Privacy Policy

For the businesses that subscribe to Pitly we are the controller: we decide how account, company and billing data is handled, and this policy governs it directly.

For the data those businesses keep about their own clients — names, phones, vehicles, orders, photos, chat messages — the business is the controller and we are only the processor. It decides what to collect and how long to keep it; we provide the tool and act on its instructions.

The platform is multi-tenant: every record belongs to exactly one company, requests are checked against that company, and no business can read another's data. We do not use our customers' client data for our own purposes.

The list below is compiled from the actual data model of the platform, category by category. If a category is missing here, it is missing from the product too.

Where the retention line says that no period is implemented yet, that is literally true: the software keeps such records until someone deletes them. Fixing concrete retention periods is one of the open points that must be settled before launch.

Every business on Pitly can have a public page where anyone can book a time without creating an account and without a password.

The form asks only for what the business needs to hold the slot and reach you:

• your name;
• your phone number;
• your email address;
• the branch, service and start time you choose;
• an optional message to the business.

Consent is mandatory: the booking is rejected if the consent box is not ticked, and the moment of consent is stored on your client record with that business. If the business already has a client with your email — or with the same phone and name — the booking is attached to it, otherwise a new client record is created. A confirmed work order is created for the business and your message is copied into it. No login account is created for you, and the form does not ask for any vehicle data.

The chat widget on a public page needs only your message and the language. A name and an email are optional and are used solely so the business knows who is writing.

Your browser keeps a random token that lets you return to the conversation; we store only an irreversible hash of it, so the conversation cannot be traced back to you from our side. The conversation is readable by the owner and managers of that business — masters do not have access. Sending the first message records your consent.

The chat is not intended for sensitive data: please do not send payment card numbers, identity document numbers or health information through it. Chat history is currently kept without an expiry date.

Depending on the data, the processing rests on one of the following:

• performance of a contract — the account, the subscription and everything needed to deliver the platform to a business (Art. 6(1)(b));
• consent — booking online and writing in the chat as a visitor; you may withdraw it at any time (Art. 6(1)(a));
• legitimate interests — keeping the service available and secure, limiting the rate of public requests, preventing abuse (Art. 6(1)(f));
• legal obligation — accounting and tax records once billing is live (Art. 6(1)(c)).

Business and client records stay for as long as the business keeps them; the platform does not delete them by itself.

These periods, on the other hand, are enforced by the software today:

• queued letters: removed 24 hours after successful delivery, 7 days after a final failure;
• the delivery log that prevents sending the same letter twice: 7 days;
• sign-in sessions: they expire with the refresh token, 30 days by default, and are deleted the moment you sign out;
• rate-limit counters keyed by IP address: one minute, in server memory only.

For accounts, clients, vehicles, orders, photos and chat conversations no automatic retention period exists in the product yet. Concrete periods have to be decided together with the erasure tooling described below, and this section will be updated when they are.

Photos attached to a work order are stored in the platform's own file storage under an internal key. They are not published to a public bucket and there is no shareable link: every image is delivered only in response to an authenticated request from staff of the company that owns the order, and a master sees only the orders assigned to them.

Each file may be up to 15 MB and an order may hold up to 30 photos; the original file name is kept alongside the image. When staff delete a photo, both the database record and the file itself are removed.

Letters are sent over an ordinary SMTP server and wait in a queue in our cache until they are delivered. A queued letter holds the recipient address, the template, the language and the contact details of the business on whose behalf it is sent. Recipient addresses also appear in server logs when delivery fails.

Every letter is written in the recipient's own language and carries the contact details of the business plus a link to this policy in its footer.

As of the date above, the only letter the platform can send is a test message an owner sends to their own address. Booking confirmations, reminders and other client-facing letters are still being built; this section will be updated when they ship.

We do not sell personal data and we do not share it for advertising. It is disclosed only to:

• the business whose page you booked on or wrote to — for its clients' data it is the controller;
• infrastructure providers hosting the servers, the database, the cache and the file storage;
• the provider of the outgoing mail server;
• public authorities, where a law obliges us to hand data over.

Individual vendors are not contracted yet, so we cannot name them here; they will be listed by name in this section before launch. What the platform demonstrably does not use today: no analytics or tracking scripts, no advertising networks, no payment provider, no SMS provider, no error-tracking service and no embedded third-party maps — the map link on a company page is an ordinary outbound link, not a frame that loads someone else's code.

The platform and its backups run inside the European Union. Every infrastructure provider we engage has to offer an EU region, and we choose one.

No transfer of personal data outside the EU and the EEA is planned. Should one ever become necessary, it will be covered by the safeguards the GDPR requires, such as standard contractual clauses, and this document will say so before it happens.

The measures below are built into the platform:

• passwords are stored only as bcrypt hashes with a high cost factor — they are never kept in readable form and cannot be recovered, only reset;
• access tokens are short-lived (15 minutes by default), sessions live in the cache and are revoked the moment a user signs out;
• every request is checked against the company the data belongs to, and roles decide what an owner, a manager and a master can each see;
• uploaded files are addressed by an internal key with protection against path traversal and are served only to authenticated staff;
• public endpoints — company page, free slots, booking and chat — are rate-limited per IP address.

This website uses no analytics, advertising or profiling cookies. The only cookie it sets is the one remembering the language you picked, so the site opens in that language next time. The API sets no cookies at all.

The dashboard keeps your sign-in tokens in the browser, and the chat widget keeps its conversation token there too. Clearing the site data in your browser removes both — and with the chat token, your access to that conversation from that browser.

Under the GDPR you have the right to:

• access — learn whether your data is processed and obtain a copy of it;
• rectification — have inaccurate data corrected;
• erasure — have your data deleted where there is no reason to keep it;
• restriction — have processing paused while a dispute is resolved;
• objection — object to processing based on legitimate interests;
• portability — receive your data in a machine-readable format;
• withdrawal of consent — at any time, without affecting what was lawful before.

If your data is held by a business that uses Pitly — because you booked with it, wrote to it or had your car serviced — write to that business first. It is the controller and it decides. We support it and we forward requests that reach us by mistake.

For your own Pitly account, write to us at the address at the end of this document. We answer within one month, as the GDPR requires.

You can also lodge a complaint with the data protection authority of the country where you live or work.

What already works by itself: a customer downloads their own data from the cabinet with one button, and a shop exports and erases a client record straight from the dashboard — erasure anonymises the personal data, work-order photographs included. What we still do by hand: deleting your own Pitly account and your support conversations; write to us and we do it within the time the GDPR requires.

Pitly is a tool for businesses and is not directed at children; we do not knowingly collect data about them. If a business enters the data of a minor as its client, that business is responsible for having a lawful basis for it.

The product changes and so does this document; the date at the top always shows the last substantive change. Material changes are announced to account holders by email before they take effect.

Questions about this policy, or about the data we hold about you: write to [email protected].

No separate data protection officer has been appointed. Requests go to the same address and are handled by the team responsible for the platform.

Pitly is operated by Vexus OÜ, registry code 16561054, VAT number EE102530805, Kreenholmi tn 30-83, 20206 Narva, Estonia. The competent supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee); a complaint may also be lodged with the authority in your own country.