Possa
Log in

Privacy Policy

Effective:

1. Controller

The controller of your personal data is the operator of Possa. For anything privacy-related, write to kontakt@possa.mk.

We process data in line with the Law on Personal Data Protection of North Macedonia (Official Gazette No. 42/2020).

2. What we collect

  • When you book: your name, phone number, email (optional), a note to the salon (optional), and the chosen service, salon and time.
  • If you create an account: your sign-in email, name and language.
  • If you turn on device notifications: a technical push subscription, your language and the browser/device type (so we know what we are sending to).
  • If you leave a review or save a salon to favourites: the rating, the comment and the link to your account. Reviews are publicly visible on the salon's profile, without your email or phone.
  • The salon's notes about you as a client (e.g. a preferred service): visible only to the salon, never public, deleted together with the history after three years.
  • For salons and owners: salon details, company name, contact person, email and phone.
  • Technical data: IP address and basic logs at our hosting providers, needed for security and operation.

3. Why, and on what basis

  • To pass your request to the salon and keep you informed about its status — performance of the service you ask for.
  • A reminder before the appointment and device notifications — your consent (email is optional; you switch push notifications on and off yourself).
  • Security, abuse prevention (e.g. mass-blocking of slots) and aggregate statistics for salons — legitimate interest.
  • We do not sell data or use it for third-party advertising.

4. Who sees your data

  • The salon you book with sees your name, phone, email and note in order to provide the service. The salon is an independent controller for that data.
  • Processors that help us run the platform: Supabase (database and sign-in), Vercel (hosting), Resend and Google (email delivery), and your browser's push services (Google, Apple, Mozilla). Where data leaves North Macedonia, this relies on standard contractual clauses or another lawful basis.
  • The map on a salon profile is loaded from OpenStreetMap, which sees your IP address when it is displayed.
  • Authorities — only where the law requires it.

5. How long

Booking data (name, phone, email, note) is automatically anonymised 3 years after the appointment; aggregate statistics without personal data remain. Accounts are kept until you ask us to delete them.

6. Cookies and local storage

We use only essential cookies: for sign-in (session) and to remember your language. The browser also keeps one per-session marker of whether you arrived through search, so the salon knows the platform found them the client. We use no advertising or tracking cookies, which is why there is no consent banner.

7. Your rights

  • Access, rectification, erasure, restriction of processing, portability and objection.
  • Withdrawing consent at any time (without affecting earlier processing).
  • Send requests to kontakt@possa.mk; we reply within 30 days at the latest.
  • You can complain to the Personal Data Protection Agency: azlp.mk.

8. Security

Access is restricted in the database itself (each salon sees only its own bookings), traffic is encrypted (HTTPS), and sign-in is passwordless, via an email link.

9. Children

The platform is not intended for anyone under 16 without a parent's or guardian's consent.

10. Changes

We may update this policy; the effective date is shown above. We announce material changes on the platform.