Privacy Policy

1. Who controls your data

SIA "DK GROUP" is the data controller for the personal data described in this policy.

• Legal entity: SIA "DK GROUP"
• Registration number: 50203547731
• VAT number: LV50203547731
• Registered address: Ropažu novads, Ropažu pagasts, Zaķumuiža, "Plūmes", LV-2133, Latvia
• Email for privacy matters: support@pieraksts.app
• Phone (support): +371 28338094
• Phone (technical): +371 27303530

This policy covers the Pieraksts mobile application, the website at pieraksts.app, and our email communications. It explains what we collect, why, how long we keep it, who we share it with, and what you can do about it.

2. A short summary

• We collect what we need to run a booking service, and no more.
• We do not sell your personal data, and we do not use it for advertising.
• We do not track you across other companies' apps or websites.
• You can delete your account, and everything in it, from inside the app at any time.
• Precise location is used only while you are looking at nearby salons, and only if you allow it.

3. What we collect

3.1 Account and profile data

• your email address and account identifier held in our authentication system;
• your first name, last name and display name;
• your phone number, where you provide one;
• your role on the platform (client, salon staff, salon owner) and whether you have finished onboarding;
• your profile photograph, if you upload one;
• your language preference and notification settings.

3.2 Booking data

• the salon, service and staff member for each booking;
• the client's name and, if given, phone number;
• free-text notes attached to a booking, which may include information you choose to share about allergies, sensitivities or preferences;
• the date, time, status and origin of the booking;
• the booking's event history: created, changed, cancelled, completed, or recorded as a no-show.

Booking notes may contain health-related information. We treat that as a special category of personal data under Article 9 of the GDPR and process it only on the basis of your explicit consent, given when you enter it, and only so the salon can perform the service safely. You do not have to provide it.

3.3 Salon profile data

• the salon's name, address, city, street and geographic coordinates;
• the salon's description, contact phone number, website and category tags;
• photographs of the salon, its staff and its work;
• the salon's services, prices, staff list and opening hours.

3.4 Reviews, ratings and reports

• the reviews and ratings you publish, together with the account that published them;
• reports you submit about content or another user, and the blocks you set;
• our record of the moderation decision and any action taken.

3.5 Location data

If you grant the permission, the app uses your device's location to show salons near you and to sort search results by distance. Location is used while you are using that part of the app. We do not store a history of your movements, and we do not use location for advertising. You can refuse the permission and still use the app by searching by city or address, and you can withdraw it at any time in your device settings.

3.6 Device and technical data

• push notification tokens, the platform they belong to, and whether they are active;
• delivery records for notifications, including failed attempts and error codes;
• app version, device model and operating system version, collected with error reports;
• server and security logs, which include IP address, timestamps and the request made.

3.7 Subscription data (salons only)

If a salon buys a subscription through Apple's In-App Purchase, Apple processes the payment. We do not receive or store your card number or other payment credentials. We receive a confirmation that the subscription is active, its type, and its renewal or expiry date, so that we can unlock the paid features.

Where we invoice a salon directly outside the app, we process the business's billing details, registration and VAT numbers and the invoice records that accounting law requires us to keep.

3.8 Website waitlist

When you join the waitlist on pieraksts.app we process your email address, the role you are interested in, your language, whether you opted in to marketing email, the version of the consent text you agreed to, the time of signup, and an unsubscribe token.

3.9 Support correspondence

When you contact us we keep the message, your contact details and our reply, so we can deal with the issue and show what was decided if it is disputed later.

4. What we do not collect

• We do not collect payment card details. Client payments for salon services happen offline, directly between you and the salon, and subscription payments are handled by Apple.
• We do not use advertising identifiers, and we do not integrate third-party advertising or cross-app tracking software. The App Tracking Transparency prompt therefore does not appear, because we do not track.
• We do not buy personal data from data brokers.
• We do not access your contacts, photos library, microphone or calendar, except that the app asks for access to your camera or a single photo when you choose to upload an image.

5. Why we process it, and on what legal basis

• To create and run your account, take and manage bookings, and send you booking notifications — performance of a contract (GDPR Article 6(1)(b)).
• To show you salons near you, where you have allowed location access — consent (Article 6(1)(a)), which you may withdraw in your device settings.
• To store health-related information you enter in a booking note — explicit consent (Article 9(2)(a)).
• To keep the service secure, prevent fraud and abuse, moderate content, and deal with disputes — our legitimate interests in running a safe platform (Article 6(1)(f)).
• To provide support and answer your messages — performance of a contract and legitimate interests.
• To notify you about the launch in Riga and, if you asked for it, to send occasional product news — consent (Article 6(1)(a)), which you may withdraw at any time.
• To keep accounting records and meet tax, consumer and other legal duties — legal obligation (Article 6(1)(c)).

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms; you may object at any time under section 9.

6. Who we share it with

We share personal data with the processors below, each under a written data processing agreement, and only to the extent they need it.

• Supabase — database, authentication, file storage and backend functions. Hosts account, booking, salon and content data.
• Expo (Expo Application Services) — delivery of push notifications to your device.
• Apple — App Store distribution, In-App Purchase billing for salon subscriptions, and push notification transport (APNs).
• Vercel — hosting of the pieraksts.app website and its server logs.
• Our transactional email provider — delivery of booking, account and waitlist email.
• Apple Maps and the device's own location services — rendering maps and resolving your position on the device.

We also share data with salons, but only what they need: a salon sees the bookings made with it and the client details attached to those bookings. Other clients never see your account data; other users see only what you deliberately publish, such as a review.

We may disclose data to professional advisers, auditors, or to a public authority or court where the law requires it. If the business is sold or restructured, data may transfer to the acquirer, who will remain bound by this policy or one at least as protective.

We do not sell personal data, and we do not share it with third parties for their own marketing.

7. International transfers

Our infrastructure is chosen to keep personal data in the European Union or the European Economic Area wherever possible. Some processors, including Apple and parts of Expo's and Vercel's infrastructure, are established in the United States or operate global networks. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses, or an adequacy decision where one applies, together with supplementary technical measures such as encryption in transit and at rest.

You may ask us for details of the safeguards in place by writing to support@pieraksts.app.

8. How long we keep it

• Account and profile data — for as long as your account exists, then deleted when you delete the account.
• Bookings and booking history — for as long as your account exists, and in any event no longer than 3 years after the appointment, which matches the general limitation period for claims in Latvia.
• Reviews and ratings — until you delete them or delete your account.
• Booking notes containing health information — deleted 12 months after the appointment, or sooner if you delete them.
• Reports, blocks and moderation records — 2 years from the decision, so that repeat behaviour can be identified.
• Push tokens — until the token becomes invalid, the app is uninstalled, or the account is deleted.
• Server and security logs — 12 months.
• Waitlist contacts — until the Riga launch communication is complete and you have had a reasonable opportunity to use the service, or until you unsubscribe, whichever comes first.
• Support correspondence — 2 years from the last message.
• Accounting records for subscriptions and invoices — 5 years, as required by the Latvian Accounting Law.

Backups are retained on a rolling basis and overwritten within 30 days, so deleted data disappears from backups within that window.

9. Your rights

Under the GDPR you have the right to:

• ask what personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict how we process your data while a question about it is resolved;
• object to processing that we base on legitimate interests, including profiling;
• receive the data you gave us in a portable, machine-readable format, and have it sent to another controller where technically feasible;
• withdraw any consent you have given, at any time, without affecting the lawfulness of what we did before you withdrew it;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions. Our content filter flags material for human review; it does not act alone in closing accounts.

To exercise any of these, write to support@pieraksts.app. We reply within one month, and will tell you if we need to extend that by up to two further months because the request is complex. We may ask you to confirm your identity first. There is no charge unless a request is manifestly unfounded or excessive.

To withdraw marketing consent, use the unsubscribe link in any marketing email, change the setting in the app, or write to us. To withdraw location consent, turn off location access for Pieraksts in your device settings.

If you believe we have handled your data wrongly, please tell us first so that we can put it right. You also have the right to complain to the supervisory authority: Datu valsts inspekcija (Data State Inspectorate), Elijas iela 17, Riga, LV-1050, Latvia. If you live elsewhere in the EU, you may complain to your own national authority instead.

10. Deleting your account and your data

You can delete your account at any time in the app, under your profile settings. This is a full deletion, not a deactivation: your profile, credentials, bookings, notes, reviews and photographs are removed from our live systems, future bookings are cancelled, and the salons concerned are told only that the booking is cancelled.

We keep only what the law obliges us to keep, principally accounting records for salon subscriptions, and we delete that at the end of the statutory period. Backups are overwritten within 30 days.

If you cannot use the in-app option, see our Account Deletion page, or write to support@pieraksts.app and we will complete the deletion within 30 days.

11. How we protect your data

• Traffic is encrypted in transit with TLS, and data is encrypted at rest by our hosting providers.
• Access to the database is controlled by row-level security policies, so a user's queries can only reach the rows they are entitled to see.
• Administrative access is limited to the people who need it, is individually accounted for, and requires multi-factor authentication.
• Passwords are stored only as salted hashes; we never see them in readable form.
• We log security events and review them, and we keep our dependencies patched.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data State Inspectorate within 72 hours and, where the risk is high, tell you directly without undue delay.

12. Children

The Service is intended for people aged 13 and over, which is the age of digital consent in Latvia. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, write to support@pieraksts.app and we will delete it. Users under 18 should use the Service with the consent and supervision of a parent or guardian.

13. Automated content filtering

Content published on the Service is screened automatically before it appears, to catch material that breaks our Community Guidelines. Where something is flagged, a person reviews it before any account is restricted. You can contest any moderation decision by writing to support@pieraksts.app.

14. Cookies

The pieraksts.app website uses a small number of cookies and similar technologies. These are described in our Cookie Policy. The mobile app does not use cookies.

15. Changes to this policy

We may update this policy to reflect changes in the Service, our processors, or the law. The current version is always published at pieraksts.app with its effective date. Where a change materially affects you, we will notify you by email or in the app before it takes effect.

16. Contact

• SIA "DK GROUP"
• Ropažu novads, Ropažu pagasts, Zaķumuiža, "Plūmes", LV-2133, Latvia
• Email: support@pieraksts.app
• Phone (support): +371 28338094
• Phone (technical): +371 27303530