This notice explains personal data processing connected with bookwithlio.com, the LIO app at app.bookwithlio.com and booking pages at form.bookwithlio.com. It distinguishes our own account and website activities from processing carried out on behalf of the business with which you book.
A privacy notice provides information; reading it or using LIO is not, by itself, consent to every type of processing. Where consent is needed, it must be obtained separately for the relevant purpose.
1. Who is responsible for your data
The controller of personal data processed for the LIO website and app user accounts is Špela Zajc s.p., Šaranovičeva cesta 31, Vir, 1230 Domžale, Slovenia. Contact: lio@bookwithlio.com.
We act as a controller when deciding why and how to process information for our own business-account administration, enquiries, legal compliance and service-security purposes.
For client records, appointments, client-card content and provider-directed appointment messages, the salon, studio or other business using LIO is normally the controller and we act as its processor. That provider determines its services, information collected and lawful purposes. Its privacy notice applies to those activities.
A provider is not relieved of its obligations merely because it uses LIO. Processing on a provider's behalf requires a binding agreement satisfying Article 28 GDPR where applicable. This public notice is not that agreement and does not establish that a separate agreement has already been concluded.
2. Who this notice covers
This notice is relevant to website visitors, people contacting LIO, business owners and account administrators, authorised staff and clients whose appointments or records are managed through LIO. Not every data category or processing activity applies to every person.
3. Personal data categories
- Account and business information: names, usernames, email addresses, phone numbers where supplied, business details, account identifiers, access roles, sign-in information, settings and recorded Terms-acceptance timestamps and version identifiers.
- Client and appointment information: names, contact details, booked services, appointment dates and times, assigned staff, status, prices, visit history and provider-entered notes.
- Optional client-card information: birthdays and general or dated notes, where a provider uses these features. Their contents depend on what the provider records.
- Payment-related information: payment or deposit amounts, currency, payment status and expiry, payment-intent references, refund status, connected Stripe account identifiers and onboarding/capability status, and payment-event records where online appointment payments are enabled. Payment-event payloads can contain additional transaction information supplied by Stripe. Card entry takes place in Stripe Checkout, rather than in LIO's booking or client-record fields.
- Communications: enquiries and support correspondence, appointment-message content, recipients and delivery-related records where messages are sent.
- Technical information: IP addresses, browser and device information, timestamps, session identifiers and diagnostic or security information processed in connection with access to the service.
Do not send passwords, full payment-card details or unnecessary sensitive information in support emails or ordinary client notes.
4. Where information comes from
We receive information directly when you register or use an account, contact us by email or Instagram direct message, or enter a booking. A business owner or authorised staff member may also enter or update information about employees and clients, including information originally collected outside LIO. Instagram communications are also processed by the service operating Instagram under its own privacy notice; do not send client records or sensitive information through direct messages.
Technical information comes from interactions with the service and its infrastructure. Connected payment and communication services may provide transaction or delivery outcomes. Information made public on a provider's booking page comes from that provider.
When a provider supplies your information, it is responsible for explaining its collection sources and processing in its own notice. Where we obtain information indirectly for an independent controller purpose, the applicable information duties under Article 14 GDPR apply to us, including the relevant source and timing of the notice.
5. Our purposes and legal bases as a controller
The basis depends on the activity and the relationship with the person, rather than applying one blanket basis to all information:
- Account setup and delivery of a contracted service: Article 6(1)(b) GDPR where necessary to take steps at your request or perform a contract with you, for example an individual business subscriber. For staff or representatives who are not personally parties to that contract, relevant account administration may instead rely on Article 6(1)(f).
- Business communication and support: Article 6(1)(b) for relevant pre-contract enquiries or contractual assistance, or Article 6(1)(f) for our legitimate interest in responding to business contacts and resolving service issues.
- Security, diagnostics and abuse prevention: Article 6(1)(f), based on the interests of protecting accounts, keeping the service reliable and preventing fraud or misuse, with safeguards and consideration of affected people's rights. Article 6(1)(c) applies where a specific legal duty requires processing.
- Accounting, legally required records and binding legal requests: Article 6(1)(c), where processing is required by applicable tax, accounting or other law.
- Establishing or defending legal claims: Article 6(1)(f), for our legitimate interest in resolving disputes and protecting legal rights.
- Consent-based activities: Article 6(1)(a) where a specific optional activity requires consent. Optional advertising, marketing or non-essential device storage must not be justified solely by accepting the Terms or this notice.
Where we rely on legitimate interests, they do not automatically override your interests or fundamental rights. You may object as described below.
6. Processing on a business provider's instructions
We process client data to provide the tools selected by the provider: maintaining client records, managing appointments, displaying booking information, sending appointment communications and handling enabled payment or calendar functions.
The provider must determine and explain the applicable legal basis, including whether processing is necessary for its contract with a client, required by law, based on a properly assessed legitimate interest or based on consent. LIO's contract with the provider is not automatically a legal basis for every use of the client's data.
Appointment confirmations, including those sent for manually added appointments, and customisable reminders serve the booking relationship. Confirmation emails can contain a self-rescheduling link subject to the provider's chosen cutoff. These messages and links do not, by themselves, authorise unrelated promotional messages. Questions about a provider's marketing, record contents or retention should be directed to that provider.
7. Sensitive information and children's data
Free-text client notes are provided for relevant business information, not as a request for health information or medical records. Providers should not enter unnecessary sensitive information and must not treat ordinary booking consent as authorisation to record it. The existence of a notes field does not establish that special-category data is needed for the service.
Processing special-category data requires an appropriate Article 9 GDPR condition in addition to an Article 6 basis, suitable safeguards and appropriate processing arrangements. A provider must assess these requirements before entering such information.
LIO business accounts are intended for people authorised to act for a business, not for children's independent use. If a provider offers services to minors, it is responsible for determining the applicable age, parental-authority and notice requirements. Contact the provider or us if you believe a child's information has been processed unlawfully.
8. Who may receive information
Information is disclosed according to the function involved, not indiscriminately to every recipient:
- The chosen provider and authorised staff: booking and client information needed for the provider's services and administration, subject to the access assigned within its account.
- Hosting, authentication, database and storage providers: infrastructure used to operate LIO and store account, booking and uploaded content. LIO uses Lovable-managed infrastructure; the relevant legal entities, subprocessors and locations must be assessed in the applicable provider arrangements.
- Email delivery services: recipient and message information needed for account and appointment communications sent through Lovable-managed email delivery.
- Stripe: where online appointment payments are enabled, Stripe Checkout and Stripe Connect handle checkout and connected-account onboarding. LIO can send the client's email, payment amount and currency, booking and provider identifiers, and the business user's email for onboarding. Stripe collects checkout and onboarding information directly and returns payment events and connected-account status to LIO. Stripe's processing is described in its Privacy policy; its role can differ between activities under the applicable agreements. The business remains responsible for its appointment charges and client-facing refund rules.
- Google Fonts: the public website and app request external font resources from Google, as described in section 9.
- Lovable AI service: the administrative template-translation tool can submit template text through Lovable's AI service, as described in section 17. This is not a general use of client records for AI.
- Selected integrations: services that a business user intentionally connects, to the extent needed for that connection.
- Professional advisers or public authorities: where needed for legal obligations, legal claims or a lawful request, with disclosure limited to what is justified.
A service provider may act as our processor, a subprocessor for provider-controlled client data, or an independent controller for some activities. The categories and services above do not establish that every necessary vendor agreement has been concluded. A provider's own employees or external service partners are governed by that provider's arrangements, not automatically by LIO's.
9. Public pages, calendar feeds and external links
Business users choose which business details, services and images to publish on a booking page. Published material can be viewed by people who have the link and may be indexed or copied by third parties. Do not publish private client information as public business content.
Where a calendar subscription is enabled, the calendar service receiving the feed can receive appointment details, which may include client names, phone numbers, email addresses and notes. The feed link contains an access token: anyone who has it may be able to read its contents. Keep it private, share it only with an authorised calendar service and replace the token if it is exposed.
The public website and app load Google Fonts through external stylesheet and font requests. These disclose an IP address and technical request information to Google even without clicking an external link. Google's processing is described in its Privacy policy.
Business users can download client and booking CSV files. These copies can contain personal data; the business controls their storage, sharing and deletion outside LIO.
Following an external link or connecting a third-party service can involve separate processing governed by that service's notice. This does not remove our responsibility for disclosures we make.
10. International transfers
The involvement of international infrastructure, email, payment or resource providers may entail processing or remote access outside the European Economic Area. An EU-facing website or an EU storage location does not, on its own, establish that all processing remains in the EEA.
Any restricted transfer must have a valid mechanism under Chapter V GDPR, such as a relevant adequacy decision or appropriate safeguards, including the European Commission's Standard Contractual Clauses where applicable, with any necessary supplementary measures. We do not represent that every recipient has the same transfer mechanism.
The specific processing countries and contractual transfer safeguards have not yet been confirmed for all of these services. We therefore do not claim that data stays exclusively in the EEA or that a particular adequacy decision or Standard Contractual Clauses cover every transfer. Contact us for the information available for your processing and copies of applicable safeguards, subject to legitimate redactions. The unresolved provider and transfer details need to be completed; this general explanation is not a substitute for those details.
11. How long information is kept
Retention depends on the purpose, our role, legal obligations and the applicable provider instructions. Keeping an account open does not justify retaining every item indefinitely.
- Account and business-administration data: for the period needed to manage the account and contractual relationship; after closure, only information needed for applicable legal duties, outstanding matters or legal claims should remain for those purposes.
- Client records, appointments and notes: according to the provider's lawful instructions and retention decisions under the processing agreement. Ask your provider for its specific periods. A provider must assess whether older records are still needed.
- Support correspondence: for handling the enquiry and relevant follow-up, with any further retention assessed against the need to evidence the resolution or address a claim.
- Payment and accounting records: for applicable statutory retention requirements where they apply to us; the payment provider and the business may have separate legal retention duties.
- Security, diagnostic and message-delivery records: only for justified operational, security or evidential purposes, taking account of incident investigations and applicable limitation periods.
- Backups: deletion from active systems may not remove backup copies at the same time. The relevant backup expiry and deletion schedule has not been confirmed; no specific maximum period is promised here.
We do not promise a fixed deletion period that has not been established, or immediate removal from every external provider and backup. A legal hold may delay deletion of specific records needed for a legal duty or dispute. Contact us for the criteria applicable to your account and any planned closure or data return.
Account removal includes administrative sign-in deletion and cleanup of selected account-related records. It also retains an account-access record marking the account as deleted. The complete outcome for linked appointments, stored files, payment-event records and external services has not been verified. Account closure must not be treated as a guarantee of complete erasure; client-data return or deletion needs to be agreed and checked with the business controller.
12. Security and incidents
The application implements session-based authentication, server-side verification for protected operations, and database access policies restricting records by account or role. These controls do not, by themselves, establish that every operational safeguard is in place. Appropriate technical and organisational measures must remain proportionate to the risks. Providers must also manage staff permissions and protect their credentials and calendar links. No internet service can guarantee absolute security.
If a personal data breach occurs, notification and assistance obligations depend on the circumstances and our role. As a processor, we must notify the relevant controller without undue delay. As a controller, we must assess supervisory-authority notification within the applicable GDPR deadline and notify affected individuals where the legal risk threshold is met.
Report suspected account compromise or data exposure to lio@bookwithlio.com. Avoid sending the exposed information itself unless a secure method has been arranged.
13. Your rights
Subject to the conditions in the GDPR, you may have the right to:
- Obtain access to your personal data and information about its processing.
- Correct inaccurate information and complete incomplete information.
- Request erasure where the legal conditions are met.
- Request restriction of processing in the circumstances set out by law.
- Receive data you provided in a structured, commonly used, machine-readable format, and request transmission to another controller where technically feasible, when processing is automated and based on consent or a contract.
- Object on grounds relating to your particular situation to processing based on legitimate interests. We must assess the objection and may continue only where the legal conditions allow it.
- Object at any time to processing for direct marketing, including related profiling; processing for that purpose must then stop.
- Withdraw consent at any time where processing relies on it, without affecting the lawfulness of processing before withdrawal.
Erasure, portability and other rights are not unconditional. For example, legally required records may need to be retained, and receiving an export does not automatically delete the original information.
14. How to exercise your rights
For our controller activities, email lio@bookwithlio.com and explain your request. We may ask for proportionate information to verify identity or authority, but you should not send identity documents unless needed and a suitable method has been arranged.
For appointments, client notes or records controlled by a salon or studio, contact that provider first. If you contact us instead, we will identify the appropriate controller where possible and assist within our processor responsibilities; we cannot simply disregard the provider's lawful instructions.
Requests must normally be answered without undue delay and within one month of receipt. The period may be extended by up to two further months where permitted because of complexity or number of requests; you must be told about the extension and reasons within the initial month.
Requests are normally free of charge. A reasonable fee or refusal is permitted only where the GDPR allows it, such as a demonstrably manifestly unfounded or excessive request, with an explanation of the decision and available remedies.
15. Complaints
We would like concerns to be resolved with us first. Please write to lio@bookwithlio.com and tell us what happened; we will look into it and explain what we can do. This is an invitation, not a condition: you are never required to contact us before approaching a supervisory authority.
You may complain to the Information Commissioner of the Republic of Slovenia, or the competent authority in the EU/EEA country of your habitual residence, place of work or the alleged infringement. You also retain applicable judicial remedies.
16. Required and optional information
Information needed to create and secure a business account or perform an agreed service may be a contractual requirement. Some records may be legally required. If essential information is not provided, the relevant account, booking, payment or support request may not be possible.
Optional information should be identified as such in the relevant context. A provider is responsible for explaining why its booking fields are required. A birthday or detailed client note should not be treated as automatically necessary for every appointment.
17. Automated processing and AI
LIO uses automated functions for tasks such as availability, booking status, reminders and operational statistics. These functions should not be confused with a decision based solely on automated processing that produces legal or similarly significant effects under Article 22 GDPR.
The administrative email-template editor includes an optional AI-assisted Slovenian-to-English translation tool. If used, it sends the selected template text and template context through Lovable's AI service. This is separate from ordinary booking, confirmations and reminders; it is not a request to submit client records or sensitive information for translation. Any personal data included in those inputs requires an appropriate lawful basis and provider arrangements.
This notice does not authorise unrelated AI training, cross-provider client profiling or use of client records for advertising. Any new controller purpose or legally significant automated decision requires a separate assessment and the information and safeguards required by law.
18. Cookies, browser storage and diagnostics
The app persists sign-in sessions and interface preferences in browser local storage. Local storage is a different technology from cookies, although device-access rules can apply to both. Session tokens and rescheduling or calendar access links are security-sensitive and should not be shared.
The website and app contain error-reporting code that can pass error details and the current page path to Lovable's runtime reporting when available. Appointment email sending also records delivery or failure outcomes. Provider-side logs, retention and any additional deployed tracking require a separate operational inventory; this notice does not claim they have all been measured.
For more information, see our Cookie policy. Non-essential cookies or similar access to a device require the applicable information and consent unless a legal exemption applies. A browser setting or a general acceptance of these Terms is not a substitute for required consent.
19. Changes and contact
We may update this notice to reflect changes in processing or law. The update date appears above. Where required, significant changes must be brought to your attention before new processing begins; any processing requiring new consent must not rely on an old, unrelated consent.
Questions about our processing, retention or safeguards can be sent to lio@bookwithlio.com. See our Terms of use for the provider's registration details and contractual conditions.