Privacy

When you create a Nuvical account as a studio, we process your name, email address and password (stored encrypted) in order to provide your account.

Clients of a studio sign in without a password: they enter their email address or phone number and receive a one-time sign-in code by email, SMS or WhatsApp. For this we process the address or number provided and the code, which is only valid for a short time. The messages are delivered by the providers listed in point 10.

The legal basis in each case is Art. 6(1)(b) GDPR (performance of a contract).

Sign-in and security logs. We log sign-ins and sign-in attempts to the admin area with the time, IP address, device and browser information (user agent), the account concerned and whether the attempt succeeded. Changes made by studio managers or our support team (for example to roles, permissions or settings) are logged with the account, time and type of change. The purpose is the security of our systems: detecting and preventing misuse and unauthorised access, and keeping changes traceable. The legal basis is Art. 6(1)(f) GDPR; this also meets our obligations under Art. 32 GDPR. Failed sign-in attempts are deleted after 7 days. For successful sign-ins, the IP address is truncated and the device information removed after 30 days, and the entry is deleted after 90 days. For all other log entries, the IP address is removed after 90 days and the entry is deleted after 3 years. Records of acceptance of our contract terms are kept for as long as the contract exists and claims arising from it can be asserted.

With the Nuvical app you book and manage appointments at studios that use Nuvical. We process appointment, client and payment data on behalf of the respective studio (see point 5). In addition:

Notifications (push). Only once you are signed in and allow notifications on your device does your device create a push identifier (token). We store it together with the operating system, app version and app language in order to send you notifications. Creating the push identifier is strictly necessary for the notification service you requested (§ 25(2) no. 2 TDDDG). We send booking confirmations, reminders, cancellations and notices about vouchers you have bought on the basis of Art. 6(1)(b) GDPR. You only receive promotional notifications from a studio, such as an offer after a longer time without a visit, if you have agreed to receive marketing (Art. 6(1)(a) GDPR). When you sign out or delete your account we remove the push identifier. You can turn notifications off at any time in your device settings.

Notifications are delivered through the device manufacturers' services. On Android we use Firebase Cloud Messaging by Google Ireland Ltd. as a processor (see point 10). On iPhone, notifications are delivered by the Apple Push Notification service. Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland) processes the push identifier, the time and the content of the notification as an independent controller. In both cases a transfer to the USA is possible. For Google it is covered by the EU-US Data Privacy Framework and EU standard contractual clauses, for Apple by EU standard contractual clauses. More information: apple.com/legal/privacy.

Permissions. The app only asks for access a feature needs, and only when you use that feature. You can withdraw any permission in your device settings.

• Camera: to scan the QR code at the studio, for your profile picture and for photos related to your appointment. Photos are only uploaded if you save or send them yourself. The QR code is recognised entirely on your device.
• Calendar: only to add your appointments to your device calendar. The app does not read your calendar.
• Face ID or fingerprint: to unlock the app quickly. The check is done by your device. We receive no biometric data, only the result.

Deleting your account. You can delete your account directly in the app: Profile, Personal details, Delete account. This removes your personal data at every studio your account is linked to and deactivates your sign-in account. Bookings and invoices are kept without any link to you where studios are legally required to retain them. Further options are described on the data deletion page.

Billing of our plans. We collect the fees for Nuvical through Stripe Payments Europe Ltd. (Ireland). Payment-related data is transmitted to Stripe; a transfer to the USA is possible and is covered by EU standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR.

Payments to studios. If you pay a studio through Nuvical, for example a deposit, a voucher or in person by card, the studio is the payee and the controller for this data. The payment is processed by the payment service provider chosen by the studio (currently Stripe or Viva.com), with whom the studio holds its own account. On the studio's behalf we only transmit the details needed for the payment (amount, service and, where applicable, your email address) and receive the payment status. You can find more details in the privacy policy of the studio and of the respective payment service provider.

Apple Pay and Google Pay. If you pay in the app with Apple Pay or Google Pay, the respective provider (Apple Distribution International Ltd. or Google Ireland Ltd., both Ireland) processes your payment data as an independent controller. The studio and its payment service provider do not receive your card number, only an encrypted payment token.

Fraud prevention. Stripe additionally processes payment and device data as an independent controller in order to prevent fraud (Art. 6(1)(f) GDPR). More information: stripe.com/privacy.

In all cases, full card and account details are processed exclusively by the payment service provider, not by us.