ExploreGuidesBlogLog in
Legal

Privacy policy

Last updated: 20 October 2026.

Data controller

Reserrva, operating from Spain, is the data controller for account data and for the businesses that use the platform. For any question about this policy or your data, write to hola@reserrva.app.

If you booked an appointment with a business, that business (for example the barbershop, studio or practice) is the controller of your data: Reserrva processes it on the business's behalf, as a processor, only to manage the appointment and notify you of changes. You can exercise your rights with the business or by writing to us; we will handle it with them.

Legal basis

  • Performance of a contract: providing the booking calendar, charging the subscription, sending confirmations and booking notices.
  • Legal obligation: keeping billing records.
  • Legitimate interest: platform security and aggregated usage analytics, including cookieless measurement with Google Analytics.
  • Consent: optional notifications you request (for example, an alert when a slot opens), measurement with Google Analytics cookies, usage analysis with Microsoft Clarity and measuring our ads with the Meta Pixel.

What data we process

  • Account data: name, email, phone, language and, if you sign in with Google, the basic profile data from that account.
  • Business data (if you are an owner, admin or staff member): business name, address, hours, services, prices and the data needed for billing through Stripe.
  • Customer data for people who book with a business: name, phone and, if they provide it, email.
  • Appointment data: service, staff member, date, time, price and status.
  • Technical data: IP address, device type and pages visited, for security and aggregated analytics.

Who we share data with

We use the following processors, each limited to what its function requires:

  • Supabase (European Union): database and authentication.
  • Vercel: hosting for the web application.
  • Stripe: payment and subscription processing.
  • Binance Pay: subscription payments in Venezuela (transaction data only).
  • Resend: transactional emails (confirmations and booking notices).
  • Google Maps: maps and geolocation on the public booking page.
  • YouTube (Google Ireland Ltd.): videos a business shows in its service galleries. They load only when you open one in a gallery or, if you accepted in the cookie notice, when it comes up in a gallery; never in the service list. YouTube then receives your IP address and browser data, and its privacy policy applies.
  • Instagram (Meta Platforms Ireland Ltd.): posts and reels a business shows in its service galleries. They load only when you open one in a gallery or, if you accepted in the cookie notice, when it comes up in a gallery; never in the service list. Instagram then receives your IP address and browser data, and its privacy policy applies.
  • Vercel Analytics: aggregated site-usage analytics, without cookies.

None of these providers use your data for their own advertising purposes. We do not sell data to third parties.

Meta (Meta Pixel), only with your consent. On our Venezuela campaign pages and when a Venezuelan business finishes signing up, if you accept advertising cookies, Meta Platforms Ireland Ltd. receives data about your visit (pages viewed, the start of the free trial, browser identifiers and IP address) to measure and improve our Facebook and Instagram ads. Meta acts as a joint controller for that processing, may use this data under its own policy and may transfer it outside the EU. If you decline, the Pixel is not loaded.

Google Analytics. On the home page, the blog and our campaign pages, Google Analytics (Google Ireland Ltd.) loads even if you do not accept measurement cookies. It sends Google the page address and title, the referring link or campaign, the buttons you click, screen size, browser information and your consent status. Google also receives your IP address during the connection; Google Analytics does not store it.

Without your acceptance, Google Analytics does not read or write cookies or use the browser's local storage. It uses a random identifier held only in browser memory while the page is loaded. If you accept, that same identifier is stored in its cookies (_ga), which allow it to recognise your later visits.

Microsoft Clarity, only with your consent. On those same pages, if you accept measurement cookies, Microsoft Ireland Operations Ltd. (Microsoft Clarity) records how you use them (clicks, scrolling and mouse movement), masking sensitive data you type by default. If you decline, it is not loaded.

We use Google Analytics and Microsoft Clarity only to learn what works on those pages: no Google signals and no ad personalisation. They may transfer this data outside the EU. They are not loaded in the business panel, sign-up, sign-in or businesses' booking pages.

Google Calendar and Google Meet

If you are a professional, you can connect your Google Calendar from Settings. Only then, and with your explicit permission, Reserrva accesses this data from your Google account:

  • Your Google email, to show which account is connected.
  • Your busy times (calendar.freebusy scope): only the start and end of each busy interval, with no titles, guests or details. We use them so those times are not offered on your booking page. We keep each date's intervals until the day after that date; after that, a scheduled task deletes them.
  • The events Reserrva creates (calendar.events scope): when someone books you, we create an event on your calendar; for a video-call appointment it has a Google Meet link, and if the person who booked gave an email, they are added as a guest. We update or delete it if the appointment changes or is cancelled. We do not read, edit or delete events Reserrva did not create.

Access tokens are stored encrypted and used only by our server. This data is used only for this feature: it is not sold, not used for advertising and not shared with third parties, except the processors listed above that run the service. You can disconnect Google Calendar from Settings at any time; we immediately delete the tokens and the stored busy times. You can also remove access from your Google account's security settings.

Reserrva's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep data

We keep your data while your account is active. If you cancel or delete your account, we keep billing data for the period required by Spanish commercial and tax law, and delete the rest within a reasonable time, unless the law requires us to keep it longer.

Exporting appointments and requesting other data

The business owner can download a CSV from Stats → Export CSV, selecting a period with appointments. It includes date, time, professional, service, customer name and phone, status, source, price and currency. This is an appointment export; it does not include complete customer records, private notes or reference images.

To request other data or portability, email hola@reserrva.app with the business and the data you need. The panel does not offer a complete download of customers and references.

Your rights

Under GDPR and Spain's LOPDGDD you can access, correct, delete, restrict or object to the processing of your data, and request portability to another service. Write to hola@reserrva.app and we will respond within the legal deadline. You can also file a complaint with the Spanish Data Protection Agency (aepd.es).

Cookies

  • rv_cc: detects your country, kept for one year, to show the right price and language. Technical, no consent required.

  • Authentication cookies (Supabase Auth): keep you signed in. Technical, necessary for the service.

  • rv_aid: a random visitor identifier, kept for one year, for our own analytics (for example, how many visits end in a sign-up). It is a first-party measurement cookie: it is also set if you choose "Reserrva only", and it is not sent to Google, Microsoft or Meta.

  • rv_ft: the first page you landed on, the referring site and the campaign parameters (UTM and, if present, gclid), kept for one year, to know which campaign brings each business that signs up and, if that page was for one type of business (barbershops, tattoo studios…), to preselect it when you create your business, from another device too, since it is saved to your account when you sign up. First-party, also set if you choose "Reserrva only", and not sent to third parties.

  • rv_onboarding_kind: remembers for one day the type of business you picked on one of our pages, to preselect it when you sign up. Technical.

  • Measurement cookies (Google Analytics, e.g. _ga; Microsoft Clarity, e.g. _clck and _clsk): only on the pages above and only if you accept them. Without them, Google Analytics works without cookies, as described above.

  • Advertising cookies (Meta Pixel, e.g. _fbp): only on the pages above and only if you accept them.

  • rv_google_nudge_off: remembers for 180 days that you chose "Not now" on the panel's Google Calendar notice, so it is not shown again in that browser. Technical.

  • rv_consent: stores for 180 days your choice about measurement and advertising cookies and about Instagram and YouTube content on business pages (one choice for all of them).

  • rv_consent_media: sits alongside rv_consent for 180 days and records that your choice included Instagram and YouTube content. Technical.

  • rv_meta_trial: a one-time technical marker, kept for one day, used to record the start of a free trial; it is deleted once used and only sent to Meta if you accepted advertising cookies.

Outside those pages we do not use third-party measurement, advertising or cross-site tracking cookies. You can change or withdraw your consent at any time in (also in the footer of our public pages), by clearing reserrva.app cookies in your browser or by writing to us.

Changes to this policy

We may update this policy. The "last updated" date shows the current version; significant changes are communicated by email or inside the panel.

Contact

hola@reserrva.app