Privacy Policy

1.Who is responsible for your data

The controller of your personal data is [Company name], registration number [Registration number], registered at [Address]. The platform is available at [Domain]. For anything about your data, write to [Contact email].

The salon you book with receives part of your data (see below) and processes it for its own calendar as an independent controller.

2.What we collect

We only collect what is needed for a booking to happen and for you to get a confirmation and a reminder.

• Account: email, name, phone and preferred language. Sign-in is passwordless, by email link or Google account (from Google we receive your email and name).
• Pets: name, species, breed, weight, birth date, notes and a photo, if you choose to add them.
• Bookings: salon, groomer, selected services, time, price and your note to the salon. With every booking we store your name, phone and pet details as they were at the time, so the history stays accurate even if you change them later.
• Availability searches: which salon, which services, which dates and whether free slots were found. If you are signed in, the search is linked to your account.
• For salons and groomers: salon details (name, address, phone, email, photos, opening hours, price list) and every calendar entry, including customers the salon enters by hand.
• Technical data: IP address, browser and device type, a session cookie for sign-in, your cookie choices and server logs kept for security.

3.Why, and on what legal basis

We process your data on the following bases under the General Data Protection Regulation (GDPR):

• Performance of a contract (Art. 6(1)(b)): to create your account, make the booking, pass it to the salon and send you a confirmation and a reminder by email.
• Legitimate interest (Art. 6(1)(f)): security and abuse prevention, keeping the service running, and aggregate statistics from real bookings (for example how many bookings flow through the platform) in which you are not identified.
• Consent (Art. 6(1)(a)): for optional cookies and third-party services such as anonymous analytics and Google Maps. You can withdraw it at any time.
• Legal obligation (Art. 6(1)(c)): where the law requires us to keep or disclose certain data.

4.Who we share data with

We do not sell your data and do not hand it to third parties for advertising. We share it only with:

• The salon you book with: your name, phone, pet details and your note, so they can welcome you and reach you if needed.
• Supabase (database, sign-in and file storage), hosted in the European Union.
• Vercel (website hosting).
• Resend (sending confirmation, reminder and invitation emails).
• PostHog (anonymous product analytics), EU servers. Loaded only after you consent and never receives your name, email or phone.
• Google Maps (map display and address suggestions). Loaded only after consent; Google may receive your IP address and set its own cookies.
• Sentry (technical error reporting), EU servers. Receives technical details about the error, not the content of your bookings.

5.How long we keep data

Your account, pets and bookings are kept for as long as you have an account. If you delete it, your pets and profile are removed immediately.

Bookings remain in the salon's history but are anonymised: we remove your name, phone and notes and unlink them from your account. The salon only sees that an appointment took place, not who it was.

Availability searches are unlinked from your account on deletion. Server logs are kept for up to 30 days. Sent emails are retained by our email provider for a limited period under its own rules.

6.Your rights

At any time you can:

• View and change your data in your account settings.
• Delete your account yourself, from Account → Delete account. No need to write to us.
• Ask for a copy of your data, restriction of processing or object to it by writing to [Contact email].
• Withdraw consent for optional cookies via the Cookies link at the bottom of every page.
• Lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg.

7.Cookies

We use two kinds of cookies. Essential cookies keep you signed in and remember your cookie choice; the platform does not work without them. Optional ones are enabled only after you agree: anonymous analytics (PostHog) and Google Maps.

We ask on your first visit. You can change your choice at any time via the Cookies link at the bottom of the page.

8.Children

Grumi is for people aged 14 and over. We do not knowingly collect data from younger children; if we learn that we have, we will delete it.

9.Security

Your connection to the platform is encrypted. Access to data is restricted at the database level, so every customer, salon and groomer sees only their own. We do not store passwords, because there are none.

10.Changes to this policy

If we change anything material, we will let you know by email or with a visible notice in the platform before the change takes effect. The date of the last change is always shown at the top of this page.

11.Contact

[Company name], registration number [Registration number], [Address]. Email: [Contact email].