Privacy Policy

This policy explains how RZZ Consulting (“we”, “us”) collects and uses personal data when you use Freecita at freecita.com (the “Service”). We aim to collect as little data as possible and never sell it.

1. Who is responsible

Business accounts. For data about businesses that register on Freecita, RZZ Consulting is the data controller.

Customer bookings. When a customer books an appointment with a business, that business is the controller of the customer's booking data and RZZ Consulting processes it on the business's behalf as a processor, solely to provide the Service. Questions about a specific booking should be directed to the business first. In addition, RZZ Consulting keeps its own record of each booking (the customer's name, the business, the service and the time) as a controller, to understand how Freecita is used and to manage its relationship with businesses.

Contact: [email protected]

2. What we collect

Businesses

• Business email address (used to sign in and receive notifications).
• Business profile you choose to publish: name, link, category, description, phone, address, timezone.
• Services, opening hours and days off.
• Team members' email addresses, roles and notification preferences, added by an admin of the business.
• Logo, background image and website you choose to publish, and an optional webhook URL.
• Security records: hashed sign-in and session tokens, IP address and browser user-agent of active sessions.

Customers making a booking

• Name, email address, optional phone number and optional notes.
• The service, date and time booked and the booking status.

Website visitors

• Messages sent through our contact form: name, email, optional business name and phone, topic and message.
• Website analytics on public pages: pages visited, referring page, time on page and a random identifier stored in your browser (see our Cookie Policy). No analytics run in the dashboard or on sign-in or booking-management links.

We do not collect payment card data and we do not use advertising trackers.

3. Why we use it (legal bases)

• To provide the Service — creating accounts, showing booking pages, making and managing bookings, sending confirmations (performance of a contract).
• To answer you and manage our relationship with businesses — contact-form messages, new business sign-ups and booking records kept in our customer-relationship system (legitimate interests).
• To understand and improve the website — aggregated website analytics (legitimate interests).
• To keep the Service secure — preventing abuse, fraud and spam, rate limiting (legitimate interests).
• To comply with the law — where we are legally required to keep or disclose information (legal obligation).
• Service messages — important notices about your account or changes to these terms (legitimate interests). We do not send marketing emails without your consent.

4. Sharing

Customer booking details are shared with the business the customer booked with. We use a small number of infrastructure providers (hosting, database and email delivery) who process data only on our instructions and under appropriate data processing agreements. We may disclose data if required by law. We never sell personal data.

Contact-form messages, new business sign-ups (business name, owner email, category, link) and booking records (customer name, business, service and time — not the customer's email or phone) are stored in our customer-relationship system at crm.polpo-8.com. Website analytics are processed by our analytics service at analytics.polpo-8.com.

If a business configures a webhook, booking details are sent to the address the business chooses, on the business's instructions and under its responsibility.

5. International transfers

Where data is transferred outside the UK or European Economic Area, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

6. Retention

• Sign-in links expire after 20 minutes and are deleted within a day.
• Sessions expire 90 days after your last visit or when you sign out.
• Contact messages and CRM records are kept for as long as needed to answer you and manage our relationship, and deleted on request.
• Business accounts and their bookings are kept until the business deletes its account. Deleting an account immediately and permanently removes the business profile, services, availability and all bookings.
• Backups are rotated and overwritten within 30 days.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, the right to data portability and the right to lodge a complaint with your data protection authority (in Spain, the Agencia Española de Protección de Datos — AEPD; in the UK, the Information Commissioner's Office). To exercise your rights, email [email protected]. If you're a customer of a business using Freecita, we may refer your request to that business.

8. Cookies

We use one strictly necessary cookie to keep business users signed in and, if you pick a language, one preference cookie to remember it. See our Cookie Policy.

9. Children

Business accounts are intended for people aged 18 or over acting on behalf of a business. Bookings for children should be made by a parent or guardian.

10. Changes

We may update this policy from time to time. We'll post the new version here and, for significant changes, notify business users by email.