Apúntalo privacy policy

1. Controller

The owner of Apúntalo and controller for the own processing described in this policy is Víctor de Vierna Valcarce, NIF 71457636V, C/ Embalse La Tabla N1, Jiménez de Jamuz, 24767 León, Spain.

Contact email: [email protected]. Full identifying details are also shown in the legal notice.

2. Who this policy applies to

It applies to website visitors, businesses that create an account or subscribe to Apúntalo, their team members, final clients whose data is managed for appointments and people who contact Apúntalo.

3. When Apúntalo is controller and when it is processor

As controller, Apúntalo decides the purposes and means needed to manage the website, signups, accounts, billing, payments, support, security, own communications and minimal analytics.

As processor, when a business uses Apúntalo to manage appointments, final clients, reminders, bookings, calendars, staff or integrations, we process the data on behalf of that business and under its instructions.

4. Personal data we may process

• Contact and identification data.
• Business data, services, opening hours, team and calendar settings.
• Internal user or staff data.
• Final client data, appointments, services and operational notes.
• WhatsApp/SMS communication data, confirmations, errors and required metadata.
• Payment, billing, device, log, security and activated integration data.

5. Purposes and legal bases

We use data to create and manage accounts, calendars, bookings, reminders, operational communications, support, billing, abuse prevention, security, permitted analytics and voluntary integrations.

Legal bases may include contract performance, pre-contractual steps, legal obligations, legitimate interest, consent or the instructions of the business acting as controller.

6. Final client data of businesses

If you are a client of a business using Apúntalo, that business is usually the controller of your data. Apúntalo acts as a technology provider and will assist the business when needed.

7. Google Calendar and Contacts data

Google integrations are optional, disabled by default and Apúntalo can be used without connecting them. When enabled, we use Google data only to provide the selected feature, in accordance with the Google API Services User Data Policy and its Limited Use requirements.

Google Calendar (https://www.googleapis.com/auth/calendar) allows us to create, update and delete the calendar and events related to synchronised appointments. When it is disconnected, Apúntalo may delete the calendar created for that synchronisation.

Manual contact import (https://www.googleapis.com/auth/contacts.readonly) allows users to view and select contacts for use in Apúntalo. We do not automatically copy the entire address book.

Google Contacts synchronisation (https://www.googleapis.com/auth/contacts) can only be enabled, changed or disconnected by the business owner or by an administrator explicitly authorised by the owner. It is limited to customers already managed in Apúntalo: names are synchronised in both directions and phone numbers only from Apúntalo to Google. It does not import other contacts or synchronise emails, notes, birthdays or deletions. The connection belongs to the business; customer changes made by its authorised users may be synchronised even if they cannot configure the integration.

To maintain these integrations, we securely store OAuth credentials, the connected account email, calendar, event or contact identifiers and technical synchronisation state. Disconnecting Contacts synchronisation removes the local credential and stops it without deleting contacts or groups already held in Google. Access can also be revoked through the Google account. We do not sell this data, use it for advertising or train general-purpose artificial intelligence models with it, and only share it when required to provide or protect the service or comply with the law.

8. Health, wellbeing and possible sensitive data

Apúntalo may be used by businesses where an appointment, service or note may reveal sensitive information. The business must assess the legal basis, inform its clients and limit data to what is necessary.

9. Analytics, cookies and events

We may use cookies or similar technologies to measure visits, performance and basic conversions. The cookie policy explains this in more detail.

In-product external analytics are limited to permitted events without personal data; internal logs may contain operational information needed to diagnose issues.

10. Providers and subprocessors

Apúntalo may rely on Google Cloud, Firebase, Meta / WhatsApp Business Platform, SMS providers when applicable, Stripe, Paycomet, Google Calendar, Google Contacts, Gmail, Google Workspace and monitoring, support or automation tools when needed and documented.

11. International transfers

Where providers are outside the European Economic Area or access from third countries exists, we will apply the mechanisms required by data protection law, such as adequacy decisions, standard contractual clauses or valid safeguards.

12. Retention

We keep data for as long as needed to provide the service, meet legal obligations, handle liabilities and maintain security. Backups and logs have limited retention according to their purpose.

13. Security

We apply technical and organisational measures aimed at confidentiality, integrity, availability and resilience: access control, separation by business, encryption in transit, secrets management, backups, technical logs, provider review and incident response.

14. Rights

You may exercise rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent by writing to [email protected]. If the request concerns data processed on behalf of a business, it may need to be handled through that business.

15. Minors

Apúntalo is aimed at businesses and professionals. If a business enters minors’ data in its calendar, it is responsible for having a valid legal basis and meeting its information duties.

16. Changes to this policy

We may update this policy to reflect legal, technical or operational changes. Relevant changes will be published on this page with the updated date.