Privacy

For online booking, the name, phone number, optional email address, requested appointment and optional notes are processed in order to manage the booking. SMTP notifications are not yet enabled in production.

Website and server statistics: public page views, entries, booking attempts, successful bookings, error classes, coarse response times, source categories and device classes are stored long-term only as aggregated daily values. No person or device is recognised. For these statistics, no visitor identifier, IP address, browser identification (user agent), full referrer address, URL parameters or exact event time is stored. Multiple visits by the same person may therefore be counted more than once; the values are not a count of unique visitors.

For the anonymous aggregated statistics: The website and ad statistics set no analytics or marketing cookies, write no statistics data to localStorage or sessionStorage and load no third-party scripts. Google Tag Manager, Google Analytics and Google conversion tags are not loaded.

With your consent, we link a Google ad click to your online booking. We store the ad click identifier in encrypted form for up to 30 days, together with selected ad parameters and a protected reference. If you book, the individual ad attribution is retained for up to 365 days. Your consent choice is stored locally in the browser; the opaque reference is stored for the session only. Where available, we use the GCLID in a Google Ads read query to identify the ad; customer contact details and appointment contents are not sent to Google. Without consent, no individual ad attribution is created. You can change your choice in the footer. Successful withdrawal deletes the attribution associated with the available reference and preserves your booking. Backup copies have a separate 30-day retention period. For earlier references or deletion requests, use the existing privacy contact.

Individual attribution is kept separately from these anonymous totals in the protected database. The server decrypts the click identifier for the Google read query; authorised infrastructure and database administrators with database and key access can read individual attribution. Encrypted click identifiers are purged after at most 30 days, individual booking attribution after at most 365 days. Future backup copies marked accordingly are checked daily and removed after at most 30 days. Following restoration, deletions and expired retention periods are applied again before the application is released. Offline withdrawal stops browser forwarding immediately; server deletion requires a successful connection or expiry cleanup. Physical overwriting of old database pages is not guaranteed.

Short-term ad visit log: to troubleshoot ad URLs, the server stores, aggregated per hour, which public page path was opened with which validated campaign, ad group, target and ad IDs, which ad keyword and match type and which network and device class as stated in the ad URL, whether the parameters came from Google's automatic tagging, from parameters configured in the ad account or from both, which attribution level resulted (campaign only, ad group or target, keyword), whether the parameters were valid, a fixed note or error reason and whether a click identifier was present. Invalid raw values and free text from invalid visits are not stored. These entries are deleted automatically after 30 days.

Long-term ad statistics: only daily values per stage (entry, booking page, reservation, booking request, successful booking and rejected booking request with a coarse error class) by campaign, ad group, target and ad ID, ad keyword, match type, network and device class as stated in the ad URL, origin of the parameters, attribution level and validity are stored permanently, together with monthly values by the same ad characteristics containing the number of bookings, total booked value and currency. Successful bookings are counted in the same storage operation as the booking itself.

For the anonymous aggregated statistics: IP addresses, browser identifiers, full referrer or page addresses, unknown URL parameters, Google click identifiers, visitor or session identifiers, reservation, appointment or customer identifiers, contact details, notes, the management link and the exact booking time are not stored. No statistics row contains a link to a specific booking or person. On days with very few bookings, a daily value may nevertheless arithmetically correspond to a single booking; the values are therefore visible only in the protected administration area. The transmitted ad keyword is a keyword from the Google Ads account and is not necessarily the actual search query of an individual. Network and device class (for example Google Search or mobile) come from Google's ad URL, not from the browser.

Google Search Console data is retrieved server-side and read-only. It contains aggregated organic clicks, impressions, search terms, landing pages, countries and devices, is kept separate from the ad statistics and is not assigned to an individual booking.