Privacy Policy

Version 1.6 · in force from October 3, 2026

1. Who we are

Piklo Systems, Denmark, company registration number 32709192, is the data controller for the personal data described on this page. You can reach us at privacy@piklobooking.com. Full company details are in the legal notice.

This policy covers the data Piklo decides about. It does not cover the data a salon holds about its own customers: there the salon decides, Piklo only processes on its behalf, and the arrangement is set out in the Data Processing Agreement.

2. The one sentence about the customer portal

The salons you book with remain responsible for the data they hold about you; Piklo shows you your own bookings because you have signed in, and never shows a salon another salon's customers.

The portal is a view, not a new record. It finds what already exists by matching your confirmed sign-in address against the address each salon has for you, at the moment you ask. Change your address at a salon and that salon drops off your list until the two match again. Salons gain nothing from the portal: no new screen, no new field, and no way to see that you are using it.

Your mobile number is used to send you a text message about your own booking, when the salon has chosen that. The number is the salon's record of you, the salon decides whether messages go by email or by text, and the message is always about a booking of yours — never marketing. It goes through Piklo's SMS provider, which is named in section 6 and in the Data Processing Agreement.

3. If you work at a business that uses Piklo

What we hold

Your name and email address, and the password you set, stored as a hash by our authentication provider.
Which organisation you belong to and your role in it.
Sign-in events and other authentication activity, held by our authentication provider.

Why, and on what basis

To give you an account and let you use the product — necessary for the performance of the contract between Piklo and the business you work for, and our legitimate interest in providing that service to the people it names (article 6(1)(b) and 6(1)(f)).
To keep the service secure, to investigate faults and to prevent abuse — our legitimate interest in a service that works and is not misused (article 6(1)(f)).
To contact you about the service: outages, changes to these documents, changes to the terms or prices — the same legitimate interest, and in some cases a legal duty to inform.

How long

For as long as the account exists. When the organisation's agreement with Piklo ends, the accounts and the organisation's data are deleted 30 days later — the export window in the Terms of Service — and are out of our provider's backups within a further 7 days.
Our own accounting records of what the business paid us are kept for as long as Danish bookkeeping law requires (article 6(1)(c)).

4. If you use the customer portal

What we hold

The email address you sign in with, and the fact that it has been confirmed.
The list of salons you have chosen to hide from your own view. It is yours: no salon can see it, set it or undo it.
Your session, for as long as you are signed in.

We hold no copy of your bookings, your payments or your points. Those belong to the salon you booked with, they stay in the salon's own records, and the portal reads them when you open the page.

Why, and on what basis

To give you the account you asked for and show you your own data — necessary for the performance of the agreement between you and Piklo that begins when you ask for a sign-in link (article 6(1)(b)).
To send you that sign-in link — the same basis.

How long

Until you delete the account. "Delete my account" is on the Salons page and it removes the account and the hidden-salon list. It does not remove what a salon holds about you, because that is the salon's own record of its own trade; ask the salon.
Sign-in activity is kept by our authentication provider for 7 days.

5. If you are only visiting

We measure how the site and the product are used without cookies and without identifying you (pages, clicks, scrolling, time on a page, referrers, country, device type and errors). The data stays with us, in our own database (Supabase, EU), and with the processors listed in the Data Processing Agreement; it is never sold or shared for advertising.

There are no advertising pixels, no profiling, nothing that follows you from site to site, and no cookie is set for any of it. That is why there is still no cookie banner: consent is required for cookies that are not strictly necessary, and every cookie below is.

What is counted, in full:

How Piklo's own website is used, measured by the site itself: which pages are read, what is pressed, how far down a page is read and how long it is open, which site or campaign a visit came from, the country (worked out by our hosting provider from the connection, not asked of you) and whether it is a phone, a tablet or a computer. No cookie, and nothing stored in your browser. A visit is recognised for one day by a key calculated from the connection with a secret that is replaced every night and then deleted, so the key cannot be traced back to you and you are a stranger again the next day; your IP address is used for that calculation and is not kept. If you go on to create an account, the random number of that visit is stored with the record that an account was created and a business set up, so we can count how many visits become accounts. The raw records are deleted after 13 months; only daily totals are kept.
Page views and referrers on the booking pages and in the dashboard, by Vercel Web Analytics. Which page was opened and which site it was reached from. No cookie, no identifier that follows you between visits, and the counting script is served from Piklo's own address rather than from somebody else's.
Errors, by Sentry, so that a page that breaks is something we hear about rather than something you have to report. An error report can carry fragments of the request that failed; the headers, cookies and query parameters that could identify anybody are removed before it leaves, no session is recorded, and the address of a page in the customer portal is kept without the email address that signed in.
The following, about Piklo's own business — an account created, a business set up, its first booking, a subscription started or stopped, a message package bought, a payment account connected. These are counts with no name, no address and no identifier on them, and they are held in Piklo's own database rather than sent anywhere.

The cookies that exist are the language you chose and the ones signing in requires. Nothing is set before you press something:

`lang` — which of Piklo's languages you chose in the language switcher on Piklo's own website. Two letters, no identifier, and nothing that says who you are. It is written when you press an entry in that switcher, and the first time the front page settles a language for you, so that the English page can be reached from a browser asking for another language. It lasts a year and goes when you clear your browser.
`sb-<project>-auth-token` — your session, where `<project>` identifies our database. Large sessions are split across `sb-<project>-auth-token.0`, `.1` and so on. It is set to last up to 400 days and is removed when you sign out.
`sb-<project>-auth-token-code-verifier`, `…-auth-token-flows-code-verifier` and `…-auth-token-flow-<id>-code-verifier` — short-lived values written while a sign-in is in progress, so that the link you open can be matched to the browser that asked for it. They are removed once the sign-in completes.

The two sign-in entries are set by our authentication provider on Piklo's own address; the language one is set by the site itself. All of them are marked `SameSite=Lax` so they are not sent from other sites, and travel only to Piklo over HTTPS. They are not marked `HttpOnly`: the sign-in library and the language switcher read them in your browser, so a script on the page can read them too. None of them is used to follow you anywhere.

Our hosting provider records ordinary server logs for every request — the address requested, the response, the time, and the IP address the request came from. That is our legitimate interest in operating and securing a service (article 6(1)(f)). They are kept for 1 day.

6. Who else sees the data

The same suppliers that appear in the Data Processing Agreement, in the same roles:

Supabase — database and authentication. EU, Frankfurt.
Vercel — hosting. The application functions run in the EU, Frankfurt; the content delivery network remains global for static files.
Stripe Payments Europe, Limited, Ireland — payments, and Piklo's own subscription billing.
Resend — sending email. EU, Ireland.
TOPefekt s.r.o. (BulkGate), Czech Republic — sending text messages, where the salon has chosen them.
Sentry. Error reporting. EU region.

We do not sell personal data, we do not share it for advertising, and we do not use it to train models.

7. Your rights

You have the right to:

Access the personal data we hold about you (article 15).
Rectification of data that is wrong (article 16).
Erasure (article 17).
Restriction of processing (article 18).
Data portability (article 20).
Object to processing based on our legitimate interests (article 21).

Write to privacy@piklobooking.com and we answer within a month. If your request is about what a salon holds about you — your bookings, your notes, your contact details in their records — the salon decides, and we will tell you so and point you to them; every salon's own page carries its address and phone number.

8. Complaints

If you disagree with how we process your personal data, you can complain to a data protection supervisory authority.

Piklo Systems is established in Denmark, and our supervisory authority is Datatilsynet, the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark (datatilsynet.dk).

You can always complain to the data protection authority in the country where you live or work. Overview of all authorities in the EEA: edpb.europa.eu.

9. Changes to this policy

The version number and the date it takes effect are at the top of this page. When a change matters to you, we tell you by email at the address we have for you, and the current version is always at this address.

10. Contact

Piklo Systems, Denmark. Email privacy@piklobooking.com. The postal address and the full company details are in the legal notice.