1. Scope and roles
These Data Processing Terms apply when you use SharelyApp as an owner and keep personal data about other people in it, such as your customers and the contacts you add to appointments (“Customer Data”). They form part of our Terms of Service and, on data protection, prevail over them.
For Customer Data you are the controller and Alexteh Solution SRL, M. Lermontov 8, apt. 1, Balti, Moldova (IDNO 1009602004114, D-U-N-S 535205387) is your processor, within the meaning of the EU General Data Protection Regulation (GDPR), the UK GDPR and the data protection law of the Republic of Moldova, as they apply.
Customers’ own sign-in accounts and profiles on the booking pages are controlled by us, as described in our Privacy Policy. When a customer books with you, the booking and the details given for it become Customer Data in your work profile.
2. Details of the processing
| Topic | Details |
|---|---|
| Subject matter and purpose | Providing SharelyApp to you: booking pages, requests, appointments, customer lists, reminders and notices, notifications, calendar sync and the other features you use. |
| Duration | For as long as you use SharelyApp, until the data is deleted as described below. |
| Nature of processing | Collecting through booking pages, storing, organising, displaying, encrypting, sending messages, exporting to services you connect, and deleting. |
| Data subjects | Your customers and prospective customers, and other people whose details you add to SharelyApp. |
| Types of personal data | Names, phone numbers and email addresses; appointment and request details such as service, time, title, notes and status; can’t-attend notices; whether you trust or block a customer; and the content and delivery status of messages sent to them. |
| Special categories | None intended. You should not add health or other special category data unless it is strictly necessary and you have a lawful basis. |
3. What we commit to
- Instructions: we process Customer Data only on your documented instructions, which are these terms and the way you use and set up SharelyApp’s features, such as choosing to send a reminder or connecting a calendar. If we believe an instruction breaks data protection law, we will tell you. We may also process data where the law requires us to, and will tell you unless the law forbids it.
- Confidentiality: people who can access Customer Data are bound by confidentiality.
- Security: we apply appropriate technical and organisational measures, including encryption in transit, encryption of names and contact details at rest with a separate key, passwordless sign-in, recent-sign-in checks for destructive actions, separation of each owner’s data, limited production access, and logs that exclude message content and contact details.
- Data subject requests: SharelyApp lets you find, correct, cancel and delete appointments and customer entries yourself. If a request reaches us directly, we will pass it to you, and help you answer it where you need us to.
- Breaches: we will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information we have, so you can meet your own obligations.
- Assistance: we will reasonably help you with data protection impact assessments and consultations with authorities, as far as they concern SharelyApp.
- Demonstrating compliance: on request we will provide the information needed to show we meet these terms. Audits are carried out first through that information and, where still necessary, with reasonable notice, no more than once a year and at your cost. Write to contact@sharelyapp.com.
4. Sub-processors
You authorise us to use the service providers below. We bind each of them to data protection obligations that protect Customer Data at least as well as these terms, and we remain responsible for them.
| Provider | What for | Data | Location |
|---|---|---|---|
| Cloud infrastructure provider | Runs our servers, databases, file storage and backups | All data described in the Privacy Policy | Available on request |
| Cloudflare | Delivers our website and booking pages, DNS and protection against attacks | IP address, browser and request details | Global network |
| Amazon Web Services (Amazon SES) | Sends emails: sign-in codes, booking emails and reminders | Email address, the email’s content | Frankfurt, Germany (EU) |
| sms.md | Sends text messages to Moldovan numbers and phone verification codes | Phone number, the message’s content | Moldova |
| Twilio | Sends text messages to numbers outside Moldova, where that is enabled | Phone number, the message’s content | United States |
| OpenAI | Generates AI drafts and suggestions when you use the assistant | Business name, languages, services, prices, working hours and your instructions. No customer or appointment data | United States |
| Sign in with Google; Google Calendar export if you connect it | Name, email, Google account ID, profile photo; the appointments you export | United States and others | |
| Apple | App Store subscriptions and purchases; Sign in with Apple when it is offered | Purchase and transaction identifiers; name and email (or a private relay address) | United States and others |
| Meta | Facebook Login, where it is offered | Name, email, Facebook user ID, profile photo | United States and others |
OpenAI receives no Customer Data. Google, Apple and Meta process data for sign-in and purchases as independent providers, and Google also for Google Calendar export when you connect it.
Before we add or replace a sub-processor that handles Customer Data, we will update this page and change its date. If the change is significant we will also tell you in the app or by email. If you object on reasonable data protection grounds, tell us; if we can’t resolve it, you can stop using SharelyApp and delete your account.
5. Services you connect
When you connect Google Calendar, share your private calendar link, or connect an AI chat app such as ChatGPT or Claude, you instruct us to send Customer Data to that service. Those services are not our sub-processors: you choose them, and their use of the data is governed by your own agreement with them. Make sure you have a lawful basis for sharing your customers’ data with them.
6. International transfers
We are based in the Republic of Moldova, and some sub-processors are in other countries. Where data protection law requires a transfer mechanism for Customer Data, such as for transfers from the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses or another recognised safeguard. On request, we will sign the Standard Contractual Clauses with you.
7. Your obligations
- Have a lawful basis for the Customer Data you keep and for the messages you send through SharelyApp, including consent where the law requires it.
- Tell your customers how you use their data, for example in your own privacy notice.
- Only give us instructions that comply with the law.
- Keep Customer Data accurate and limited to what you need, and avoid special category data unless strictly necessary.
- Answer your customers’ requests about their data. SharelyApp gives you the tools to do so.
8. Deletion at the end
When you delete an appointment, a customer entry, a work profile or your account, we delete the related Customer Data from our live systems. Limited records, such as records of messages already sent and encrypted backups, are kept for a short period and then deleted, as described in our Privacy Policy and Data Deletion page. Record anything you need to keep before you delete it.
9. Contact
Data protection questions: contact@sharelyapp.com.