Privacy policy

1. Who handles your data

DispoSpot is published by DigitalWebWorks, in France. For any question about your data, write to [email protected].

2. What we collect

Two categories, not to be confused.

• Your own data: name, email address, password (kept as a bcrypt hash, never in clear text), interface language, and your business details (trading name, address, opening hours, services).
• Your clients' data: name, email, phone and the appointments entered in your calendar. They are yours; we host them on your behalf.
• Minimal technical data: the IP address at sign-in or at booking time, to limit abuse, and error logs.
• Payments are handled by Stripe: we never see or keep a card number.

3. What they are used for

• Running your booking page and your calendar.
• Sending you the emails the service needs: address verification, password reset, booking confirmations and reminders.
• Managing your subscription and its billing.
• Preventing abuse: attempt limits, detection of automated sending.

We sell no data and run no targeted advertising.

4. On what basis

Performance of our contract for the service and the emails that go with it, our legitimate interest in protecting the platform for the anti-abuse measures, and our accounting obligations for billing data.

5. For how long

Your data is kept as long as your account exists. When you delete it, your account, the businesses you own alone, and the services, resources, clients and bookings attached to them are erased in the same operation. We keep only a pseudonymised record of the deletion (a hash of your address and the date) so it can be proven to have happened. Payment records stay at Stripe, under Stripe's own legal retention.

6. Who else has access

Strictly what the service needs to run.

• Stripe: payments and subscriptions.
• OVH: sending the service emails.
• Our hosting provider, whose servers are located in France.

7. Your rights

At any time you can:

• read and correct your details under Settings, then Account;
• change your account's email address, once the new one is confirmed;
• delete your account from that same page, without going through us;
• ask for a copy of your data or object to a processing, by writing to [email protected];
• refer the matter to your data protection authority if our answer does not satisfy you.

8. Cookies

One session cookie to keep you signed in, one language cookie to remember your interface choice. No advertising cookie, no third-party tracker.

We measure how our pages are used with our own tool, hosted in France. It sets no cookie, does not identify you, and honours your browser's Do Not Track signal.

9. Security

Passwords are kept as bcrypt hashes. Tokens sent by email (reset, invitation) are stored only as hashes and expire. No method is foolproof: should an incident affect your data, we will tell you.

10. Write to us

[email protected]. We answer within thirty days at most.