Notice on the processing of personal data · Regulation (EU) 2016/679

Privacy

This is a translation. In case of discrepancy, the Italian version prevails.

Clients, appointments, stock and chat live on your device and, if you choose, on your Google Drive. AgendaCRM does not receive them. Below, item by item, is the little that it does process: the account, notifications and, if you turn it on, online booking.

In brief

Clients, appointments, stock, chat	on your device and on your Drive. They do not pass through AgendaCRM and I have no copy of them
Account	optional. If you connect one, I keep your Google email, in a database in the European Union
Online booking	optional. The page shows the free times you choose to publish. Clients’ requests reach you in a sealed envelope: I deliver them without being able to open them
Cookies	technical only: one for the account, two Cloudflare security cookies on the public pages. No profiling, no advertising
Statistics	on the public pages, Cloudflare Web Analytics: overall visit numbers, without cookies. In the app, one anonymous signal a day to count devices
Backups	you keep them. Since I have none, I cannot recover data you lose

Who processes the data

Andrea Salvatore Palla, who develops and runs AgendaCRM, is the data controller for the data in this notice: account, sessions, server logs, email. To write to me: info@offlineagendacrm.it.

For your clients’ data and your business’s data, you are the controller. AgendaCRM is the tool you keep them in: I do not see them and I do not store them.

If you use the app

Your business’s data

• Clients, appointments, waiting list, queue, deals, completed forms with signatures, stock, price list, messages, notes, deadlines, packages and vouchers, quotes, suppliers, takings, expenses, history and collected booking requests live in the browser of your device and, if you connect Google, in a file on your Drive.
• They do not pass through my server and I keep no copy of them anywhere.
• Form signatures are saved as a drawing of the stroke, without the pressure or speed of the hand, together with the form.
• “To do today” remembers which messages you have already sent (client, type, day), in the same archive. Messages go out from your WhatsApp or your email program.
• “Add to Google Calendar”, in an appointment’s form, is a link: if you tap it, description, client, time, staff member and note go to Google, into your account, just as when you open a WhatsApp link. Until you tap it nothing is sent, and the app asks for no permission on your calendar.
• If you clear the site’s data from the browser, it disappears from that device. The file on the Drive stays until you delete it.

If you lose your data

You keep the copies: on your Google Drive, on the other linked devices, in a folder on your computer, with “Save a copy” (how they work). I have none, so I cannot recover them: writing to me will not get them back.

Barcodes

The camera reads the code on your device: the images do not leave it. If the code is not in your stock yet and there is a connection, the app asks Open Food Facts, Open Beauty Facts and Open Products Facts, free and open databases, for the name and brand: they receive only the number of the code, along with your IP address like any website. I see nothing.

The device count

Once a day the app tells the server it has been opened, with just two pieces of information: whether a Google account is connected and whether the device is still on the first screen. The server adds one to that day’s total. No identifier and no data from your business: two signals from the same device cannot be linked. Like other requests, it goes through the burst-protection check, with an encrypted fingerprint of the IP address that is deleted within two hours. In the demo it is not sent.

The account

The app can also be used without one. If you connect your Google account, on my server I keep:

• an identifier of my own, the Google identifier of your account and your email;
• when you created it and when you last used it;
• the businesses where you are the owner: the identifier of the file on the Drive, never its content;
• the businesses where you are on the staff: your place in the staff list, never the name;
• the devices on which you turned on notifications (below).

The database is at Cloudflare, in the European Union.

When you connect the account, the code Google sends back to the app stays on the server for two minutes at most, then disappears. On its own it opens nothing.

To link another device, the QR code and the link carry a code that lets it sign in with your account, without going through Google. It is valid for ten minutes and once only: on the server a fingerprint of it remains, together with the encrypted renewal permission of the device that created it, until it is used or expires. Whoever receives it signs in with your account: send it only to yourself.

On your device the app keeps a log of the steps of the connection to Google: times and outcomes, never emails or permissions. It leaves the device only if you copy it.

Google Drive

• Permission: drive.file, meaning only the files the app created. I do not see the rest of your Drive.
• Use: writing and re-reading your business’s archive and the staff chat, and sharing them with the staff you link. Nothing else.
• Access: it lasts an hour and stays on your device until it expires.
• Renewal: the first time Google also gives a renewal permission. The server encrypts it and hands it back to your device, without keeping it. It is used to renew access without asking you anything.
• No selling, no advertising, no training of artificial intelligence.

The use of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

The cookie

• __Host-sessione: keeps the account signed in between the app and the server. It is technical: without it the account does not work.
• It lasts 90 days from the last time you use the app, and every day of use starts it over. On the server I keep only a fingerprint of it, not the cookie.
• No profiling, statistics or advertising cookies. If ads ever appear, I will write it here first: only on the public pages, never in the app.

Signing out and deleting

“Sign out”	closes the account on that device. The others stay connected
“Delete account”	removes from the server the account, sessions, businesses, places on the staff list, notification subscriptions, booking page and uncollected requests, and withdraws the permission from Google
From Google	remove AgendaCRM from the apps connected to your account

In every case the file stays on your Drive.

Staff and employees

• To link a person I need their Google email: the archive on your Drive is shared with them, and Google notifies them. If there is a chat, that too, without notification.
• The six-digit code that lets them in is valid for ten minutes. It contains the business, the person, their email and their name. Once used or expired, it disappears.
• Every change records who made it and when. If you work with employees, you must inform them (Article 4 of the Workers’ Statute, Law 300/1970).
• “Delete permanently” erases name, phone, email and notes from all devices. Earlier versions of the file on your Drive and your own copies remain, until you delete them.

The staff chat

• Messages live in a separate file on the owner’s Drive, agendacrm-chat.json, shared with the linked staff. They do not pass through my server.
• Each message carries the text, the date and time, and the name and colour of whoever wrote it.
• The file and each device keep the latest 500 messages: when a new one arrives, the app removes the oldest. On the device they stay until the site’s data is cleared from the browser. Google keeps earlier versions of the file for itself, for up to 30 days.
• If a folder is linked on a device (Settings → Backups → Folder), that device also writes the chat it receives there: one text file a day, in the chat subfolder. It stays there until you delete it.
• Only those with access to the file read them: you and the linked staff. Inside the file they are not encrypted. Removing a person’s access also removes them from the chat; what they already had on their device stays there.

Notifications

• Optional, device by device: they are turned on from the chat or from Settings, and turned off from Settings.
• For each device that turns them on, the server keeps the address the browser received from its notification service (Google, Apple, Mozilla or Microsoft, the browser chooses), two public keys, your account, the business, the date of subscription and that of the last confirmation.
• In chat notifications, the sender’s name and the start of the message (up to 120 characters) are encrypted by the sender’s device, for each device that receives them. The server forwards them without being able to read them, and so does the notification service.
• Notifications also arrive when the owner confirms a week’s shifts, only to the people whose shift has changed, by the same mechanism: the title and the week (“Week of 2 November”) are encrypted by the owner’s device for each device that receives them; times and shifts are not in them. To choose the devices, the server tells the owner which account each one is linked to.
• Notifications of booking requests are encrypted by the server and say only that one has arrived: who sent it is not there.
• The notification service sees that a notification is arriving for that browser, when, and how big it is.
• The subscription is deleted when you turn notifications off, when you leave the staff, with “Delete account”, or after 60 days in which the device does not check in.

Online booking

Optional: the owner turns it on (Settings → Online booking), with the Google account connected, after accepting the Terms for businesses, which contain the data processing agreement (Article 28).

• The page (offlineagendacrm.it/prenota/ and the name you choose) is public: anyone with the link sees the business’s name and, if you write them, its phone, address and the link to your privacy notice, the bookable services with duration and price, the names of the bookable people and the free times of the coming weeks. Never clients or appointments: only the gaps between one appointment and the next.
• On the server, with the page, is the business’s public key. The private key is in your business’s archive, so on the devices and on the Drive, never with me.
• The business’s devices republish the times when the diary changes. A page that no device has updated for 7 days does not accept requests.
• Requests arrive in a sealed envelope, encrypted in the browser of whoever books. A device of the business collects them, opens them and puts them in the archive on the Drive: they disappear from the server at that moment, and in any case after 7 days. I hold them on behalf of your business, which is their controller, without being able to open them.
• If a request waits more than two hours, I send an email to your account address: how many requests and since when, never who sent them. It is turned off in Settings → Online booking.
• Requests that have been answered are removed from the archive after 30 days. If you confirm one, the booker’s details go into the client record, like the ones you write yourself.
• With the page I keep which version of the terms was accepted, when and by which account.
• If I suspend a page (point 5 of the terms), I keep its name, the date and the reason until I reactivate it or the account is deleted.
• “Turn off booking” removes the page, the uncollected requests and the acceptance of the terms. The page’s name becomes free again.
• For the data of people who book with you, you are the controller: it is for you to tell your clients how you use it and how long you keep it. That is why the page can show the link to your privacy notice.

Without a Google account there is also the link for requests on WhatsApp: the business’s name, services and opening hours are in the link itself, after the #, which the browser does not send to any server. The request goes out from the booker’s WhatsApp or email.

AI assistants

If you ask an assistant (Claude, ChatGPT and the like) to prepare an appointment or a client, what you tell it passes through the server only to compose the link to open, and I do not keep it. If an assistant asks for a business’s free times, it reads the same public page that anyone can see.

If you book with a business

This part is for people who ask for an appointment from the booking page of a business that uses AgendaCRM.

• The controller of your data is the business you write to: its name is at the top of the page, and if it has a notice of its own the link is next to the send button. To find out how it uses your data, how long it keeps it and to exercise your rights, contact it.
• Name, phone number, email and notes leave your browser in a sealed envelope (encrypted): only the business has the key to open it. AgendaCRM delivers it without being able to open it and keeps it until the business collects it, 7 days at most.
• Outside the envelope there are only the day, time, duration, the person chosen and, if the service uses one, the treatment room or other room: they are there to avoid giving the same time to two clients. They disappear with the envelope.
• To stop anyone sending requests in bursts I keep an encrypted fingerprint of your IP address, not the address. It is deleted within two hours.
• Before sending, Cloudflare’s Turnstile checks that a person is writing and not a program. To do so it uses the IP address and some technical information from the browser; it sets no profiling cookies and shows no advertising (Turnstile privacy notice, updated 18 June 2025).
• The reply comes from the business, on WhatsApp or by email. I do not write to you.

If you visit the site

• The public pages have a Cloudflare security check that tells people from automated programs. To do so a Cloudflare script reads some technical information from the browser and sets two technical cookies: cf_clearance, which lasts up to a year, and __cf_ob, which is deleted when the browser closes. No profiling, no advertising.
• Cloudflare keeps a log of accesses to the site (IP address, browser, page) to make it work and protect it. From the log it shows me only overall numbers (visits, requests, countries of origin), which I use to understand when and how to improve the site.
• If a page does not load, the browser may report the type of network error to Cloudflare.
• On the public pages and in the manual, not in the app or on the booking page, there is Cloudflare Web Analytics. A script downloaded from static.cloudflareinsights.com sends to cloudflareinsights.com the page visited, without the address parameters, the page you came from and the loading times. From these Cloudflare derives country, device type, browser and operating system, and shows me only overall numbers. According to its documentation it uses no cookies or other data stored in the browser and does not recognise people by IP address or browser. It keeps the full data for 7 days, then only a sample.
• The fonts are on this domain: apart from Cloudflare, no other service receives your IP address while you read.

Security and logs

• For each request the server records only the operation, the outcome and the duration. Never emails, IP addresses, cookies or permissions.
• Cloudflare also records the timing of the server’s operations (calls to Google, to Brevo and to the database) and groups errors, to understand what to improve. Without content, and with addresses stripped of parameters.
• To stop anyone trying random codes I keep an encrypted fingerprint of the IP address, not the address. It is deleted within two hours.

Emails

• I write to you only with service notices: if a booking request is waiting (and only if you have booking turned on), if your account stays idle for two years, a month before removing it, and when the Terms for businesses require it (new terms, suspended pages, new providers, data breaches).
• If you write to me, I use your address only to reply.
• If you report a booking page, I use your name, your email and what you write to examine the report and tell you the decision. To the business I give the reason, not who reported it, unless that is needed to decide.
• “Report a problem” opens a ready-written email in your mail program: the app version, the browser, the language and the latest errors from that session. The errors can contain client names: you see them before sending and delete what you don’t want. Nothing is sent by itself.
• No newsletters, no lists, no disclosure to third parties.

Providers

Cloudflare	site, server, accounts database (in the EU), logs and overall statistics (including Web Analytics on the public pages), security check on the public pages, Turnstile on the booking page
Google	sign-in with the Google account, archive and chat on your Drive
Brevo	sending service emails
Browser notification services	delivery of notifications, encrypted: Google, Apple, Mozilla or Microsoft, depending on the browser
ImprovMX	forwarding emails to info@

None of them receives clients, appointments or stock. Booking requests pass through Cloudflare sealed.

Outside the European Union

Cloudflare and Google are based in the United States. The transfer relies on the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) and, failing that, on the standard contractual clauses. The accounts database stays in the European Union.

Browser notification services may be outside the European Union: they receive the browser’s address and encrypted messages that they cannot open.

Brevo is a French company with servers in the European Union; companies in its group in other countries may access them with the same safeguards.

For how long

Your business’s data	as long as you keep it
Archive on the Drive	until you delete it
Chat messages on the Drive	the latest 500; earlier versions of the file are kept by Google for up to 30 days
Chat messages on devices	the latest 500
Chat in the linked folder	until you delete it
Account	as long as you use it. After 24 months without sign-ins it is removed, with an email at least 30 days before
Session	90 days from the last time you use the app
After “Delete account”	immediately from the server; up to 7 days in the database backups
Notification subscriptions	as long as you keep them on; 60 days from the last time the device checks in
Booking page and accepted terms	as long as booking is on
Booking requests on the server	until the business collects them, 7 days at most
Answered requests, in the business’s archive	30 days
Staff codes	10 minutes
Codes to link another device	10 minutes, or until used
Return code from Google	2 minutes
IP address fingerprints	within two hours
Daily device totals	no limit: they are numbers, not personal data
Our server’s log and timings	up to 7 days
Cloudflare log	according to Cloudflare’s retention times
Web Analytics	7 days in full, then a sample in Cloudflare’s overall numbers
Security cookies on the public pages	cf_clearance up to a year; __cf_ob until the browser closes
Emails you write to me	up to two years from the last message, or sooner if you ask me
Page reports	up to two years from the decision

On what basis

Account, session and cookie	they are necessary for the service you ask for (Article 6(1)(b))
Archive and chat on the Drive	your consent, which you can withdraw at any time (Article 6(1)(a))
Staff and codes	they are necessary for the service you ask for (point (b))
Linking another device	it is necessary for the service you ask for (point (b))
Notifications	they are necessary for the service you ask for, when you turn them on (point (b))
Booking page, terms and request emails	they are necessary for the service you ask for, when you turn it on (point (b))
Requests from people who book	I hold them on behalf of the business, which is their controller (Article 28)
Turnstile and IP fingerprints on booking	legitimate interest in defending the page from automated requests (point (f))
Email before removal	legitimate interest in not letting you lose an account without knowing (point (f))
Logs and IP fingerprints	legitimate interest in the security of the service (point (f))
Security check on the public pages	legitimate interest in protecting the site from automated programs (point (f) and recital 49). The two cookies are technical: consent is not needed (Article 122 of the Italian Privacy Code)
Overall visit statistics	legitimate interest in improving the site (point (f))
Daily device count	legitimate interest in knowing how much the app is used (point (f))
Emails you write to me	legitimate interest in replying to you (point (f))
Page reports	legal obligation (point (c); Article 16 of Regulation (EU) 2022/2065)

Your rights

You can ask for access, rectification, erasure, restriction and portability, object to the processing and withdraw consent by writing to info@offlineagendacrm.it. You can also delete the account yourself, with “Delete account”. You manage and delete your business’s data yourself, from the app.

If you believe the processing breaches the rules, you can lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority).

Changes

Every change alters the date below. Earlier versions are available on request.

In force from 28 October 2026.