1. Who is responsible for what
You are the controller of client data — you decide what you process and why (including allergy notes). edapi is the processor: we store and process under the Data Processing Agreement (DPA), which is part of the Terms.
The controller of your own account data (name, email, sign-ins) is edapi. It is all set out in the Privacy Policy and the DPA (links at the bottom of the page).
2. A client asks for a copy of their data or deletion
Copy: client card → "Download data" (JSON or CSV) — all their data, visits, consent history, emails, reviews. Hand the file to them yourself; the GDPR deadline is a month, in the system it takes a minute.
Deletion: card → "Delete data" — the dialog lists what disappears and asks you to type the client's name. Name, phone, email, notes, allergies, message and review texts are removed irreversibly; visit times and amounts remain without personal data (your accounting needs them).
After deletion the client receives no more emails, and a new booking with their phone creates a new card — the history is not linked.
3. The full salon archive
"Salon → Data": "Download all salon data (JSON)" — profile, services, team (without passwords), clients, bookings with payment facts, consents, reviews, campaign facts, photo list. For quick work in Excel — two CSVs: clients and visits.
The archive contains personal data — keep it as carefully as the system itself (not on a shared drive without a password, not forwarded via Messenger).
Every member downloads a copy of their own data (account, sessions, their visits): "Account → My data".
4. Consent log
On the client card you see the consent history: date, channel, status (agreed / opted out), source (booking form, email link, import, anonymisation). This is your evidence if the client or a supervisory authority asks why a newsletter was received.
Consent is always a pair: client + your salon + channel. Other salons' consents are invisible to you and do not apply.
5. Reports about public reviews (DSA)
Every public review has a "Report" link: anyone — a client, you, an outsider — can report defamation, insults, disclosed personal data or a fake review. edapi (not the salon) reviews the report; the reporter receives a number and a reasoned decision, usually within 7 days.
If a review is hidden, its author receives an email with the reasons (the EU Digital Services Act requires it), and your log gets an entry "Review hidden" with the basis "DSA" and the report number. The review and rating stay visible to you — only the public display disappears.
An opinion about the service ("did not like it, expensive") is not a violation — such reviews stay. You can also hide any public review on your page yourself at any time ("Reviews" → hide); making it public again — no.
We keep the reporter's name and email for 365 days after the decision, then anonymise them; the decision and reasons themselves remain.
6. How long we keep things
Account and client data — while you use the system. A paused account: 90 days + a warning + 30 days until anonymisation. Email sending records — 180 days (so the same email does not go out twice). The activity log remains, but after personal data deletion — without it.
Questions about data, client requests you do not know how to fulfil, supervisory authority enquiries — support@edapi.io, we reply within 1 business day.