Privacy
What data we collect, why, who we pass it to and how long we keep it.
Last updated: October 2026.
Who processes your data
The controller is techmg GmbH, Auf der Eierwiese 3a, 82031 Grünwald, Germany (Geschäftsführer: Mario Gvozden), USt-IdNr. DE361239022, registered at Amtsgericht München, HRB 284616. For anything to do with personal data — access, correction, erasure or objection — contact us through the contact form. We answer within one month at the latest.
What we collect and why
When you open an account we keep your email address; without it we cannot sign you in. When you book, we keep your name, phone number and the details of the appointment, because the salon needs them to receive you. Both are necessary to deliver what we agreed to. We keep reviews and ratings because they are the content of the directory, and business claims together with the company ID because we have to check who is taking over someone else’s profile — those are our legitimate interests. The phone number and website you enter in a business claim become the business’s details on its public profile once the claim is approved. With a business claim we also keep the tag of the ad or link you came from, so we know which channel actually helps owners — that is our legitimate interest. You join the newsletter by consent and withdraw it with one click. When you write to us through the contact form, your name, address and message are sent to our own mailbox and used only to reply to you — that is our legitimate interest. If you are a business owner and leave your name, phone number and business name in the form inside an ad on Instagram or Facebook, we use them only to call you about claiming your profile — you asked for that call, so this is processing at your request. We briefly remember the address you come from only to stop scripts hammering the site. When you message a salon on WhatsApp or Instagram and the salon has connected our receptionist, we process your messages, profile name and phone number on that salon's behalf — to answer you and book the appointment you ask for. For that conversation the salon is the controller and we are its processor. Replies are written by a language model, and the receptionist tells you so in its first message. We ask for nothing else.
Business listings and where they come from
The directory was built from publicly available sources, chiefly Google Maps, and holds data about the business only: name, address and map location, company phone number, opening hours, the public rating and number of reviews, a link to its website or social media, and a cover photo. We do not store the photo but show it from Google, so a person may appear in it. We do not take reviewer names or the text of other people’s reviews. Croatian sole traders are often named after their owner, so a personal name can end up in the directory even though we never asked for one — we process it on the basis of our legitimate interest in a complete directory of local services. If you are an owner and do not want to be listed, do not want your name in the business name, or do not want the photo on your profile, tell us through the report button on your profile or through the contact form. We will remove it.
Who we pass data to
Your name, phone number and appointment details are seen by the salon you booked with — from that moment it is a separate controller and may use them only for that appointment. We are also helped by Resend (sending email), Google (visit measurement, Google sign-in and our email), Render (server, database and its backups), Apify (collecting public business data), Meta (the form inside ads on Instagram and Facebook, and receptionist messages on WhatsApp and Instagram), Anthropic (the language model that writes the receptionist's replies) and Stripe (payments). Each of them processes data on our instructions and for nothing else. We do not sell data and do not hand it to advertisers.
Transfers outside the European Economic Area
The server and the database are in Frankfurt, inside the European Union. Some of the services we rely on are US companies, so data may travel outside the European Economic Area. That happens only under the safeguards the GDPR requires — the EU–US Data Privacy Framework or standard contractual clauses.
How long we keep data
Your account and everything on it stays until you delete it yourself. Completed appointments are anonymised after two years: the salon keeps the record that the service happened, without your name and phone number. Email logs and data reports are deleted after a year, rejected business claims after six months. A newsletter sign-up you never confirmed is deleted after thirty days, and an unsubscribed one a year after you unsubscribe. Messages sent through the contact form stay in our mailbox for twelve months after the last reply. Details left in the form inside an ad are deleted ninety days after you leave them, unless you claim your profile in the meantime — then the retention periods for business claims apply. Messages in conversations with the receptionist on WhatsApp and Instagram are deleted after thirty days; a conversation linked to an upcoming appointment stays until the appointment has passed, but without the message content. Payment records must be kept for eleven years under Croatian accounting law — those we cannot delete even at your request. Our database provider keeps the ability to restore the database up to seven days back, and we keep manual database copies for at most ninety days, so data briefly survives deletion there too.
Cookies and visit measurement
Signing in uses a cookie without which it would not work, and that one needs no consent. We measure visits with Google Analytics. It loads on every page, but until you click Accept it sets no cookies: it only sends Google a signal that a page was opened, with no cookies and no device identifier, and, as with any request on the internet, your IP address comes with it. Only once you accept does it set cookies and recognise repeat visits. If you decline it stays cookie-free, and we delete any cookies it set earlier. You can change your mind at any time through Cookie settings in the footer.
Your rights
You have the right to ask for access to your data and a copy of it, to correct what is wrong, to ask for erasure or restriction, to take your data elsewhere, and to object to processing based on legitimate interest. You can withdraw consent whenever you like, and withdrawing does not affect what was processed before it. You delete your account and data yourself on the My account page, where you can also download them. For anything else, contact us through the contact form.
Complaint to the supervisory authority
If you think we are not handling your data properly, tell us first — that is the fastest way to fix it. Either way, you can complain to the supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr.
Age
The service is not intended for people under sixteen — that is the threshold Croatian law sets for online services. For anyone younger, a parent or guardian makes the booking.
Changes to this policy
This policy can change when what we do changes. The date of the last change is at the top of the page, and we email signed-in users about anything significant.