Privacy Policy

3.1 Website Delivery and Infrastructure (Bunny.net)

For the delivery of our website and the underlying infrastructure, we use services from BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia. Specifically, we use:

• CDN (Content Delivery Network): Delivery of static website files (HTML, JavaScript, CSS) via a globally distributed server network
• Edge Scripting: Server-side logic executed at Bunny.net nodes
• Storage: Storage of static files and assets

With each page request, Bunny.net processes technical connection data, in particular IP address, timestamp, requested URL, and browser and device information. This data is technically required for website delivery. Under the data processing agreement, Bunny.net is contractually obligated to hold all raw log data including personal information exclusively in working memory (RAM) and to automatically delete it after 20–30 seconds. Bunny.net stores no IP addresses or connection data permanently.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of the website).

Place of processing: The website is delivered exclusively via Bunny.net nodes located in EU member states. No connection data is transferred to third countries. This data is held exclusively in the working memory (RAM) of the respective CDN nodes and is automatically deleted after 20–30 seconds; no permanent storage takes place. Bunny.net contractually guarantees that all sub-processors employed implement appropriate technical and organizational safeguards in accordance with GDPR requirements.

Further information: bunny.net/privacy (opens in new tab) and bunny.net/gdpr (opens in new tab)

3.2 Application Data (netcup)

All user data – in particular account data, appointments, and booking information – is processed and stored exclusively on servers of netcup GmbH at its locations in Nuremberg (Germany), Vienna (Austria), and Amsterdam (Netherlands). No transfer of this data to third countries takes place.

Processing currently takes place exclusively at the Nuremberg location.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) for the processing of user data such as account data, appointments, and booking information; Art. 6(1)(f) GDPR (legitimate interest) for the technical operation and ensuring the security and integrity of the application infrastructure.

4.1 Public Website (Landing Page)

When visiting our public website, only the technical connection data described in Section 3.1 is processed by Bunny.net. No personal data is collected beyond this.

4.2 Registration and User Account

To use Terminaro, registration is required. We process the following data:

• Name
• Email address
• Password (stored hashed)
• Account-related settings and configurations
• Date and version identifier of the accepted terms of service
• Date and version identifier of the accepted data processing agreement, where the contract incorporates it
• A record of each individual acceptance, including the channel it came in through: given during registration, given on the acceptance page in your account, or adopted from a previously stored acceptance

Legal basis: Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures taken at your request). The information is required to use the service; where a registration is never completed, no contract comes about and the pre-contractual alternative applies.

Retention period: Data is stored for the duration of account usage. After termination, data is deleted within 30 days. That deadline is postponed where a documented retention exception is recorded for the account – which is the case in particular where statutory retention obligations apply, notably Sections 257 HGB and 147 AO, which may require retention of commercial and tax-relevant records for up to 10 years – and it is postponed for 56 days after the most recent payment made by SEPA direct debit, for as long as that payment can still be reversed.

Incomplete registrations: A registration whose email address is never confirmed is deleted 7 days after sign-up. A registration that is confirmed but never completed is deleted 30 days after confirmation. In both cases no account is created and no registration data is kept.

4.3 Session Management

In the logged-in area, Better Auth uses technically necessary session mechanisms so users can remain signed in across the frontend and the Convex authentication endpoints without having to enter their password on every page visit.

This includes technically necessary session cookies and, depending on the authentication flow, additional browser-side session data. These mechanisms are used exclusively for authentication and are not used for tracking or advertising purposes.

Legal basis: Section 25(2) No. 2 TDDDG (technically necessary for the provision of the service). Consent is not required.

4.4 Booking Form

Persons who book an appointment through a publicly shared booking form submit the following data:

• Name (required)
• Email address (required)
• Visitor language (required)
• Company (optional)
• Phone number (optional)
• Reason for booking (optional)
• Visitor time zone (required)

This data is stored to manage the appointment and process the booking. The account holder who provides the booking form is the sole data controller for the personal data of the persons booking through it. Terminaro processes this data exclusively as a data processor on behalf of the account holder pursuant to Art. 28 GDPR and acts solely in accordance with the account holder's instructions. Persons who book an appointment may exercise their data subject rights (e.g., access, rectification, erasure) with the respective account holder.

The visitor language is stored and used to send the booking confirmation in the visitor's language.

If provided, the company field is used to assign the booking to the visitor's business context, the phone number is used for short-notice contact in case of changes or cancellations, and the reason for booking is used to prepare for the appointment.

The visitor time zone is used to display the booked appointment in the visitor's local time, in particular on the booking page, in the cancellation flow, and in booking confirmation emails.

A data processing agreement pursuant to Art. 28 GDPR is concluded with account holders who use Terminaro for the processing of booking data. This agreement can be viewed at terminaro.eu/en/dpa.

Legal basis: Art. 6(1)(b) GDPR (implementation of pre-contractual measures at the request of the data subject).

Retention period: Booking data is stored until 90 days after the appointment date and then automatically deleted. The current product setup assumes that no statutory retention obligations apply to this booking data.

A reference to this privacy policy is displayed on the booking form.

4.5 Waitlist

Our website offers the option to sign up for early access to Terminaro via a waitlist. We collect only the email address of the person signing up.

Purpose: Notification about the launch of Terminaro.

Legal basis: Art. 6(1)(a) GDPR (consent). Registration is voluntary.

Retention period: The email address is stored until the launch of Terminaro, but no later than January 1, 2027, or until consent is withdrawn — whichever occurs first. Withdrawal is possible at any time by contacting: privacy@terminaro.eu

4.7 Billing and Payments

For paid plans we work with two service providers. Fakturia, operated by Luminea IT Services GmbH in Germany, creates contracts, invoices and dunning notices on our behalf. Stripe Payments Europe, Limited in Ireland processes card payments and SEPA direct debits. Card numbers and IBANs are entered directly with Stripe; Terminaro never receives or stores them.

In our own system we store only the data required for billing, tax evidence and feature access: a reference to your customer record at the payment provider, a reference to your contract at the billing provider, your current plan, the subscription status, the payment state (dunning level and the end of the grace period), the payment method type (card or SEPA direct debit), a reference to the payment method or SEPA mandate, the current term end, the evidence of where you are established (the country of your billing address, each country you have stated together with the date you stated it, and the country of your payment method), the details of the SEPA mandate (the mandate reference, our creditor identifier, and the acceptance with its time, IP address, browser identification and the address of the mandate page), the record of the check of your VAT identification number, and — on the tax evidence record and on the mandate record — a keyed pseudonym of your email address.

That last item exists for one reason. Those two records outlive your account, and nothing else in them would lead from you to them once the account is gone. The pseudonym is computed from your email address with a secret only our server holds, so the address cannot be read back out of it, and it is what lets us find the records again in order to answer a request for access or an objection. It has a limit we would rather state than conceal: it is formed from the address on file at the moment of the payment, so it does not find the records of payments you made under an email address you have changed since.

Invoices, payment details and the SEPA mandate document itself are held by these providers. Your IBAN and your card number never reach Terminaro. The reference to the mandate and the acceptance details listed above are stored by Terminaro as well, because they are evidence we have to be able to produce ourselves, independently of any provider.

Purpose: Provision of paid plans, invoicing, determining and evidencing the place of taxation, and statutory bookkeeping.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) for processing payments, for the SEPA mandate and for providing the plan; Art. 6(1)(c) GDPR (legal obligation) for retaining invoices and for the tax evidence record we keep for each payment, which holds the evidence of establishment required by Art. 24b of Implementing Regulation (EU) No 282/2011 and the confirmation of a VAT identification number under Section 18e of the German VAT Act (UStG); and Art. 6(1)(f) GDPR (legitimate interests) for the separate mandate record we keep for every direct debit we collect, which we hold in order to be able to show that the collection was authorized should it later be disputed. You can object to processing based on a legitimate interest under Art. 21 GDPR; Section 8 describes how.

Retention period: Invoice data is retained by our billing provider for the statutory bookkeeping periods. Stripe may retain data beyond the end of the contract where longer retention is legally required or permitted, in particular for anti-money-laundering purposes.

Three retention periods, but not for the same data: The mandate data — the mandate reference, our creditor identifier and the details of the acceptance, the IP address among them — is stored in two places, and each of them has its own period. As part of your payment method it serves the direct debit itself: it is deleted together with your account, and only where a SEPA direct debit can still be reversed is deletion of the related billing record deferred for up to eight weeks so a chargeback can be reconciled. For every direct debit we actually collect we additionally keep a separate mandate record — the mandate reference, our creditor identifier, the time of the acceptance, the browser identification, the address of the mandate page and the IP address of that acceptance — which documents that this collection was authorized, and when. That can still matter long after those eight weeks, because a direct debit disputed as unauthorized can be contested for up to 13 months. We keep the mandate record until claims arising from the collection have become time-barred: three years, counted from the end of the calendar year in which the collection took place (Sections 195 and 199(1) of the German Civil Code, BGB). The 13 months lie inside that period. Those two are the only places your mandate data is held. The copy on your payment method goes when your account does; the mandate record goes three years after the year of the collection — unless a tax audit is pending, which suspends that deletion by the same switch, and for the same reason, as it suspends the deletion of the tax evidence record described next. The third period belongs to a record that holds no mandate data at all: the tax evidence record we keep for each payment documents only where you were established at the time of the payment, and we have to keep it for eight years (Section 147 AO). That period starts on January 1 of the year following the payment, and the records are erased year by year once it has run. It does not expire while the records still matter for taxes whose assessment period is still open, in particular while a tax audit is pending (Section 147(3) sentence 5 AO, Section 171(4) AO). The IP address of the mandate acceptance is held with the mandate record and no longer in the tax evidence record, so once those three years have run, the tax evidence record for a SEPA payment carries one item of evidence of establishment fewer than before. Your mandate data can therefore already be gone from your payment method while the mandate record still holds it – and it can be gone from both while the tax evidence record for the same payment is still kept, because that record is about where you were established, not about your mandate. The eight years do not apply to your mandate data.

Account deletion: If you delete your account, neither the tax evidence records nor the mandate records are deleted with it. For the tax evidence records Art. 17(3)(b) GDPR permits this, for the mandate records Art. 17(3)(e) GDPR does, which covers the defence of legal claims. Instead we restrict the processing of both under Art. 18 GDPR, so they are kept solely for the statutory retention obligation and for answering a disputed direct debit, and used for nothing else. The keyed pseudonym of your email address described above is what still leads from you to them after the account itself is gone.

Stripe as an independent controller: Stripe processes part of this data for its own purposes, in particular fraud prevention, anti-money-laundering and identity checks, averting financial loss, and selecting the banks and payment method providers involved. For that part, requests for access or erasure have to be addressed to Stripe under its own privacy policy; we can neither grant access nor arrange erasure there. Where Stripe acts as our processor, it forwards such requests to us.

Note: Our contract for payment processing is with Stripe Payments Europe, Limited in Ireland; Stripe Technology Company Ltd. in Ireland is Stripe's main establishment under the GDPR. Stripe nevertheless transfers personal data to third countries. Transfers to the USA rest on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which Stripe, LLC is certified. Transfers to India, where Stripe runs a group company for support and for specific regulated data, rest on the EU Standard Contractual Clauses. Luminea IT Services GmbH operates from Germany and hosts our billing data in a data center in Nuremberg. The processing by these providers is additionally governed by their own privacy policies.