How I handle trust. In plain words.

Security

• 🔐 TLS 1.3 everywhere (wildcard cert, renews on its own). HTTP redirects to HTTPS with HSTS on.
• 🔑 Passwordless login by magic email link. No password to lose, none to steal.
• 🧾 CSRF tokens on every form that changes something. Strict Referer check on HTTPS.
• 🛡️ Content Security Policy through Talisman (strict script origins). Login and signup rate-limited via Redis.
• 🗄️ Database bound to 127.0.0.1 only, no public port open. Nightly encrypted backup to disk.
• 🕵️ Every important action lands in an audit log (visit added, reward redeemed, settings changed, ghost login).

Reliability

• ⏱️ Hosted on Hetzner, Frankfurt, in the EU. Public health check at /healthz.
• 💾 Nightly pg_dump backup, kept for 14 days. I test the restore myself once a month.
• 📉 If something breaks, the fix ships the same day. I run one product, not fifty.
• 📊 Uptime target 99.5 percent (worst case, about 3.5 hours of downtime a month). No SLA credits yet - I will sign one with the first salon who asks.

Privacy and GDPR

• 🇪🇺 All data lives in the EU (Hetzner, Frankfurt). Nothing leaves the EU/EEA, except email delivery through Brevo, which is EU-hosted too.
• 🚫 No third-party analytics with cookies. No Google Analytics, no Facebook Pixel, no session replay.
• 📤 You can export every client, visit and reward as CSV from Settings, whenever you want.
• 🗑️ A client asks to be forgotten: one click in Clients deletes their row and their whole history with it.
• ⏳ Close your account and you get a 30-day window with full CSV export. After that, everything is deleted for good.
• 📄 Full details in my Privacy Policy.

Sub-processors

These are the third parties that help me run fidel. Nothing else touches your data.

Full details, transfer basis, change notification policy in SUBPROCESSORS.md.

Cookies I set

First-party only. No third-party cookies, no cross-site trackers, no advertising IDs.

How long I keep things

• 👥 Client records - until you cancel your account (or click 🗑 on a specific client). Then 30-day grace window, then hard-deleted.
• 📊 Analytics events - 90 days (funnel windows are 7 and 30 days; the extra buffer allows year-over-year sanity checks and is auto-purged nightly.)
• 📱 Kiosk QR tokens - 5 minutes (rotating anti-fraud); 1 day audit trace after expiry.
• 💾 Encrypted backups - 14 days on disk, then rotated out.
• 📜 Web + app logs - 14-30 days.

Full retention grid in RETENTION.md.

If something goes wrong

I have a written breach response plan with a 72-hour notification deadline to the Romanian supervisory authority (ANSPDCP) per GDPR Art 33, plus direct notification to every affected tenant. RTO 4 hours, RPO 24 hours, tested quarterly.

Full playbook in INCIDENT-RESPONSE.md.

Who owns the data

You do. Your client list is your business, not mine. I never sell it, never share it with anyone else, never train ML models on it, never look at individual client records unless you ask me to help debug something. Export any time, take it anywhere.