Privacy

Who is responsible and how to reach us

This website and the booking platform are operated under the ClevBook brand. For anything concerning your data, write to contact@clevbook.com — all contact goes through this address.

The company behind ClevBook is currently being entered in the commercial register. As soon as the registration is complete, we will add the company name, address and representatives here.

When you book with a venue — say, a tennis court or a yoga studio — that venue decides what it needs your booking details for. ClevBook provides the platform it uses to do so.

When you book a slot or sign up for a course

For a booking, a course sign-up or a place on a waiting list we collect: first name, last name, phone number and e-mail address, together with the chosen slot and the language you booked in.

The venue you book with sees these details — it needs them to run the appointment and to reach you if something changes. Other venues never see your data. The legal basis is the performance of the contract covering your booking (Art. 6(1)(b) GDPR).

When you run a venue account

For a venue account we store your e-mail address. You sign in through a link we send you by e-mail — we do not store a password. Added to that are the details of your venue, such as its name, address, offers and prices; they appear publicly on your booking page, which is what they are for.

When you write to us via "Something's missing"

Through this form you can tell us which trade or feature you are missing. We store exactly this: your e-mail address, your message, the time, your language, and whether the message came from the website or from the setup assistant. No IP address, no browser fingerprint.

We need your e-mail address for a single purpose: to reply to you (Art. 6(1)(b) GDPR — steps taken at your request). The messages cannot be retrieved through the website, and venues do not see them either.

When you join the waiting list

As long as ClevBook is not open to the public, you can join a waiting list. We store exactly: your country, your e-mail address, your optional text, your language, the time and whether you clicked the confirmation link. No IP address, no browser fingerprint.

We need your e-mail address for a single purpose: to let you know as soon as you can get started (Art. 6(1)(b) GDPR — steps at your request). Entries without confirmation are deleted again. The list cannot be accessed via the website, and businesses do not see it.

E-mails from ClevBook

We send booking and course confirmations and reminders through the Swiss provider Infomaniak. Such an e-mail contains your name, the appointment, the venue, and the link you can use to manage your booking. We do not send marketing e-mails.

When you pay online

If you pay online, the payment runs through Stripe, PayU or Przelewy24, depending on the venue. We pass your e-mail address, the amount, a description of the booking and a booking reference to the payment provider. You enter your card or account details directly on the payment provider's own page — ClevBook never sees them.

The money goes directly to the venue you booked with. ClevBook takes no commission and holds no funds.

Protection against automated access

Before a booking, course sign-up, feedback message or waiting-list entry is submitted, Cloudflare's Turnstile service checks in the background that a human is at work. Your browser loads a script from Cloudflare (a US provider certified under the EU-U.S. Data Privacy Framework); Cloudflare sees your IP address and characteristics of your browser, and our server sends your IP address once for verification. This happens only when you use such a form — not when you merely view a page.

In addition, our database counts booking attempts per IP address to slow down mass bookings. These entries are deleted after two hours at the latest. The legal basis is our legitimate interest in a reliable booking system (Art. 6(1)(f) GDPR).

Where your data lives

The application runs at Infomaniak in Switzerland. Like any host, Infomaniak sees the technical details of every request, such as the IP address and the address requested.

The database is hosted by Supabase in a data centre in Zurich (region eu-central-2). Supabase is a US company; the stored data itself resides in Switzerland. Venue logos and photos are loaded by your browser directly from Supabase.

If you click a venue's address, your maps service opens (Google Maps or Apple Maps). Only with that click does the maps service learn your IP address and the address you looked up.

Cookies

ClevBook sets only cookies the service needs to run: your language choice (clevbook.locale — only if you switch the language by hand), a random identifier against mass bookings (clevbook.ct), a one-hour cookie holding the categories you picked during registration (cb-kategorien), and the sign-in session for venue accounts.

None of these cookies follows you across other websites, and none serves advertising or statistics. That is also why there is no cookie banner.

How long we keep data

Booking and course data remains stored for as long as the venue needs it — for instance to account for appointments, payments and cancellations. The counter of booking attempts per IP address is emptied after two hours at the latest. Messages from "Something's missing" are deleted no later than twelve months after they arrive.

If you want us to delete your data, write to contact@clevbook.com.

Your rights

You have the right to know what data we hold about you, to have it corrected or deleted, to restrict its processing, to object to processing, and to receive your data in a portable format. Write to contact@clevbook.com — we will reply as quickly as we can.

You also have the right to lodge a complaint with a data protection supervisory authority, for instance the one where you live. For people in Switzerland, the Swiss Data Protection Act (FADP) applies as well; the rights described here are yours under it too.

What ClevBook does not do

No analytics or tracking services, no advertising networks, no selling of data, no automated individual decisions, no profiling. Even the website's fonts are served by us — your browser contacts no third-party servers for them.