Privacy
Last updated August 28, 2026
This notice explains what Aptly does with personal data — both the data of the businesses who use it, and the data of their clients. It is written to be read, not to be survived.
In one paragraph: we hold what a booking needs — a name, a way to reach somebody, and when they are coming. We never sell it, we never rent it, and we never use one salon's client list for anything but that salon.
Who is responsible for what
Aptly (“we”, “us”) is operated by, and the controller described below is:
STEFAN JANDRIĆ PR CODEWAVE — a sole trader registered in the Republic of Serbia
Sentandrejski put 51, 21000 Novi Sad, Serbia
Tax ID (PIB) 114607697 · Company number (MB) 67711114
booking@aptly.sh
That address is where a formal request or a data processing agreement should go; the email is read by a person and is the faster route.
There are two different relationships here and the difference matters:
- For the business using Aptly — the salon, clinic or practice — we are the controller of the account data: who signed up, the email address, the plan, the billing record.
- For that business's own clients — the people who book an appointment — the business is the controller and we are the processor. We hold and move that data on their instructions and for no purpose of our own. If you booked an appointment and want your data removed, ask the business first; they can do it themselves, and we will help them if they ask.
What we collect
| What | Why | How long |
|---|---|---|
| Account: name, email address, password (hashed), language, two-factor and passkey credentials | To let you in, and to keep other people out | While the account exists, then 90 days |
| Business: salon name, country, timezone, currency, logo, brand colour, opening hours, services and prices | To run the booking page and the calendar | While the account exists |
| Clients: name, phone number, email address, appointment history, notes and tags the business writes, and whether they agreed to be messaged | To take a booking, send a confirmation, and let the business recognise a returning client | Controlled by the business; deleted with the account |
| Appointments: date, time, service, staff member, price, and any note the client left | The product itself | While the account exists |
| Messages: the text of confirmations and reminders, the recipient, and whether delivery succeeded | So the business can prove a reminder was sent, and so we can bill for texts accurately | 24 months |
| Push subscriptions: the anonymous endpoint your browser mints when you turn notifications on | To notify staff of a new booking | Until you turn notifications off |
| Technical: IP address, browser and time of significant actions (sign-in, plan change, data export) | Security, fraud prevention, and answering “who changed this?” | 12 months |
We do not ask for and do not want special-category data. If a business writes health information into a client note — which a clinic reasonably might — that is their decision and their responsibility as controller, and it is held under the same protections as everything else here.
What we never do
- We do not sell personal data. There is no version of this business where we do.
- We do not rent, share or license client lists to advertisers, data brokers or anyone else.
- We do not market to one business's clients. They are not our audience; they are our customer's customer.
- We do not run advertising trackers, third-party analytics scripts or advertising cookies on the public booking pages.
Why we are allowed to hold it
- To perform our contract with you — running the account you signed up for.
- Our legitimate interests — keeping the service secure, preventing abuse, and understanding aggregate usage so we can improve it.
- Consent — for marketing messages, and for anything a client explicitly opts into. Consent to reminders is recorded per client and can be withdrawn at any time.
- Legal obligation — invoices and tax records we are required to keep.
Who else touches the data
Running a booking product means using other companies for the parts we do not build ourselves. Each one is listed here because a sub-processor a customer cannot see is a sub-processor they cannot consent to.
| Who | What for | What they see |
|---|---|---|
| Railway | Hosting, application database and cache | Everything, at rest, as our infrastructure provider |
| Cloudflare (R2) | Storing uploaded logos | Image files only |
| Resend | Sending confirmations, reminders and account email | Recipient address and message content |
| SMS Agent (Serbia), BulkGate (elsewhere) | Delivering text messages | Recipient phone number and message content |
| Creem | Payments — Creem is the merchant of record and issues your invoice | Billing name, email, payment details. We never see a card number. |
| “Sign in with Google”, if you choose it | Your name and email address, only when you use it | |
| Jitsi | The video room for an online appointment | The room address. We do not record calls and never have access to them. |
| Apple, Google, Mozilla push services | Delivering a notification to an installed app | An encrypted payload and an anonymous endpoint |
Where the data lives
Inside the European Union. Some of the companies above are established outside the EU; where data leaves it, that transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision. We will tell you which, for any specific vendor, if you ask.
Cookies
Aptly uses a small number of cookies and none of them are for advertising:
- a session cookie, so you stay signed in;
- a CSRF token, which is what stops another website submitting a form as you;
- a “remember me” cookie, only if you tick the box.
The public booking page sets no analytics or advertising cookies at all. A client can book an appointment without anything being written to their browser beyond what the form itself requires.
What you can ask us to do
Under the GDPR and the Serbian Law on Personal Data Protection you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing based on legitimate interests, and ask for your data in a portable format. You can also complain to a supervisory authority — in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection.
Write to booking@aptly.sh and we will answer within 30 days. There is no charge, and no hostage clause: if you leave, we will export your clients and your bookings in a format you can open.
Security
- Everything travels over TLS, and passwords are stored hashed — never in a form we could read.
- Two-factor authentication and passkeys are available on every account, free ones included.
- One business can never query another's data. Isolation is enforced in the database layer, not by a filter somebody might forget to apply, and it is covered by automated tests that run on every change.
- Staff access is limited by role: a stylist sees their own appointments, not the whole diary.
Children
Aptly is a tool for businesses and is not directed at children. A parent may of course book an appointment for a child; that booking belongs to the business, not to us.
Changes
If we change this notice in a way that matters, we will say so by email before it takes effect rather than quietly changing the date at the top.