Privacy Policy

Last updated: January 6, 2026

This Privacy Policy explains how arthXcode d.o.o. ("we", "us", "our", "Company") collects, uses, shares, and protects your personal data when you use our mobile applications and related services (collectively, the "Service").

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and applicable Croatian data protection laws.

1. Data Controller

2. Data We Collect

2.1 Information You Provide

Depending on how you use the Service, we may collect:

• Account Information: Name, email address, phone number, profile picture
• Booking Information: Appointment details, service preferences, messages
• Waitlist Information: Preferred dates, times, and services
• Business Information: Business name, address, phone, email, tax ID (for business accounts)
• Employee Information: Name, email, phone, profile details, working hours, availability
• Service Information: Service names, descriptions, prices, durations
• Notes: Notes about appointments or clients (for business accounts)

2.2 Information Collected Automatically

• Device Information: Device type (iOS/Android), device tokens for push notifications
• Usage Data: App interactions, appointment history, timestamps
• Technical Data: App version, operating system version

2.3 Information We Do NOT Collect

• Location data (GPS)
• Contact lists
• Camera or microphone access (except when you upload images)
• Health or biometric data
• Financial or payment information (we do not process payments)

3. How We Use Your Data

Purpose	Legal Basis (GDPR)
To create and manage your account	Contract performance (Art. 6(1)(b))
To process and manage appointments	Contract performance (Art. 6(1)(b))
To send appointment confirmations and reminders	Contract performance (Art. 6(1)(b))
To send push notifications about your bookings	Consent (Art. 6(1)(a))
To send email notifications (verification, password reset)	Contract performance (Art. 6(1)(b))
To provide customer support	Legitimate interest (Art. 6(1)(f))
To improve our services and fix bugs	Legitimate interest (Art. 6(1)(f))
To comply with legal obligations	Legal obligation (Art. 6(1)(c))

4. Data Sharing and Third Parties

4.1 Service Providers (Data Processors)

We use the following third-party services to operate the Service:

Service	Purpose	Location
MongoDB Atlas	Database hosting	EU (Ireland) / US
Firebase Cloud Messaging (Google)	Push notifications	EU / US
Cloudinary	Image storage	EU / US
Resend	Email delivery	US

All service providers are bound by data processing agreements and are required to protect your data in accordance with GDPR.

4.2 Data Sharing Between Users

When you book an appointment:

• Your name, phone number, and appointment details are shared with the service provider you book with
• Service providers can see your booking history with their establishment
• Service providers may add internal notes about your appointments (visible only to their staff)

4.3 We Do NOT

• Sell your personal data to third parties
• Share your data with advertisers
• Use your data for targeted advertising

5. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all service providers
• Encryption of data in transit and at rest

6. Data Retention

Data Type	Retention Period
Account data	Until you delete your account
Appointment history	3 years after the appointment date
Business data	Until the business account is deleted
Email verification tokens	24 hours
Password reset tokens	24 hours
Device tokens	Until you log out or uninstall the app

7. Your Rights Under GDPR

As a data subject in the EU, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restriction (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time (e.g., push notifications)

To exercise any of these rights, contact us at support@xnow-one.com. We will respond within 30 days.

Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP):

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: Passwords are encrypted using industry-standard hashing
• HTTPS: All data transmitted between the app and our servers is encrypted
• Access Control: Only authorized personnel can access personal data
• Secure Infrastructure: Our servers are hosted on secure cloud infrastructure
• Regular Updates: We keep our systems updated with security patches

9. Push Notifications

We use Firebase Cloud Messaging to send push notifications about:

• Appointment confirmations
• Appointment reminders
• Appointment cancellations or changes
• Waitlist updates

You can disable push notifications at any time in your device settings. This will not affect other functionality of the Service.

10. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@xnow-one.com.

11. Cookies and Tracking

Our mobile applications do not use cookies. We do not use advertising trackers or analytics SDKs that track your behavior across apps.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you via email or in-app notification (for material changes)

We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: