Privacy Policy

1. Who is responsible

Mestechki is provided by [to be filled: LEGAL_OWNER], contact for data questions: [to be filled: LEGAL_EMAIL].

For professionals’ data (account, profile) we are the controller under the GDPR.

For the data of clients who book with a professional, the professional is the controller — they are their clients. We store and process this data on their behalf as a processor; see “Data processing on behalf of the professional” in the Terms of Service.

2. What data we process

Professionals: first and last name, email, password (hashed only), booking page address, profile data (photos, description, work addresses, services and prices, languages), time zone and language, notification settings (including Telegram if connected), support messages, days and times of dashboard use.

Clients of professionals: name, phone number, optionally email and Telegram username, booking comment, address (home visits only), browser time zone and language, booking history, reviews. The professional may add their own notes and a category (e.g. “regular”).

Technical data: IP address and request details in server logs — to protect against attacks and abuse.

3. Purposes and legal bases

To provide the service: professional account, booking page, calendar, booking notifications — performance of a contract (Art. 6(1)(b) GDPR).

To protect the service against attacks, spam and abuse and to keep a log of administrator actions — legitimate interest (Art. 6(1)(f) GDPR).

Service emails (email confirmation, password reset, bookings) are part of the contract. We do not send marketing emails.

4. Where data is stored and who else receives it

Servers and backups — Hetzner Online GmbH, data centres in Finland and Germany (EU).

Email delivery — Resend (Resend Inc., USA). Transfers to the USA are covered by the EU Standard Contractual Clauses.

Telegram — only if a professional or client connects Telegram notifications themselves.

We do not sell data or share it with advertising networks. Client data is visible only to the professional they booked with.

5. Administrator access

Only the service administrator has technical access to the server. We do not look at professionals’ client data unless the professional asks for help via support. The admin panel shows only service information about a professional (profile, number of bookings, activity), not their client list. Administrator actions on a professional’s account are logged.

6. Retention

Account data — as long as the account exists. After an account is deleted, its data is deleted within 30 days, and from backups as they rotate (no longer than 6 months).

Server logs — up to 30 days.

7. Cookies and browser storage

We do not use advertising or analytics cookies. The browser stores only what is needed: your login, chosen language and links to your bookings. No cookie consent banner is therefore required.

8. Security

Connections use HTTPS, passwords are stored only as hashes, the database is not reachable from the internet, backups are encrypted.

9. Your rights

You may request access to your data, rectification, erasure, restriction of processing and a copy in a portable format, and you may object to processing. Write to [to be filled: LEGAL_EMAIL] — we reply within one month.

If you are a client of a professional, please contact the professional first about your data; we will help them fulfil your request.

You also have the right to lodge a complaint with a data protection authority in your EU country.

10. Age

You must be 18 or older to register as a professional.

11. Changes

If this policy changes, we will update the version date on this page and notify professionals of important changes by email.