Privacy policy · DameHora

At DameHora we take your data seriously. This policy explains what data we process, why, who we share it with, how long we keep it and how you can exercise your rights. It has a common part and two annexes, one for people who book an appointment with a business and one for the businesses that use DameHora.

1. Who is the controller

Holder: Teodoro Salas García
Tax ID (NIF): 43141584R
Email: info@damehora.com
Website: damehora.com

For any privacy question, write to us at info@damehora.com. We are not required to appoint a data protection officer and have not appointed one.

2. Two different roles, the business's and DameHora's

DameHora is two things. A website where anyone can look for where to book an appointment, and a calendar, booking and payment program used by businesses that work by appointment, whatever their activity.

When you book with a business, that business is the controller of its calendar, of its customer records and of the service it provides to you. DameHora is its processor. It stores and processes that data on the business's behalf, following its instructions and under a data processing agreement in line with Article 28 GDPR. As processor, it also protects the data with the security measures that agreement requires.

DameHora is the controller, on the other hand, of the processing it carries out for its own purposes, which is this:

The accounts of the people at the businesses, the subscription, its billing and support.
The public website and the contact form.
The overall security of the service and the prevention of abuse, for example stopping automated bookings or checking an email address with a code.
The review invitations you allow when booking, and the publication and moderation of reviews.

For booking security and for reviews, DameHora uses some data from the business's calendar, under the terms of annex 1. Beyond these uses, which we explain here, DameHora does not use a business's calendar data for anything of its own.

3. What we do not do

We do not store card numbers. Subscription payments are processed by Stripe.
We do not use analytics or advertising cookies, or tracking pixels.
We do not sell data or pass it on to third parties to send you advertising.
We do not take decisions about you with legal effects solely by automated means. If something in a booking looks automated, at most we ask you for a code by email.

4. Providers and recipients

We only share data with the providers we need to run the service, always under contract. Each has a different role depending on what it does:

Hetzner Online GmbH (Gunzenhausen, Germany). Hosts the servers, the database and the backups in its European Union data centres. Processor.
Mailjet SAS (Paris, France), part of the Sinch group. Sends the confirmation, reminder, notice, support and account emails, and the review emails. It stores the data in Google Cloud data centres in Germany and Belgium. Processor.
Google Cloud EMEA Limited (Dublin, Ireland), with reCAPTCHA. Protects online booking and the contact form against bots, only if you accept it in the cookie notice. Since 2 April 2026, Google acts as a processor for the data reCAPTCHA collects on our pages, under the Google Cloud terms. Google also processes, as a controller, technical data about the use of its service (device and cookie identifiers, and the IP address) to provide, maintain and protect it, under its Google Cloud privacy notice. Under those terms, it does not use them for personalised advertising.
Google, with Firebase Cloud Messaging. Delivers the app's notifications to the phone or iPad of the businesses that turn them on. It is a processor under the Firebase data processing terms. It also processes, as a controller, technical service data such as app identifiers and the IP address. On iPhone and iPad, the notification arrives through Apple's notification service.
Google, with Google Maps Platform. Shows the map where the business places its location, in Ajustes › Sedes in the app (the app is in Spanish). Google receives the location's address, what is searched on the map, the coordinates and the technical data of the browser of whoever uses it. Google is an independent controller of that data, under its controller-to-controller data protection terms.
Stripe Payments Europe, Limited (Dublin, Ireland). Charges the businesses' subscription. It is a processor when providing the payment service and a controller for its own purposes, such as preventing fraud and complying with financial regulation, under its terms.
Bilteo, the invoicing program with VeriFactu, only when a business subscribes to it and connects it. It is the business's provider, not DameHora's, and DameHora sends it the data of each sale on the business's instruction.
Public authorities and courts, when a law requires it.

If we change provider, we will update this list.

5. Transfers outside the European Economic Area

Our servers, the database and the backups are in the European Union. That does not rule out every transfer, because some providers may process data or access it from outside the European Economic Area. For each flow, the safeguard is this:

Google (reCAPTCHA, Firebase Cloud Messaging and Google Maps) may process data in any country where it has facilities. For the United States, Google LLC is certified under the EU-US Data Privacy Framework. For other countries, its terms apply the European Commission's standard contractual clauses.
Stripe transfers data to Stripe, LLC in the United States, which is certified under the EU-US Data Privacy Framework. Should that framework stop applying, its terms provide for the standard contractual clauses.
Mailjet stores the data in the European Union. A company of its group in the United States and some support providers may access it, under the standard contractual clauses and, for that company, also the Data Privacy Framework.
Hetzner processes the data only in the European Union.

You can ask us for more information about these safeguards at info@damehora.com.

6. Your rights

You can ask us at any time for:

Access, to know what data of yours we process.
Rectification, to correct inaccurate data.
Erasure, so that we delete your data when it is no longer needed.
Objection, so that we stop processing it on the basis of legitimate interest, unless there are compelling legitimate grounds.
Restriction, so that we keep it without using it while we resolve a complaint.
Portability, to receive the data you gave us in a structured format.
Withdrawal of your consent when processing is based on it, without affecting what was done before.

Write to info@damehora.com saying which right you want to exercise. We may ask you to prove your identity. We will reply within one month. If your data is processed by a business because you booked with it, we will pass your request on to the business and help it reply to you.

If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).

7. Security

We use encrypted connections (HTTPS), store passwords encrypted so that nobody can read them, separate each business's data so that none can see another's, and limit what each team member can see according to their role. Important actions are logged. If a personal data breach occurs, we notify the authority and, where required, the people affected.

8. Minors

DameHora is not intended for children under 14. If a minor needs to book, their mother, father or guardian should do it.

9. Changes to this policy

If we change anything important, we will publish a new version with its date and, if you are a business, we will let you know in the app.

Annex 1. If you book an appointment with a business

What data

What you type when booking, which is your name, phone and email.
The appointment's details, which are the business, location, services, professional, day, time, language and the status of the appointment.
What the business later notes in your record, such as your visit history or internal notes. If the business records health data, for example an allergy that matters for the service, it needs a legal basis and an exception under Article 9 GDPR, and DameHora processes it only on its behalf. The booking form does not ask you for it.
If you tick the review invitation box, the date, the appointment and the version of the text you accepted, and the date you withdraw it if you do.
If you review your visit, your rating, your text, your photos and your first name with the initial of your surname.
If you report a review to us, the reason, what you write, your name, your email and your good-faith statement.
Technical data to prevent abuse. A fingerprint of your IP address, stored in an unrecognisable form for one hour, and, if you accept reCAPTCHA, the score it gives each submission, which we do not store.
If you confirm your email with a code, a signed mark in your browser for 180 days so we don't ask you again at that business.

Purposes and legal basis

To manage your booking, send you the confirmation, the reminder 24 hours before and the link to view, change or cancel it. Controller, the business. Basis, the service contract you make with it.
To protect online booking against bots and fake bookings, for example by asking you for a code by email when something does not add up. Controller, DameHora. Basis, its legitimate interest in preventing abuse of the service.
To invite you to review your appointment. Controller, DameHora. Basis, your consent. We only invite you if, when booking online, you tick the box "I'd like DameHora to email me to rate my visit", which is separate and left unticked. It covers only that appointment, not promotions or other visits. You can withdraw it from your appointment's link before you receive the invitation, and each invitation has a simple, free link to unsubscribe.
To publish your review on the business's page, in the DameHora directory and in the rating summaries. Controller, DameHora. Basis, the review service you ask us for when you submit it.
To check reviews, handle reports, remove those that break the rules and prevent fake reviews. Controller, DameHora. Basis, its legitimate interest in reliable reviews and the legal obligation to handle notices of illegal content.

Who sees it

The business you book with and the members of its team with permission. Your review, with your first name and surname initial, is public on the business's page. Your phone and email, never. If you report a review, we do not publish your identity or tell its author.

How long

The business keeps your appointment data for as long as it needs to serve you and meet its obligations. If the business stops using DameHora, it is deleted when its read-only period ends, as annex 2 explains. Reviews are published for as long as the business has its page, and you can ask us to remove yours. A removed review is kept unpublished only for as long as it may be needed to review the decision or handle a complaint. Reports about reviews and the proof of your consent to invitations are kept with the appointment and the decision they relate to.

Annex 2. If you use DameHora in your business

What data

From your account, your name, email, phone and password (encrypted). If you sign in with Google, we receive your name and email.
From the business, its name, company name and tax ID for the invoice, locations, opening hours, services, prices, team, logo and photos.
From the subscription, the active professionals, seats, payment status, charges and the business's tax details (company name, tax ID and address), which are shared with Stripe. Card details are stored by Stripe, not DameHora.
Usage and security data, which is activity logs and the IP address and browser when signing in, accepting the agreements or making important changes.
If you write to us, your name, email and message.
If you write to support from the app, your message, the screenshots you attach and technical data about the screen, the browser and the app version.
If you turn on notifications on a phone or on the counter iPad, the identifier Firebase gives that device, its name and the app version.

Purposes and legal basis

To provide the service, keep your account and give you support. Basis, the contract.
To send the app's notifications to the phone or iPad that turns them on. Basis, the contract. You can turn them off whenever you like.
To charge the subscription and issue invoices. Basis, the contract and tax obligations.
To protect the service, detect unauthorised access and be able to prove who accepted each agreement and when. Basis, legitimate interest and legal obligation.
To tell you about changes to the service, prices or these terms. Basis, the contract.
To send you commercial news, only if you give us your separate consent. You can withdraw it whenever you like.

How long

The subscription ends on the day the paid period ends if the business cancels it, on the day the trial ends if it does not subscribe, or on the day the 7-day grace period ends if a payment is not resolved. From that day, the business has 90 days of read-only access to review its data and ask us for a copy in a structured format. We tell it the exact closing and deletion date. A missed payment does not keep the account stored forever, it counts the same as cancelling.

When the 90 days are over we delete the account and the business's data, including its customers' and team's, and we ask our providers to delete what they keep on our behalf. Backups expire at most 15 days after that deletion. In the meantime they are isolated and not used, and if one had to be restored, we would apply the deletions again before using it. That is why the data may remain in a backup for up to 15 days after day 90.

Separately, and blocked, we only keep what a law requires us to keep or what is needed for a specific claim, such as our invoices to the business (6 years for commercial records and 4 years for tax records). Our tax obligations do not justify keeping the business's calendar.

Contact form messages are deleted after 12 months. Screenshots attached to support messages are deleted 365 days after the conversation is closed, or earlier once they are no longer needed, unless there is an open claim. The text of support conversations is deleted with the account.

The business's team

When the business adds a team member, the business is the controller of that data and DameHora its processor, just as with customers.