; Sutempo subscription billing | European Union; Stripe also acts as controller for its own obligations (fraud prevention, KYC) |
| Resend Inc. | 2261 Market Street #5039, San Francisco, CA 94114, United States | Sending emails: sign-in codes, confirmations, reminders, thank-you messages, review requests | United States; standard contractual clauses |
| Google LLC / Google Ireland Ltd. | Gordon House, Barrow Street, Dublin 4, Ireland | Sign in with Google (at the user’s choice), Google Calendar synchronisation (enabled by the business), Google Maps map on the business’s public page (loaded at the visitor’s request), Google Fonts chosen by the business on booking surfaces and in administration | European Union and United States; Data Privacy Framework |
| Apple Inc. | One Apple Park Way, Cupertino, CA 95014, United States | Sign in with Apple (at the user’s choice) | United States; Data Privacy Framework |
Transfers outside the European Union rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission’s standard contractual clauses, supplemented by technical measures (encryption in transit and at rest).
We may disclose data to an authority where required by law, informing you unless legally prohibited.
6. Your rights
You have rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time. For your account and business data, most rights can be exercised directly in the administration area: editing information, exporting customers as CSV, deleting the business.
For other requests, write to contact@sutempo.com and provide the email address on your account. We respond within one month, extendable by two months for complex requests. We may request proportionate identity verification.
You may lodge a complaint with the supervisory authority: the CNIL (Commission nationale de l’informatique et des libertés, cnil.fr).
If you are a customer of a business, that business is your point of contact. Your customer portal opens with a Sutempo account (Google, Apple or email code); booking does not require one, and an appointment confirmation email contains a link to manage that appointment alone without an account. From your customer portal, you can view and reschedule appointments and unsubscribe from emails and review requests. The business can erase your personal data from its workspace: it is then replaced with anonymous values throughout the database, including logs and delivery history.
7. Deleting a business and account
A business owner deletes their business under Settings, Account and security, Delete this business, entering its exact name to confirm. The business’s Sutempo subscription is first cancelled immediately at Stripe without a refund for the current period, and the corresponding billing details are erased there. Deletion then takes place immediately, in a single transaction, and covers:
- the public page and its content (text, referenced images, translations);
- the calendar: locations, team, rooms and equipment, schedules, closures, blocked times;
- the catalogue: services, categories, group classes, packs and credits;
- customers: records, contact details, consents, notes, tags, access tokens and customer accounts;
- appointments and their history, class places, review requests;
- payment, deposit and refund history as recorded by Sutempo (the data remains at Stripe, in the business’s account, under Stripe’s terms);
- email settings and logs, Google Calendar connections and synchronised events;
- the Stripe connection, booking rules, modules and their settings.
Access keys used only for that business are revoked and accounts with no remaining business are detached. The sign-in account (email, Google or Apple) remains, allowing access to other businesses or a customer portal.
That sign-in account can then be deleted under My account, Delete my account, by entering its email address to confirm, once it no longer owns any business. The following are erased: email address and name, sessions, associated Google or Apple connections, access to team workspaces and pending sign-in codes. Appointments made as a customer remain in each business’s customer records, for which that business is responsible: erasure must be requested from the business. To prevent the same owner from taking repeated free trials, a fingerprint (SHA-256 hash) of the email address is retained, without any other contact data.
What remains: invoices and accounting records for the statutory period, an audit log without customer content recording the deletion, and copies in backups until overwritten within 7 days. This action is irreversible; first export anything you need to retain.
8. Security
Encryption in transit (TLS) and at rest, secrets and access keys encrypted in the database, hashed one-time sign-in codes, time-limited HttpOnly sessions, strict content security policy on all pages, data isolation by business checked on every request, sign-in rate limiting and configuration change audit log. Our team’s access is individually assigned and limited to what is strictly necessary.
In the event of a data breach posing a risk to your rights, we inform you within GDPR time limits and, when acting as processor, notify the business without undue delay.
10. Minors
The Service is intended for professionals. A business serving minors remains responsible for the conditions under which it collects their data.
11. Changes to this policy
We update this policy when the Service or our providers change. The update date appears at the top of the page; any material change is notified by email.