Privacy policy

1. Who we are

Aionix is run by Ionut Moldovan (“we”).

For anything about your data, write to contact@aionixapp.com.

The people who use the app to manage their appointments are “businesses” in this policy. The people they book are “clients”.

2. Two kinds of data, two roles

For a business’s own account (their name, email, password and settings), we decide how the data is used, so we are its controller under the GDPR.

Client details and bookings are entered by the business, for their own work. The business is the controller of that data and we process it on their behalf, only to run Aionix for them. If you are a client, the business that booked you is the one to ask about your data (see section 9).

3. What we collect

From businesses, when they use the app:

• Account: name, email address and password. We keep only a scrambled (scrypt) form of the password, never the password itself. The one-time codes we email for confirming your address, changing your password or deleting your account are also kept only in scrambled form, and expire after 15 minutes.
• Business details you choose to add: business name, phone, email, address, a pin on the map and a note for clients.
• Settings: language, currency, time zone, opening hours, your reminder message, whether we send SMS reminders for you and how long before each booking, and your rescheduling, cancelling and confirmation page choices.
• Your plan: free or Pro. If you buy Pro, Apple or Google take the payment and we never see your card details. RevenueCat (section 7) tells us whether your account has Pro, and we keep only that.
• Your services (name, description, duration, price) and the time you block off (with an optional reason).
• Push notifications: if you allow them, your phone’s push token and the app’s language, so notifications reach your phone in your language. They are removed when you sign out.

About clients, entered by the business:

• Name, phone number, email address, the language of their reminders, whether they get automatic SMS reminders, and the business’s notes about them.
• Bookings: service, date and time, price, status (unconfirmed, confirmed, cancelled, no-show), how many times the client moved it, and whether an SMS reminder was sent for it.
• SMS reminders, for businesses on Pro who turn them on: for each text we send, the client’s phone number, the message (usually the client’s first name, the service, date and time, the confirmation link and the business’s name), when it was sent, whether it was delivered, and what it cost.
• What the client did from their confirmation link (confirmed, moved or cancelled), shown on the business’s home screen and kept for 30 days.

Notes are free text. Businesses should write only what they need for their work and avoid sensitive details; if a note mentions health (an allergy, for example), the business is responsible for having a reason to keep it.

Contacts: Aionix asks to read your phone’s contacts only when you tap “Import from contacts”. The list is read on your phone. Only the contacts you select are sent to us, and only their name, first phone number and email address. Aionix never changes your contacts.

On your phone, the app keeps your sign-in session in the phone’s secure storage, and your language and appearance choices.

4. The confirmation page

Reminders carry a link to a page where the client confirms, moves or cancels their booking. The link contains a long random code, so it can’t be guessed. The page shows the booking’s service, date and time, the business’s details the business chose to show, and the price if they turned it on. It doesn’t show the client’s name, phone number or email.

When the client confirms, moves or cancels, we update the booking and tell the business, in the app and with a push notification.

The page uses no cookies and no analytics. It remembers the client’s preferred maps app in their browser’s local storage, only on their device.

If the business shows a map, the page loads it from Google Maps, so Google receives the visitor’s IP address and browser details (see Google’s privacy policy). The directions and “add to calendar” buttons open Google, Apple Maps, Waze or the client’s calendar only when tapped.

5. Technical data

To answer requests, our server sees your device’s IP address; we don’t store it in our database. To keep the service running and fix problems, we record technical information about requests and errors: which part of the API was called, how long it took, the response status, error details and the app or browser version. This doesn’t include what you send us, such as client details.

Aionix has no advertising, no analytics or tracking tools, and doesn’t build profiles. We don’t sell personal data.

6. Why we use it, and on what legal basis

• To provide Aionix: your account, calendar, reminders, confirmation pages, reports and notifications. Basis: our contract with you (GDPR Art. 6(1)(b)).
• To send the emails the service needs: email confirmation, password and account deletion codes, your data export, and a welcome message. Basis: our contract with you.
• To sell and provide Aionix Pro: knowing which accounts have it, and what it unlocks. Basis: our contract with you.
• To keep Aionix secure and working, and to fix errors. Basis: our legitimate interest in a reliable, safe service (Art. 6(1)(f)).
• To meet legal obligations, such as answering lawful requests from authorities. Basis: Art. 6(1)(c).
• Client data, including the SMS reminders we send for a business: only on the business’s instructions, to run Aionix for them (Art. 28). The business needs its own legal basis, usually the appointment it agreed with the client.

7. Who else handles the data

We use a few service providers, each only for what’s listed here:

• Hetzner Online GmbH: runs our server and database, in the European Union.
• Our email provider (Spacemail): sends the emails listed in section 6.
• SMSO (Romania): sends the SMS reminders of businesses who turn them on, and tells us whether each one was delivered. It receives the client’s phone number and the message.
• Expo, and through it Google Firebase Cloud Messaging and Apple Push Notification service: deliver push notifications. A notification contains the client’s name, the service and the time, e.g. “Ana confirmed Haircut on Tuesday at 10:00”.
• NestJS Observe: receives the technical data in section 5, so we can spot and fix errors.
• Google Maps: shows the map on confirmation pages where the business turned it on (section 4).
• RevenueCat: handles buying Pro in the app. The app gives it your Aionix account ID (not your name or email), and it receives your purchases from Apple or Google and basic information about your phone and the app.
• Apple (App Store) and Google (Google Play): take payment for Pro, under their own privacy policies.

Reminders a business sends from the app on WhatsApp or by SMS go out from their own phone, through those apps. Aionix only prepares the message; WhatsApp’s or the phone carrier’s terms apply to sending it. Automatic SMS reminders are the exception: we send those, through SMSO.

Some of these providers (Expo, Google, Apple, RevenueCat) may process data outside the European Economic Area, mainly in the United States. Where they do, the transfer relies on the safeguards the GDPR provides, such as the EU–U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

We may also disclose data when the law requires it.

8. How long we keep it

• Account, settings, services, clients, bookings and blocked time: for as long as the account exists, until the business deletes them.
• Client activity (confirmed, moved, cancelled): 30 days, then it’s deleted automatically.
• Emailed codes: until used, and at most 15 minutes.
• Push tokens: until you sign out, or until the phone stops being able to receive notifications.
• Sign-in sessions on your phone: up to 30 days, or until you sign out.
• The record of SMS reminders sent: for as long as the account exists.
• Your plan: for as long as the account exists. RevenueCat, Apple and Google keep their purchase records under their own policies.

When a business deletes their account (Settings → Account → Delete account), we delete the account and everything in it straight away: clients, services, bookings, blocked time, activity, the record of SMS reminders and settings. This doesn’t cancel a Pro subscription: cancel it in your App Store or Google Play account too. Copies may remain in our backups for up to 30 days, after which they are overwritten.

When a business deletes a client, the client’s details are deleted; their past bookings stay in the business’s calendar without a name, recent activity that mentions them is deleted within 30 days, and the record of SMS reminders sent to them stays until the account is deleted.

9. Your rights

Under the GDPR you can ask to see, correct, delete or take a copy of your data, to restrict or object to how we use it, and you can complain to a data protection authority.

Businesses can do most of this in the app:

• See and correct: everything you entered can be edited in the app.
• Copy: Settings → Account → Export my data emails you everything you entered, as a JSON file and two spreadsheets (clients and bookings).
• Delete: Settings → Account → Delete account removes everything, after you enter a code we email you.

Clients: the business that booked you decides about your data, so ask them first; they can correct or delete your details in the app. If you write to us, we will pass your request to the business, or help them answer it.

For anything else, write to contact@aionixapp.com.

In Romania, the data protection authority is ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal): www.dataprotection.ro.

10. Security

Data travels between the app, the confirmation pages and our server over encrypted connections (HTTPS). Passwords and emailed codes are stored only in scrambled form, sign-in sessions expire, and each confirmation link carries its own random code. Only the business can see their clients and bookings.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authority as the law requires.

11. Children

Aionix accounts are for businesses and adults; you must be at least 16 to create one. Businesses may book children as clients (for a kids’ haircut, for example), with their parents’ agreement.

12. Changes

If we change this policy, we will update the date at the top. If the change matters, for example a new kind of data or a new provider, we will also tell businesses in the app or by email before it applies.