Privacy
Privacy notice
Under Art. 13 and 14 GDPR, this notice explains which personal data we process when you visit our website, create an account or use appoint4u, for which purposes and on which legal basis, and which rights you have. We use no analytics, tracking or advertising cookies.
Last updated: 20 October 2026
Controller and privacy contact
The controller within the meaning of the GDPR is PLUS TradeCon GmbH, Dieselstraße 16, 63165 Mühlheim am Main, Deutschland, represented by its managing director Josip Kresonja. Please send privacy requests to support@appoint4u.com. Full operator details are listed in the legal notice.
When we are the controller
We are responsible for the data of visitors to our website, of prospects and of our customers – the businesses that use appoint4u.For the data a business processes with appoint4u about its own customers (messages, appointments, bookings), the business is the controller. We then process those data only on its behalf (Art. 28 GDPR); see “Data of a business's customers” below. Please address questions about those data to the business first.
Visiting the website
When you open our website, our hosting provider Vercel processes technically necessary data your browser sends: IP address, date and time, requested address, referrer, browser identifier (user agent) and the response status code. We need these data to deliver the website, keep it stable and secure, find errors and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and working service.The logs are deleted automatically after a short time, after 30 days at the latest, unless they are needed to investigate a specific security incident.
Protection against abuse
We protect registration, password links, the contact form, the website chat and online booking with a security check that runs in your browser – without third parties and without cookies. On submission it uses your IP address, browser identifier and language setting and expires after a few minutes. We also limit the number of requests and sign-in attempts. For this we store the IP address only as an encrypted check value (HMAC) with a counter and a timestamp; the entry is not deleted automatically but overwritten by the next request from the same address.The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against automated requests, spam and attacks.
Contact form and email
When you write to us through the contact form or by email, we process your details – in the form your name, business, email address, phone number, industry, team size, estimated number of WhatsApp enquiries and your message – to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns or aims at a contract with us, otherwise Art. 6(1)(f) GDPR (our interest in answering requests).We delete your request once it is settled and no follow-up questions are to be expected. If it leads to a contract, we keep the correspondence as business letters for six years (§ 257 HGB, § 147 AO; Art. 6(1)(c) GDPR).
Website chat with AI
The chat on our website is an AI assistant, and the chat says so explicitly. Your messages and the conversation so far are sent to our server and, to generate the answer, to Google (Gemini on Vertex AI). Google processes the data as our processor through its global endpoint, i.e. in data centres worldwide, including the US (see “Transfers to third countries”), and does not use them to train AI models.We do not store the conversation on our servers; it stays in your browser's session storage only. The legal basis is Art. 6(1)(f) GDPR – our interest in answering questions about our service quickly – or (b) where your question concerns a contract. AI answers may contain mistakes. Please do not enter sensitive data in the chat, such as health information.
Registration and customer account
For an account we process your name, email address, password (only as a hash, never in plain text), your business name, your settings and sign-in and log data, such as the time of sign-ins and important changes. You confirm your email address through a link we send you. At registration we also record which version of the terms, the data processing agreement and this privacy notice applied and that you confirmed acting as a business.The purpose is to provide the account and perform the contract (Art. 6(1)(b) GDPR); the logs serve security and as proof of the contract and of consents given (Art. 6(1)(f) GDPR). Emails about your account – confirmation and password links, invitations, notices about your contract and invoices, alerts from your business – are sent through our service provider Resend.When a business invites staff, we process their name, email address, role and sign-in data. As far as the team's work with appoint4u is concerned, we act on the business's behalf; we are responsible ourselves for the security of the sign-in.
Orders, payments and invoices
When you order a plan, we process the contract data (plan, term, price, trial, cancellation), your billing address, your VAT identification number where given and an invoice email address you add, as well as your acceptance of the order terms with wording, version and time (Art. 6(1)(b) GDPR; for invoices and checking the VAT number (c)).Payments are handled by Stripe Payments Europe Ltd., Dublin, Ireland. Stripe is an independent controller for the payment processing itself – including fraud prevention and the statutory duties of a payment service provider – under Stripe's privacy policy (stripe.com/privacy). For managing subscriptions and issuing invoices, Stripe acts on our behalf. We do not receive your full card or bank details, only what we need for the contract and invoices, such as plan, amount, payment method and payment status.We keep invoices and accounting records for eight years, books and annual accounts for ten years and business letters for six years (§ 147 AO, § 257 HGB, § 14b UStG; Art. 6(1)(c) GDPR).
Demo
Our demo runs on a separate website with made-up sample data. What you enter there is processed only temporarily in the server's memory; it is not stored permanently and not sent to any AI service – the replies in the demo follow a fixed script. The legal basis is Art. 6(1)(f) GDPR; our interest is to show you our service.
Data of a business's customers (processing on behalf)
When a business uses appoint4u, we process the messages, voice messages, contact details and appointments of its customers on its behalf (Art. 28 GDPR). The business is the controller; we act only on its instructions under our data processing agreement. The business informs its customers about this processing itself; for its online booking page we provide it with a privacy notice for that purpose.The AI assistant writes its answers with Google Gemini. For this it receives the necessary part of the conversation and the information the business approved, such as services, prices, opening hours and free slots. Google converts voice messages to text; we do not store the recording itself. When the assistant replies by voice, Google generates the voice. The assistant identifies itself as an AI in its first reply, spoken replies are marked as an AI voice – audibly and in machine-readable form – and customers can ask to talk to a person at any time. Google does not use the data for training.If you messaged or booked with a business, please address questions about your data to that business. If such a request reaches us, we forward it to the business and help it answer.
WhatsApp and Telegram
Messages to businesses run through the WhatsApp Business Platform of Meta Platforms Ireland Ltd. Each business agrees access to that platform with Meta itself; Meta processes the messages under those terms and is itself responsible for the WhatsApp accounts of its users. WhatsApp's own terms and privacy notices also apply.If a business has connected its own Telegram bot, messages also run through Telegram (Telegram Messenger Inc.), which is itself responsible for the processing in its service (EU representative under Art. 27 GDPR: European Data Protection Office, Brussels; according to Telegram, data of users from the EEA is stored in data centres in the Netherlands). Through the bot, the business and we as its processor receive the Telegram ID, name, username, language setting and the messages sent to the bot; the phone number only if the person shares it. The business creates the bot in its own Telegram account; we set it up (name, logo, description).We store the access tokens for WhatsApp and Telegram encrypted and delete them when the business disconnects.
Calendars and booking tools
A business can connect its Google, Outlook or iCloud calendar, a calendar link (iCal) or a booking tool such as Calendly, Cal.com or Acuity. We then match appointments with it on the business's behalf: from its calendars we take only when times are busy (start and end, no titles or attendees). Into its calendar we write appointments with first name, service, staff member and time, without phone number, email address or notes. From booking tools we likewise take only first name, service, staff member and time.The business uses the calendar and booking tool with its own provider, who processes the data there under its contract with the business. We store credentials encrypted and delete them when the business disconnects. Links for subscribing to the appointments are private; we store only a hash of them, and the business can replace any link with a new one at any time. We send phone numbers and email addresses to the business's own systems (webhooks) only if the business explicitly switches this on.
Recipients and service providers
Within our company, only people who need your data for their task have access to it. External recipients are the service providers listed below. Vercel, Supabase, Google and Resend process data as processors only on our instructions and are bound by contract under Art. 28 GDPR. Stripe is an independent controller for payment processing; each business agrees the WhatsApp Business Platform with Meta itself.Beyond that we pass data on only where the law requires it, for example to authorities, or where it is necessary to protect our rights, for example to tax advisers, lawyers or courts.
Vercel Inc.
Hosting of website and application · Servers in London (United Kingdom), delivery through Vercel's global network
Based in the US: EU-US Data Privacy Framework and EU standard contractual clauses; EU adequacy decision for the United Kingdom
Supabase Inc.
Database · London (United Kingdom)
EU adequacy decision for the United Kingdom; EU standard contractual clauses for access from the US
Google Cloud EMEA Ltd. (Gemini über Vertex AI)
AI replies, transcription of voice messages and speech output · global endpoint: Google data centres worldwide, including the US
EU-US Data Privacy Framework and EU standard contractual clauses; data not used for training
Resend Inc.
Email delivery · United States
EU-US Data Privacy Framework and EU standard contractual clauses
Stripe Payments Europe Ltd.
Payment processing (as an independent controller), subscriptions and invoices (on our behalf) · Ireland / United States
EU-US Data Privacy Framework and EU standard contractual clauses
Meta Platforms Ireland Ltd.
WhatsApp Business Platform – under the terms each business agrees with Meta itself · Ireland / United States
EU-US Data Privacy Framework
Transfers to third countries
Some service providers are based outside the EU/EEA or process data there:• Our servers and our database are in London. The European Commission has adopted an adequacy decision for the United Kingdom (Art. 45 GDPR).• Vercel, Supabase and Resend are based in the US; Google, Stripe and Meta belong to groups based in the US. We base transfers to the US on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and additionally on the EU standard contractual clauses (Art. 46(2)(c) GDPR).• The AI features use Google Vertex AI's global endpoint: Google chooses the data centre itself, so requests may also be processed outside the EU, for example in the US. The basis is the standard contractual clauses in Google Cloud's data processing terms and Google LLC's certification under the Data Privacy Framework.You can obtain a copy of the standard contractual clauses by writing to support@appoint4u.com.
How long we keep data
We delete personal data as soon as they are no longer needed for their purpose and no retention duty applies. In detail:• Server logs: at most 30 days.• Customer account: as long as you use it; after the user agreement ends we delete the data within 30 days.• Messages of a business's customers: the service deletes them automatically every day once they are older than the period the business chooses in its settings (30 days to two years, 180 days by default). Appointments are exempt; they remain stored as the business's records as long as its account exists, unless it has them deleted earlier.• Invoices and accounting records: eight years; books and annual accounts: ten years; business letters: six years.• Contact requests: until they are settled.• Newsletter: until you unsubscribe; unconfirmed sign-ups 30 days.Deleted data may remain in database backups until these are overwritten in the regular cycle; we do not use them until then.
Obligation to provide data
You can use our website without telling us anything about yourself; the technically necessary connection data are unavoidable, though. For an account and a contract we need the details marked as required; without them we cannot conclude a contract. Certain details are required by law for invoices (§ 14 UStG).
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3)); processing carried out until then remains lawful.Just write to us at support@appoint4u.com.You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, your place of work or the alleged infringement. The authority responsible for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
Your right to object (Art. 21 GDPR)
Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.You may object to the use of your data for direct marketing at any time without giving reasons; we then no longer use them for that purpose.An informal objection to support@appoint4u.com is enough.
No automated decisions
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. A business's AI assistant answers questions and books free slots according to the rules the business sets; it makes no decisions with legal or similarly significant effects.
Security
All connections are encrypted (TLS). We store credentials for connected services encrypted, keep every business's data separate and log important changes. Our application accesses Google's AI service without permanently stored keys, using short-lived credentials only. Annex 1 of our data processing agreement has the details.
Changes to this privacy notice
We update this privacy notice when our service or the law changes. The version published here applies.
appoint4u is a service of PLUS TradeCon GmbH. Questions: support@appoint4u.com