Privacy Policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is all data by which you can be personally identified. For detailed information on the subject of data protection, please refer to our privacy policy set out below this text.

Data collection on this website

Who is responsible for the data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section “Information on the controller” in this privacy policy.

How do we collect your data?

Your data is collected on the one hand by you providing it to us. This may, for example, be data that you enter into a contact form. Other data is collected automatically or with your consent by our IT systems when you visit the website. This is above all technical data (e.g. internet browser, operating system or time of the page view).

What do we use your data for?

Part of the data is collected in order to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have a right to request the rectification or erasure of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future.

2. Hosting

Vercel

We host our website with Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel is a cloud hosting service for web applications.

For details, please see the privacy policy of Vercel: https://vercel.com/legal/privacy-policy

Supabase

For data storage we use Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. All customer data is stored in EU data centres and is subject to the DSGVO (GDPR).

For details, please see the privacy policy of Supabase: https://supabase.com/privacy

3. General information and mandatory information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose that happens.

4. Data collection on this website

Cookies

Our web pages use so-called “cookies”. Cookies are small data packets and do no harm to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies).

Session cookies are deleted automatically at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or until they are deleted automatically by your web browser.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. The collection of this data takes place on the basis of Art. 6 Abs. 1 lit. f DSGVO (GDPR).

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions.

Registration on this website

You can register on this website in order to use additional functions. We use the data entered for this purpose only for the purpose of using the respective offering or service for which you have registered. The mandatory information requested during registration must be provided in full. Otherwise we will refuse the registration.

For important changes, for example to the scope of the offering or in the case of technically necessary changes, we use the email address provided during registration to inform you in this way.

5. Analysis tools and advertising

Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of the website visitors. In doing so the website operator receives various usage data, such as page views, time spent, operating systems used and origin of the user.

Microsoft Clarity

We use Microsoft Clarity to analyse user behaviour on our website. Microsoft Clarity is a web analysis tool of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

For details, please see the privacy policy of Microsoft: https://privacy.microsoft.com/de-de/privacystatement

6. Plugins and tools

Clerk Authentication

For user authentication we use Clerk, a service of Clerk Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Clerk processes authentication data such as email addresses and passwords.

For details, please see the privacy policy of Clerk: https://clerk.com/privacy

Stripe

For payment processing on this website we use Stripe, a service of Stripe Inc., 510 Townsend Street, San Francisco, CA 94103, USA.

For details, please see the privacy policy of Stripe: https://stripe.com/de/privacy

Google Calendar API (Google API Services)

If you connect your Google Calendar with Set2Sell in the settings, we access data of your Google account via the Google Calendar API. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

OAuth scope used: https://www.googleapis.com/auth/calendar (full read and write access to your Google calendars).

Which data is processed:

• List of your Google calendars (name, calendar ID, time zone)
• Appointments and events (title, description, location, start/end time, participants, conference links)
• OAuth tokens (access token, refresh token, expiry time) to maintain the connection
• Email address of the connected Google account

Purpose of the processing: Synchronisation of your appointments between Set2Sell and Google Calendar (bidirectional), calculation of free time slots for public booking pages, creation of calendar entries when appointments are booked, and display of your appointments in the Cockpit. The legal basis is Art. 6 Abs. 1 lit. b DSGVO (performance of a contract) or Art. 6 Abs. 1 lit. a DSGVO (consent via the OAuth consent screen).

Storage location and storage period: The data is stored on servers commissioned by us in the European Union (Supabase, EU region) and is only kept for as long as the calendar connection is active. You can disconnect the connection at any time in Settings → Calendar; in doing so, all OAuth tokens and the local appointment cache are deleted immediately. In addition, you can revoke the permission at any time directly in your Google account at myaccount.google.com/permissions. After disconnecting or revoking, the associated tokens and the appointment cache are permanently removed from our systems within 24 hours.

Data security and protection: All data is transmitted exclusively in encrypted form via TLS/HTTPS. Storage is encrypted (encryption at rest) at our processor Supabase in the EU region. OAuth tokens are stored exclusively on the server side and are not publicly retrievable. Access to your data is restricted to the respective workspace by role-based access control (Row Level Security). Data processing agreements pursuant to Art. 28 DSGVO are in place with all infrastructure service providers used (Supabase for storage, Vercel for hosting).

Disclosure to third parties: Data received via the Google Calendar API is disclosed to third parties exclusively to the infrastructure service providers named above (Supabase, Vercel), which act exclusively on our behalf and are bound by our instructions. No disclosure for advertising, analysis or other own purposes of third parties takes place. The data is not sold.

Google API Services User Data Policy – Limited Use: Set2Sell’s use of information received from Google APIs, and its transfer to other apps, adheres to the Google API Services User Data Policy, including the Limited Use requirements. Set2Sell uses the data received via the Google Calendar API exclusively to provide and improve the user-facing calendar functions named above. No processing of your Google calendar data for other purposes takes place. We do not sell this data, do not use it for advertising or marketing, do not transfer it to third parties outside the infrastructure required for the service (Supabase, Vercel) and do not use it for AI or machine learning models.

Set2Sell employees do not generally view your Google calendar data. Manual inspection takes place exclusively in the exceptions expressly permitted by the Google API Services User Data Policy: (a) after your express consent in the specific individual case (for example in the case of a support request initiated by you), (b) to investigate a specific security incident, or (c) insofar as expressly required by law.

For details, please see the privacy policy of Google: https://policies.google.com/privacy

Microsoft Graph / Outlook Calendar

Analogously to the Google connection, you can connect your Microsoft 365 / Outlook calendar via Microsoft Graph. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Only calendar data (appointments, availabilities, OAuth tokens) is processed for synchronisation with Set2Sell. You can disconnect the connection at any time in Settings → Calendar.

For details, please see the privacy policy of Microsoft: https://privacy.microsoft.com/de-de/privacystatement

7. Your rights

You have the following rights:

• Right to information about your personal data stored by us
• Right to rectification of inaccurate data
• Right to erasure of your data
• Right to restriction of the data processing
• Right to data portability
• Right to object to the processing
• Right to withdraw your consent

To exercise your rights, please contact: datenschutz@set2sell.io

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by us.

8. SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

9. Data transfer on conclusion of a contract

We transfer personal data to third parties only if this is necessary within the scope of the contract processing, for example to the credit institution commissioned with the payment processing.

No further transfer of the data takes place, or only if you have expressly consented to the transfer. Your data will not be passed on to third parties without express consent, for example for advertising purposes.