Privacy Policy

1. Controller and contact

The data controller for FYND accounts is FYND TECHNOLOGY S.R.L., tax ID (CUI) 55578444, Trade Register no. J2026054172003, registered office at Sat Izvoare, Comuna Dumbrava Roșie, Strada Școlii Nr. 1, Județul Neamț, 617188, România ("FYND", "we"). Contact for any data request: admin@fynd.tech.

Important: for client data that a business enters or receives in the platform (client records, bookings), that business is the controller and FYND processes that data only on its behalf, as a processor.

2. What data we process

Account data: name, email, password (stored encrypted — we cannot see it), phone (optional), role.

Business data: business name, category, description, address and location, schedule, services and prices, images, team.

Booking data: service, date and time, specialist, the client's name and contact details, notes.

Payment data: subscriptions are processed by Stripe; FYND never stores card numbers. We keep only the subscription status and Stripe identifiers.

Minimal technical data needed to run the service (e.g. server logs, auth token). We use no tracking or advertising cookies.

Data from the mobile apps (iOS and Android), only if you use them: (a) a push-notification token — a device identifier issued by Apple or Google through the Expo service, kept while you are signed in and used solely to deliver the notifications you enabled (confirmations, reminders, invitations); (b) the device's approximate location — requested only while the app is open and only if you allow it, to show nearby salons and practices and to place your business address on the map; we do not store it on our servers and never track location in the background; (c) photo-library access — only for the photos you pick for your business page (cover, logo, gallery, team, services); we do not read or scan the rest of your library.

3. Purposes and legal bases

Providing the service (accounts, bookings, notifications) — performance of contract (art. 6(1)(b) GDPR).

Billing and payments — performance of contract and legal obligations (art. 6(1)(b) and (c)).

Security, abuse prevention, support — legitimate interest (art. 6(1)(f)).

Operational messages (e.g. confirmations, appointment reminders) — performance of contract. We send no marketing emails without consent.

Push notifications — your consent given through the system permission (art. 6(1)(a)), plus performance of the contract for their content; withdraw it any time from your phone settings or the in-app notification preferences. Location — consent through the system permission (art. 6(1)(a)), revocable any time from your phone settings; the app works without it. Photos — consent, at your choice, for each image you upload.

4. Who we share data with (processors)

Supabase (database hosting and authentication), Stripe (payment processing), Vercel (application hosting). These providers process data only on our instructions under data-processing agreements. Some transfers may involve countries outside the EU, based on standard contractual clauses.

We do not sell your data and do not share it with third parties for marketing.

For push notifications in the mobile apps: Expo (Expo Application Services, Inc.) relays delivery, and Apple Push Notification service / Firebase Cloud Messaging (Google) deliver it on the device. They receive the device token and the notification content, nothing else.

5. How long we keep data

For as long as the account is active. When you delete your account (possible anytime in the app), account data and — for businesses — all business data are permanently removed. Financial-accounting records are kept for the legally required periods.

The push-notification token is deleted on sign-out or account deletion and replaced automatically when the device renews it. Location is not stored at all. Photos remain as long as you keep them on your business page or until the account is deleted.

6. Your rights

You have the right of access, rectification, erasure ("right to be forgotten"), restriction, portability and objection. You can exercise erasure and export directly in the app or write to admin@fynd.tech; we respond within 30 days.

You may lodge a complaint with the Romanian supervisory authority ANSPDCP — dataprotection.ro.

7. Security

We use encryption in transit (HTTPS), encrypted password storage, per-business data isolation at the database level (row-level access policies) and least-privilege access. No system is perfectly secure; if a breach affects your rights we will notify you as required by law.