Privacy Policy

1. Controller

Dimitri Hamann, Einzelunternehmer, handelnd unter PROPLANU, Cuxhavener Straße 128b, 21149 Hamburg, Deutschland

Email: info@proplanu.com

Phone: 017664384773

2. Processing principles

We process personal data only where necessary to provide the platform, register users, arrange appointments, administer studios, process payments, maintain security, communicate, or comply with legal obligations. Processing follows the General Data Protection Regulation (GDPR), the German Federal Data Protection Act, and applicable German data protection law.

3. Data processed when using the website and app

When you use PROPLANU through the website or native Android app, we may process account and contact data, login data, customer, studio, or admin roles, profile details, language settings, studio profiles, team data, services, opening hours, availability, bookings, cancellations, payment status, support requests, reviews, technical logs, app version, operating system, device model, push identifier, and error data. Device permissions are requested only for the stated feature and can be revoked in Android settings.

4. Bookings, functional communication, and customer records

A booking requires your name and at least one contact method, email or phone. NaillyPro and the studio use it for confirmations, necessary appointment changes, payment information, reminders, and other information needed to perform the appointment. This functional communication is separate from studio advertising. The studio receives only what it needs for the appointment. Contacts may be matched by name, email, or phone only within that studio to assign bookings and avoid duplicates. Customer records are not matched across studios.

A matching email address or phone number does not establish account access. Guest bookings remain accessible through their protected booking links. A studio may merge contacts within its own customer records after checking them; publicly entered contact details do not link another customer’s account.

5. Uploads, camera, photo library, and reference photos

PROPLANU supports uploads of studio and team photos, profile pictures, reference images, current nail photos, receipts, and studio-verification documents. In the app, access to the camera or selected photos occurs only after device permission and a user action. We do not read the entire photo library. Selected files are stored and shown only within the relevant dashboard, customer, booking, or verification function.

6. Studio registration and verification

Studios may provide company, contact, payment, profile, and verification data. We use it to review studio applications, verify identity or business details, build the studio profile, manage a subscription, and publish the studio after approval.

7. Payments, subscriptions, Tap to Pay, and reports

PROPLANU processes payment, customer, subscription, invoice, checkout, status, and transaction information where required for bookings, billing, payouts, support, fraud prevention, reports, exports, or legal records. Card and account data is generally processed directly by providers such as Stripe and, where enabled, PayPal. Tap to Pay may send the amount, status, reader, device, diagnostic, and Stripe-required location data to Stripe. Location, NFC, Bluetooth, and local-network access are used only after permission for operating the reader. PROPLANU does not store full card details.

8. Reviews and review requests

After a completed appointment, PROPLANU may send one email on behalf of the booked studio asking for a review of that service. New bookings show the email-use notice and a free objection option directly during booking. You can decline for that appointment or stop further review emails from that studio through the unsubscribe link. Necessary appointment emails continue. Without the recorded notice and the conditions of section 7(3) UWG, separate consent is required. Earlier bookings are not retrospectively enabled. You can also object through support@proplanu.com. We record the booking, studio, customer, artist, notice or consent version and time, any objection or withdrawal, invitation and link-expiry data, plus any voluntary rating and comment.

9. Maps, search, and location

We use OpenFreeMap with OpenStreetMap data for the embedded basemap; MapTiler may still be used for geocoding and place search. Map requests, IP addresses, and technical usage data may be sent to OpenFreeMap, while search terms and technical data may be sent to MapTiler. The embedded map does not require your device location. Only after you select “Use location” does the browser request permission. Once allowed, coordinates are used to rank nearby studios and are not stored permanently in your customer profile. Separate Stripe-required location checks may apply to Tap to Pay. Permission is voluntary and can be revoked in browser or device settings. The “Directions with Google Maps” link does not embed Google Maps in NaillyPro. Google is contacted only after you select the link; the public studio destination or coordinates are then passed to Google Maps.

10. Login, OAuth, and Google Business

For login, PROPLANU processes session and security data. If you use Google, Apple, or Facebook login, the provider sends us the profile data needed for authentication, such as name, email address, and provider-specific user ID. Apple may provide a private relay email address if you choose that option. If a studio connects Google Business features, we process OAuth status data and profile or review information supplied by Google for display and management in the studio dashboard.

11. Google Workspace APIs and Google Calendar Data

When a studio voluntarily connects Google Calendar, NaillyPro Studio may access calendar names and calendar events, including titles, descriptions, start and end times, and, where included in an event and covered by the granted scopes, attendee information.

We use this data solely to provide the calendar features explicitly requested by the studio: selecting a calendar, displaying busy times, checking availability, and creating, updating, or deleting NaillyPro appointments or blocked times in the connected calendar. For third-party Google events, we store only the time ranges and technical references needed for availability checks, not their titles or descriptions.

Google user data is not sold, is not used for personalized or general advertising, and is not shared with data brokers, resellers, or similar third parties.

Data is shared only with technical service providers where necessary to operate and secure the calendar feature. These providers include Vercel for hosting and function execution and Supabase for database and protected storage. OpenAI is used for separate, explicitly requested features such as optional voice transcription; Google Workspace or Google Calendar data is not transferred to OpenAI for those features.

Google user data, including raw, aggregated, anonymized, or derived data, is not used or transferred to any third party to train, improve, or develop generalized or non-personalized artificial-intelligence or machine-learning models.

Data is transmitted securely using HTTPS/TLS. OAuth credentials are stored in encrypted form. Technical access controls restrict access to authorized systems and personnel who require it for operation, support, or security.

A studio may disconnect Google Calendar in NaillyPro Studio at any time or revoke access in its Google account. When disconnected, we delete stored OAuth credentials, synchronization identifiers, and Google Calendar mappings that are no longer required. Other data is retained only for as long as necessary for the requested feature, security, or legal obligations.

NaillyPro Studio’s use of information received from Google APIs adheres to the Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy, including the Limited Use requirements.

12. Email, push, Telegram, studio marketing, and Rewards

Functional emails cover bookings, necessary appointment or payment information, security, support, and studio verification. One-time review requests on behalf of the booked studio follow the notices and objection options in section 8, without an extra booking confirmation click. Studio offers and news require a customer action in the customer account followed by double opt-in and apply only to the selected studio. Only then does the contact appear in that studio’s Marketing area; studios cannot set consent themselves. Consent evidence, withdrawals, tokens, and delivery status are recorded. A one-time invitation to the loyalty program is sent only if explicitly requested during a guest booking. Customers can optionally add their birthday day and month to their profile; the year is never collected and the studio does not receive this information. Adding the date activates the birthday bonus automatically. While the date is stored, NaillyPro awards 500 points once per calendar year. After first entry, the date cannot be replaced through self-service. Removing it deletes day and month; reactivation or correction requires a support review. Studios may optionally use push and Telegram. Voice messages may be sent to OpenAI only for transcription and an appointment draft, which requires studio confirmation.

13. Hosting, database, app distribution, and shop

Vercel hosts NaillyPro; Supabase provides the database and file storage. The current Supabase project is in London, United Kingdom. Production database failures do not redirect data to a local fallback database. Necessary hosting and security logs are independent of Analytics consent. The Android app is distributed through Google Play. Shopify provides shop products, carts and checkout, with technical, order, contact and payment data passed to the providers involved when those features are used.

14. Analytics and external scripts

Only NaillyPro’s own measurement runs on public pages after voluntary Analytics consent. Google Analytics, Vercel Web Analytics and Vercel Speed Insights are not loaded. We record the public page path without URL parameters, page title, referring domain, a broad source category from campaign source or domain (Google, ChatGPT, Bing, social networks, direct or other), device category, approximate country and a daily changing visitor hash. Raw IP addresses, full browser identifiers, personal links and account pages are excluded from this report. Studios see aggregated profile views and source categories. Records are deleted within 180 days. Consent can be withdrawn through Cookie settings; accessible old Google Analytics cookies are removed. The legal basis is Article 6(1)(a) GDPR and, for device access requiring consent, section 25(1) TDDDG.

15. Service providers

Depending on the selected functions, providers include Vercel, Supabase, Stripe, PayPal, Expo, Google Firebase Cloud Messaging, Google for Play, login, Business, analytics and advertising, Apple for Sign in with Apple, Meta for Facebook login, Shopify, OpenFreeMap for the basemap, MapTiler for geocoding and place search, Telegram, OpenAI for optional transcription, and configured email or SMTP services. Providers may process data in the EU, EEA, or third countries.

16. Legal bases

Accounts, bookings, functional booking communication, studio administration, payments, reports, customer records, appointment drafts, and support rely on Article 6(1)(b) GDPR where needed for contract steps or performance. Studio marketing, the one-time points invitation, the optional birthday bonus, and optional analytics rely on Article 6(1)(a) GDPR. German electronic-marketing rules under section 7 UWG also apply. One-time requests about the booked studio service rely on Article 6(1)(f) GDPR with section 7(3) UWG where its existing-customer conditions are met; otherwise consent under Article 6(1)(a) GDPR is required. Security, fraud prevention, necessary error analysis, maps, platform administration, and duplicate prevention may rely on Article 6(1)(f) GDPR. Statutory retention and tax records rely on Article 6(1)(c) GDPR.

17. Recipients and processors

Depending on use, recipients may include studios, artists, payment providers, hosting, database and storage providers, email services, Telegram, OpenAI, map and login providers, analytics and advertising services, support and IT providers, and public authorities where required by law. We conclude data-processing or comparable privacy agreements where required.

18. Transfers to third countries

Some providers may process data outside the European Union or European Economic Area. Supabase resources may in particular be operated in the United Kingdom, for which a current European Commission adequacy decision applies. For other third countries, we use an adequacy decision, EU Standard Contractual Clauses with necessary supplementary measures, or another Chapter V GDPR mechanism as appropriate.

19. Retention and automatic account deletion

Data is retained only as long as necessary. First-party analytics events are erased after no more than 180 days and are also volume-limited. Unlawful-content reports, acknowledgements, moderation decisions, and related communications are automatically erased no later than three years after receipt unless litigation, an authority, or another overriding evidence duty requires longer. Unconfirmed opt-in and invitation tokens expire. Consent and withdrawal evidence may be restricted and retained for legal proof. Account deletion can be requested in the app, web account, or at support@proplanu.com; the account is disabled immediately and finalized after a 30-day reactivation period. Booking, payment, invoice, tax, fraud-prevention, and evidence data remains separately archived only where legal duties require it.

Additional retention periods: email delivery logs 30 days; Instagram messages stored by NaillyPro 90 days. Withdrawal declarations and delivery evidence are retained for processing and legal defence until the end of the third calendar year after receipt. A documented dispute or legal duty may justify a temporary hold. Pending acknowledgements remain until processed. Model drafts remain private; unreferenced model photos are removed after a 24-hour grace period. Failed storage deletions are retried and are not treated as completed.

20. Your rights

Subject to the GDPR, you have rights to access, rectification, erasure, restriction, data portability, and objection. Consent may be withdrawn at any time with future effect. To exercise your rights, contact the email address above.

21. Right to lodge a complaint

You may complain to a data protection supervisory authority. In Hamburg, the Hamburg Commissioner for Data Protection and Freedom of Information is particularly responsible.

22. Version and changes to this privacy policy

Updated September 13, 2026, version 2026-09-13.1. These notices are updated when features, providers or processing activities change.

23. Model marketplace

Adult customers may voluntarily create a model profile with display name, location, description, categories, availability and selected photos. Only explicit publication with consent makes the profile and photos public, including to visitors without an account. Drafts stay private. Publication relies on Article 6(1)(a) GDPR and can be ended for the future by pausing or deleting the profile. We cannot remove copies already made by third parties from their systems. Requests and contact details for an agreed collaboration are processed to initiate and perform the arrangement under Article 6(1)(b) GDPR. Contact details are shown to the requesting studio only after the request is accepted. Deactivating the account hides the profile.

24. Instagram communication and AI replies

When you message a connected Instagram account with automatic replies enabled, NaillyPro processes message content, message and sender identifiers, timestamps and limited conversation history through Meta/Instagram. Message text and context are sent to OpenAI for reply drafts or automatic replies. Processing supports pre-contractual enquiries under Article 6(1)(b) GDPR or our legitimate interest in answering enquiries under Article 6(1)(f). You can request human assistance or use email instead. Please do not send health data or other particularly sensitive information. Persistent response storage through the interface is disabled. This does not exclude technical or security logs at OpenAI. NaillyPro normally deletes stored messages after 90 days. Meta and OpenAI processing is subject to their contracts and the safeguards described for international transfers.

25. In-person SumUp payments

If a studio uses optional SumUp card payments, SumUp receives the amount, currency, device and transaction data necessary for payment and reader operation. NaillyPro records references and payment status to match the booking, without storing complete card data. Processing is based on contract performance and applicable payment or record-keeping duties (Article 6(1)(b) and (c) GDPR). SumUp processes payment and legally required verification data under its own privacy information; roles depend on the function used.

26. Electronic withdrawal declarations

The withdrawal form processes name, confirmation address, contract description, any part withdrawn, contracting party, receipt timestamp and delivery status. We store the declaration, acknowledge it by email and forward studio contract declarations to the selected studio. Processing fulfils legal duties and handles the contract (Article 6(1)(c) and (b) GDPR); limited legal-defence evidence relies on Article 6(1)(f). An acknowledgement does not decide eligibility or refunds.

27. Google Ads: booking measurement for Kovalenko Nails

Only after voluntary Ads consent do we load the Google tag on the public Kovalenko Nails profile and on return from an online payment started there. Google Ads attributes booking starts and confirmed bookings to ad clicks. Google receives the event type, a pseudonymous transaction identifier, public profile address, ad identifiers and technical data such as IP address and browser information. We do not send names, contact details, services, appointment times, payment links or access links. Ad personalization and enhanced conversions with contact data are disabled. Google may use cookies such as _gcl_*. Local pending measurement receipts expire after 24 hours and duplicate-prevention identifiers after 90 days; expired entries are removed on the next visit. The provider is Google Ireland Limited; processing outside the EEA is possible. See [Google’s privacy policy](https://policies.google.com/privacy?hl=en). Legal basis: Article 6(1)(a) GDPR and section 25(1) TDDDG. Withdraw through Cookie settings; the page reloads and accessible Google Ads cookies and local measurement receipts are deleted. Without consent the tag is not loaded and no consentless measurement pings are sent.