Data,
clearly.

Who is the data controller

IWI is a SaaS platform for salons — appointments, staff, services, and customer-facing booking. IWI is the data controller.

For any privacy question or request, contact hello@iwiapp.com.

Once IWI is formally registered, the registered company name and company number will be added here.

What we collect, and why

Account data (salon owner / staff): email + Google profile basics, set when you sign in with Google. Legal basis: contract — required to give you an account.

Salon configuration: business name, opening hours, services, prices, staff list. Legal basis: contract.

Booking data (created by guests of your salon): name, phone, email, optional notes, the chosen service, date, time, and assigned staff member. Legal basis: contract — required to confirm and remember the appointment.

Google Calendar identifiers: only the access scopes needed to write your salon's booking events to your own calendar. We do not read events that we did not create. Legal basis: consent (you choose to connect).

Payment metadata (when subscriptions go live): Stripe customer ID, subscription ID, connected-account ID. The actual card number is handled by Stripe and never touches our servers. Legal basis: contract.

Operational logs: standard server-side logs (timestamp, request path, IP address, user-agent) maintained by our backend for security and debugging. Legal basis: legitimate interest.

Google Calendar

Connecting Google Calendar is optional. If you connect it, IWI uses the access exclusively to create, update, and delete the booking events tied to your IWI account.

We do not read existing events on your calendar. We do not access contacts, Drive, Gmail, or any other Google service.

You can disconnect at any time from your IWI settings, or revoke access from your Google Account → Security → Third-party apps with account access.

04 · Payments

Payments are processed by Stripe. Card details are entered directly into Stripe's secure payment form and never reach our servers — we do not see, store, or process card numbers.

We keep only the technical identifiers Stripe issues (such as a customer or subscription reference) so we can look up and manage your subscription on your behalf.

05 · Sub-processors

Authentication and database infrastructure — a managed cloud provider.

Payments — Stripe; processing may involve international transfers protected by applicable contractual and data-protection safeguards.

Calendar integration — Google LLC, only when you choose to connect it; international transfers are protected by applicable data-protection safeguards.

For an up-to-date list of all sub-processors and service details, contact hello@iwiapp.com.

06 · Security

All traffic between your browser and our service uses HTTPS only. Sensitive credentials, such as third-party access tokens, are encrypted at rest before being stored. Authentication is delegated to a trusted identity provider — IWI never sees or stores passwords. Card data is delegated entirely to Stripe; IWI never handles card numbers.

07 · Cookies and tracking

IWI does not use third-party analytics, advertising pixels, or marketing trackers. We don't set cookies for tracking.

We use the browser's localStorage only for non-tracking preferences: your selected language and small UI flags (e.g. "I have already seen this tooltip"). You can clear these from your browser at any time.

How long we keep things

Booking records: 7 years, in line with applicable accounting and record-retention requirements.

Account data: kept while your subscription is active, deleted within 30 days after cancellation or deletion request.

Google Calendar OAuth tokens: kept until you disconnect, or after 90 days of complete inactivity.

Server logs (IP, user-agent, request path): up to 30 days, then deleted.

Your rights under GDPR

You can request: access to your data, rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent at any time.

Send any of these requests to hello@iwiapp.com. We respond within 30 days.

If you believe your rights are not respected, you have the right to lodge a complaint with the relevant data-protection supervisory authority.

10 · No automated decision-making

IWI does not make automated decisions about you with legal or similarly significant effect, and does not profile users.

11 · Changes to this policy

If we change anything material — new sub-processor, new data category, new retention period — we update this page and bump the "Last updated" date at the top. Active customers receive an email notification before the change takes effect.

Contact

hello@iwiapp.com.