This policy applies while Shonly is in beta. Before the beta ends we’ll publish the full policy and tell you about it.
Who we are
Shonly is responsible for your account data.
Write to us at [email protected]
Two roles
For the people who run a business on Shonly — owners and staff — we are the controller. For their clients’ data we are a processor: the business decides, we keep it safe and use it only to provide the service.
What we collect
Accounts: name, email, a password stored only as a secure hash (or Google sign-in) and language. Clients: what the business records — names, contact details, family links, bookings, attendance and payment records. An invite request: your name, email, business name and kind of business. We never store card details.
Why
To provide the service, keep it secure, answer support emails and meet legal duties. No advertising, and we never sell data.
Where it’s kept
Account and business data is stored on servers in the EU — Frankfurt, Germany. Emails to support and invite requests are kept in our mailbox at Google. On the way to you, pages and requests pass through Cloudflare’s network, which can carry them through places outside the EU.
Who helps us
These companies process data for us:
| Company | What for | Where |
|---|---|---|
| DigitalOcean | Hosting and the database | Frankfurt, Germany |
| Cloudflare | Delivering pages and requests; checking a guest booking isn’t a bot | Its worldwide network (a US company) |
| Brevo | Sending email | EU |
| Sentry | Error reports | EU (Germany) |
| Our support mailbox; optional sign-in | Google’s servers (a US company) |
How long we keep it
We keep account and business data while the account is open, and delete it when the business asks us to close the account. Backups are overwritten on a rolling schedule. The exact periods come with the full policy before the beta ends.
Your rights
You can ask to see, correct, export or delete your data, and you can complain to the Commission for Personal Data Protection.
Cookies
Only what’s needed: the app’s cookies keep you signed in, and Cloudflare, which delivers our pages, sets a short-lived cookie (__cf_bm) to tell people from bots. This site also remembers your light or dark choice and the business you picked, on your device only. No trackers and no ads.
Changes
We’ll post changes here and email account holders before they apply.