Privacy Policy

1. Data Controller

Kristaps Mudurs (hereinafter — "we" or "RINDIQ"), Jelgava, Latvia. Contact email: [email protected].

We are the data controller with respect to platform users' data (business owners and staff members). With respect to business clients' data, we act as a data processor — your business is the data controller.

By registering an account or starting onboarding, you confirm that you have read this Privacy Policy and understand how we process your data. How we contact you, and how to opt out of marketing contact, is set out in Section 14.

2. What Data We Collect

2.1. Business Owners and Staff Members

• First name, last name, email address
• Password (securely encrypted with bcrypt)
• Google account ID (if using Google authentication)
• Business information: name, address, phone number, logo, photo gallery
• Login times and IP addresses (for system security)

2.2. Business Clients

• First name, email address, phone number
• Booking history
• Reliability score (visit statistics)
• Client notes (entered by business staff members)

3. Purposes & Legal Basis for Processing

4. Data Storage & Security

• All data is securely stored within the EU (Garmtech, Latvia)
• Passwords are encrypted with bcrypt (never stored in plain text)
• All data transmission occurs over secure HTTPS/TLS connections
• Access to data is strictly limited by role (administrator, staff member, client)
• Each business can only see its own data (complete data isolation)

5. Data Retention

• Account data: while the account is active, plus 90 days after deletion
• Booking history: while the business account is active
• Audit log records: 2 years
• Login logs: 90 days

6. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Access — request information about your processed data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request restriction of data processing
• Portability — receive your data in a structured, machine-readable format (CSV export)
• Objection — object to certain types of data processing
• Withdraw consent — withdraw consent at any time (e.g., opt out of reminder emails). Withdrawal does not affect the lawfulness of processing carried out before withdrawal
• Lodge a complaint — file a complaint with the supervisory authority. In Latvia this is the Data State Inspectorate (Datu valsts inspekcija, Elijas iela 17, Riga LV-1050, email: [email protected]). You may also lodge a complaint with the supervisory authority in your country of residence

To exercise your rights, please contact us: [email protected]. We will respond within 30 days.

7. Cookies

We only use functionally necessary cookies to ensure the platform operates correctly:

• session — maintains a secure login session for businesses and staff members
• client_session — maintains a secure client session (e.g., when logging in with Google)
• admin_location_id — remembers your selected active location
• lang — remembers your selected interface language (LV or EN)
• rindiq_lr_* — fraud-prevention cookie (scoped per business, one cookie per business). Set only when your reliability rating at that business is below the threshold and the business has enabled the prepayment requirement. Purpose: prevent threshold evasion by switching email addresses on the same device. The cookie contains a cryptographically signed token with the email address that triggered the requirement and expires after 30 days or once a successful prepayment is completed. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — prevention of fraud and financial loss to the business
• Cloudflare Turnstile — sign-up forms use Cloudflare's security check (a CAPTCHA alternative), which may set short-lived cookies for bot protection. These cookies are strictly necessary for security and are not used for tracking

We do not use analytics or marketing cookies. No third-party tracking tools are embedded in the platform.

8. Third-Party Services

• Resend (email delivery) — data processor
• Google OAuth (login) — used for authentication only (profile email and name)
• Google Calendar API (optional calendar sync) — only when a business user turns it on in settings. The sync is one-way: RINDIQ creates, updates and deletes the calendar events that correspond to bookings. An event records the service name, specialist name, client name and phone, room and appointment time. We do not read or analyse the user's existing calendar events. Access can be revoked at any time from settings (“Disconnect Google”) or from the user's Google Account security page.
• Stripe (payment processing) — direct connection between the business and Stripe; all client payments are held in the business's own Stripe account, not in a RINDIQ account; we do not store card data and we are not a contractual party to the transaction between the client and the business
• Twilio Inc. (USA) — SMS reminder delivery. We send only the phone number, business name, and appointment time. The message log is retained for 12 months. SMS and email reminder consent is unified — you can opt out at any time by contacting the business or following the link in the email.
• Garmtech (hosting) — servers located in Latvia, EU, fully GDPR compliant

RINDIQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it to third parties, and do not use it to train AI models.

9. International Data Transfers

Most data processing takes place within the European Union (Garmtech servers in Latvia). However, some sub-processors (Resend, Stripe, Google, Twilio) are located in or process data outside the European Economic Area (primarily the United States).

For such transfers, we apply safeguards under Chapter V of the GDPR:

• European Commission-approved Standard Contractual Clauses (SCCs) with each non-EU sub-processor
• The EU–U.S. Data Privacy Framework where applicable (e.g., Google LLC is certified)
• Technical safeguards: TLS encryption in transit, encrypted storage at rest

A complete list of sub-processors and their locations is available in our Data Processing Agreement.

10. Automated Decision-Making (GDPR Article 22)

The platform uses automated processing to calculate a client reliability score— the ratio between attended and missed appointments. This score may affect a client's future booking experience at the specific business.

Logic involved

The score is calculated as: completed appointments divided by total appointments, multiplied by 100. The calculation includes only late cancellations (less than 24 hours before the appointment, or the deadline set by the business) and no-shows. On-time cancellations and business-initiated cancellations do not affect the score.

Possible consequences

If the reliability score falls below the threshold set by the business, the business may:

• Require mandatory prepayment before confirming a booking
• Require manual booking approval (a real person decides, not an automated process)
• Decline the booking (at the business's discretion)

Your rights

You have the following rights under Article 22(3) of the GDPR:

• Request human intervention (contact the business directly — manual approval is itself a human-intervention mechanism)
• Express your point of view and contest the decision
• Request an explanation of how the specific decision was reached

The reliability score is not visible to the client, affects only the experience at the specific business, and does not involve cross-business profiling. Each business can enable or disable the feature independently.

11. Source of Personal Data (GDPR Article 14)

We primarily receive client personal data directly from the client (when the client makes a booking through the public booking page).

In some cases, however, client personal data may enter our system from the business (rather than from the client directly), for example:

• Manual bookings created by business staff on behalf of a client (e.g., phone bookings)
• Client list imports from CSV (when the business migrates from another booking tool or a paper notebook)
• Client notes added by business staff to a client profile

In such cases, the business(as the data controller) is responsible for the existence of a legal basis and for informing the data subject. RINDIQ, as data processor, relies on the business's representation that it is entitled to provide the data for processing.

12. Data Breach Notification

In the event of a personal data breach, we commit to:

• Notify the affected business (data controller) without undue delay and no later than 72 hours after becoming aware of the breach (GDPR Article 33)
• Provide the business with all information needed to assess the breach and to file a notification with the Data State Inspectorate
• In high-risk cases, support direct notification to data subjects (GDPR Article 34)
• Take the necessary steps to mitigate the breach and limit its impact

13. Data Protection Officer (DPO)

Given the scale and nature of our service (we do not process special categories of personal data within the meaning of Article 9 of the GDPR, and we do not carry out large-scale systematic monitoring), we have not formally appointed a Data Protection Officer under Article 37 of the GDPR.

All data protection, data subject rights, and GDPR compliance matters are personally handled by:

Kristaps Mudurs — RINDIQ data controller
Email: [email protected]

14. Contacting You and Marketing

14.1. Contact with businesses (platform users)

We use the contact details you provide during registration and onboarding — your email address, phone number and business contact details — to contact you by email, phone, SMS or another messaging channel, as well as through in-platform notifications and push notifications in the mobile app.

You may object to marketing communications at any time (GDPR Article 21) — using the link at the bottom of the email, replying to an SMS, telling us during a phone call, or writing to [email protected]. Your opt-out is recorded on your account and applies across all channels. Account and service notifications continue for as long as the account is active. For details, see Section 21 of the Terms of Service.

14.2. Contact with business clients

• Booking confirmations and reminders (transactional emails and SMS) — sent on a contractual / legitimate interest basis; you can opt out by contacting the business
• Win-back emails — sent only if the client has consented to reminders. Every message contains a clear unsubscribe link

We do not send marketing on behalf of third parties, and we do not sell your contact data.

15. Contact Information

If you have questions about how we process your personal data, please contact us:

Email: [email protected]