Privacy Policy
Last updated: 24 September 2026 · Draft — subject to legal review
1. Who we are
Mészáros János, sole proprietor (Hungary, EU), the operator of grabtheslot.com and the GrabTheSlot platform (the Operator).
Contact: [email protected]
The Operator acts in two roles: as a data controller for the data of its own subscribers (businesses using GrabTheSlot), and as a data processor for the personal data of the subscribers' end-customers (the people who book appointments). The processor relationship is governed in detail by the Data Processing Agreement (DPA).
2. Personal data we process
Subscribers (business customers)
- Name, email address, phone number
- Business name, address, tax/VAT number
- Payment card details are processed exclusively by Paddle as Merchant of Record — the Operator never stores them
End-customers (people who book)
- Name, email address, phone number
- Booking time and the selected service
- IP address (technically necessary)
Visitors of this website
- This marketing site is static and sets no analytics cookies. A single functional preference (dark/light theme) is stored in your browser; it identifies nobody.
3. Legal bases (GDPR Art. 6)
- Performance of a contract (Art. 6(1)(b)) — providing the booking service
- Legitimate interest (Art. 6(1)(f)) — system security and service improvement
- Consent (Art. 6(1)(a)) — marketing communications, where applicable
4. Sub-processors
Data is stored within the European Economic Area: the database and the application server in Germany, operated by us (Hetzner, Nuremberg). Our processors:
| Sub-processor | Purpose | Data location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH | Server infrastructure: the application, our self-operated database and authentication, and encrypted storage of uploaded files (logos, images); a separate server runs our self-hosted, cookie-free visit statistics | EU (Germany, Nuremberg — application, database, file storage; Germany, Falkenstein — statistics) | EEA |
| Cloudflare, Inc. | Provider-independent, encrypted backup (continuous and daily copies of the entire database and uploaded files, for disaster recovery; the provider cannot decrypt the content) and DNS service | EU-jurisdiction storage (R2); US-based provider | EU-U.S. Data Privacy Framework (DPF) |
| GitHub, Inc. | Automated release pipeline (build, tests, deployment) and running database schema changes over an encrypted channel; it stores no personal data | US | EU-U.S. Data Privacy Framework (DPF) |
| Resend Inc. | Sending transactional emails (confirmations, reminders, cancellations, account notices) | US | EU-U.S. Data Privacy Framework (DPF) |
| Twilio Inc. | Delivering SMS and WhatsApp reminders (phone number + reminder text) (only if the Controller enables the SMS or WhatsApp reminder add-on) | US | EU-U.S. Data Privacy Framework (DPF) + Binding Corporate Rules (BCR) |
| Zoho Corporation B.V. | Support email mailbox (receiving the messages you send us) | EU (the provider’s EU data centre) | EEA |
Services acting as independent controllers, or as the booked business’s own partners:
| Service | Role |
|---|---|
| Paddle.com Market Limited | Collects the GrabTheSlot subscription fee as reseller (Merchant of Record) — an independent controller for payment data; it has no access to your customers’ data |
| Barion Payment Zrt. | Online booking fee / deposit collection — under the Controller’s OWN Barion account and contract, if enabled |
| Google Ireland Limited | “Sign in with Google” (the user’s choice) and calendar sync into the Controller’s OWN Google Calendar, if connected |
5. Retention
- Account data: until the account is deleted
- Booking data: 5 years from the booking date (accounting obligations)
- Invoicing records: 8 years (Hungarian Accounting Act, as the Operator is established in Hungary)
6. Your rights
- Right of access — request a copy of the data we hold about you
- Right to rectification — have inaccurate data corrected
- Right to erasure ("right to be forgotten")
- Right to data portability — receive your data in a machine-readable format
- Right to object — to processing based on legitimate interest
To exercise your rights, write to [email protected]. We respond within 30 days.
7. Complaints
If you believe your personal data is processed in violation of the GDPR, you may lodge a complaint with your local EU supervisory authority, or with the authority competent for the Operator: the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11, Hungary · naih.hu · [email protected]