Privacy Policy

1. Data we process

Registration and identification data: name, email, phone and, for Professionals, business and team data.

Usage and booking data: booked services, appointments, history, reviews and messages with the business.

Payment data: handled by the payment institution (Redsys/Bizum); Servomo does not store your full card details.

Technical data: IP address, device identifiers and browsing data for security and analytics purposes.

2. Purposes and legal basis

Providing the Service and managing your account, bookings and payments: performance of the contract (Art. 6.1.b GDPR).

Sending transactional communications (confirmations, reminders): performance of the contract and legitimate interest.

Preventing fraud and keeping the platform secure: legitimate interest (Art. 6.1.f).

Product analytics via cookies to understand usage and improve the Service: your consent (Art. 6.1.a), revocable at any time.

Sending Servomo marketing communications: your consent (Art. 6.1.a), revocable at any time.

Complying with legal obligations (tax, accounting): legal obligation (Art. 6.1.c).

3. Retention

We keep your data while your account is active and, after closure, for the applicable legal periods (for example, tax and commercial obligations) or as long as needed to address possible liabilities. Data is then deleted or anonymised.

4. Recipients and processors

We share data with providers who act as processors under contract: Supabase (database and authentication), Vercel and Cloudflare (hosting and delivery network), Amazon Web Services and Resend (email delivery), Redsys/Bizum (payment processing), PostHog (product analytics) and Sentry (error monitoring).

We also share strictly necessary data with the Professional when you book with them, and with authorities where legally required.

We do not sell or transfer personal data to third parties for their own purposes.

When a business stores its clients' data in Servomo (for example, when recording an appointment, a sale or an invoice), the business is the controller of that data and Servomo acts as its processor: it processes the data only on the business's behalf, does not transfer it and does not use it for its own purposes.

5. International transfers

Some providers may process data outside the European Economic Area. In that case, we ensure the safeguards required by the GDPR, such as the Standard Contractual Clauses approved by the European Commission.

6. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw your consent, by writing to [email protected]. We will need to verify your identity.

If you believe we have not properly handled your rights, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Security

We apply appropriate technical and organisational measures to protect your data (encryption in transit, access control and row-level security in the database). No system is infallible, but we work to minimise risks.

Businesses' payment credentials (the terminal key) and electronic certificates are additionally stored encrypted (AES-256-GCM), are not shown once saved, and only the essential technical staff can access them, to resolve an incident.

8. Cookies and similar technologies

We use cookies and local storage strictly necessary for operation (session, language, keeping your booking): these require no consent because the Service does not work without them.

Product analytics cookies (PostHog) are installed ONLY if you accept them in the cookie notice. They do not load before your decision, and rejecting them takes a single click, just like accepting.

You can change or withdraw your decision at any time from the «Cookie settings» link in the footer, as easily as you gave it. You can also manage them from your browser.

We do not use advertising or cross-site tracking cookies, and we do not share this data with third parties for advertising purposes.

9. Minors

The Service is not directed at children under 14. If we detect a minor's data without the required authorisation, we will delete it.

10. Changes to this policy

We may update this policy to reflect legal or Service changes. We will publish the current version with its update date and, if changes are material, we will notify you.

11. How to delete your Servomo account

You can delete your Servomo account (the servomo.es website and the Servomo app) yourself, without asking anyone: sign in, go to Account (if you are a business, to Settings in your panel), scroll to «Delete my account», tap «I want to delete my account», type BORRAR and confirm.

What is deleted: your access and your personal data (name, email, phone, photo, hair profile and mobile notifications). If you own businesses, they are unpublished and stop receiving bookings.

What is kept: past appointments stay with each business, but without your name or data; and invoices already issued are kept for the periods required by tax and commercial law. They are deleted afterwards.

If you cannot sign in, write to [email protected] from the account's email address and we will delete it for you.