Privacy Policy
Last updated: 11 November 2026
This policy explains how personal data is processed on Vuoroin: the booking platform at vuoroin.fi and the booking site of every business that uses it. It gives the information required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
Vuoroin has two roles, depending on whose data it is:
- Vuoroin is the controller for the platform itself: user accounts and sign-in, the businesses that subscribe to Vuoroin and their billing, security and support.
- The business you book with (a studio, gym, clinic or other service provider) is the controller for what it holds about you as its customer: your bookings, payments, attendance, answers to its booking questions and notes its staff write. Its own privacy notice applies to that data. Vuoroin processes it on the business's behalf, only on its instructions, under the data processing terms in our Terms of Service.
One Vuoroin account works on the booking site of every business you use. Each business sees only your details and your dealings with that business, never your bookings elsewhere.
1. Controller and contact
Epoch 505 Oy, business ID 3654705-9, Reppukatu 13 A 2, 00770 Helsinki, Finland.
Send questions about privacy and requests to exercise your rights to [email protected]. Where a business is the controller, you can also contact that business directly; its contact details are on its booking site.
2. What data we process
About customers of businesses that use Vuoroin:
- Contact details: first and last name, email address and phone number.
- Account details: your password, stored only as a one-way hash, whether your email address is verified, when the account was created and when the password was last changed. Booking as a guest stores your contact details without a password. If you sign in with Google or Apple, we also store that company's identifier for your account, which is how the same Google or Apple account always reaches the same Vuoroin account. If you use Apple's “Hide My Email”, the address we receive is one Apple forwards to you.
- Bookings: what you booked and when, the staff member for an appointment, payment method and status, promo codes and discounts, cancellations and refunds, waitlist places and offers, and check-in times.
- Answers to the questions a business asks when you book. Free-text answers are stored as you write them.
- Punch cards, memberships, loyalty points and gift cards. For a gift card, this includes the buyer's and the recipient's email address and any personal message.
- A check-in code: a random identifier shown as a QR code in your profile, if the business uses check-in. It is not your personal identity code.
- Notes the business's staff write about you. Only that business's staff can see them.
- Emails sent to you: address, subject and delivery status. Messages a business sends to its customers through Vuoroin are stored in that business's records.
About businesses and their staff:
- Name, email address and password hash of the business owner and each staff member, their role, and the working hours and time off entered for scheduling.
- Business details: trading and registered name, business ID, contact email and phone number, website, social media accounts, locations with their addresses and opening hours, logo and images.
- Subscription: plan, trial and subscription status, and the customer and subscription identifiers at Stripe. Card details are handled by Stripe and never reach our servers.
- Payment settings: the Stripe account connected for taking payments and its status, and Epassi merchant credentials, which are stored encrypted.
- A log of actions platform administrators take inside a business's account.
About everyone who uses the service:
- Technical data needed to deliver and protect the service, such as IP address, browser type and the time of a request. IP addresses are used to limit repeated sign-in attempts and other abuse; they are held in memory briefly and are not stored in our database.
- Error reports your browser sends when a page fails: the error message, the page address and the browser type.
3. Purposes and legal bases
When Vuoroin is the controller:
- Providing the service to businesses and their staff: the contract with the business (GDPR Art. 6(1)(b)). For staff members, our legitimate interest in providing the service their employer has ordered (Art. 6(1)(f)).
- Your account and sign-in, including email verification and password resets: the contract with you (Art. 6(1)(b)).
- Billing and accounting: legal obligations under accounting and tax law (Art. 6(1)(c)).
- Security, abuse prevention, error monitoring and the administrator log: our legitimate interest in keeping the service and its users' data safe (Art. 6(1)(f)).
When a business is the controller, the business decides the purposes and is responsible for the legal basis. Usually the basis is the contract between you and the business (Art. 6(1)(b)): taking the booking and payment, sending confirmations, reminders, calendar invitations, waitlist offers and cancellation notices, handling refunds and checking you in.
Vuoroin does not use customers' data for its own marketing, does not sell personal data and does not use advertising or analytics trackers.
4. Who receives data
The business you book with and its staff, according to their role. Payment providers receive what they need to process a payment. Authorities receive data only when the law requires it.
Vuoroin uses these service providers (sub-processors). Each processes data only to provide its part of the service, under a data processing agreement:
- Hetzner Online GmbH: servers and the database, in a data centre in Helsinki, Finland.
- Cloudflare, Inc.: domain name service, network security and delivery of the service, and Cloudflare R2 storage for uploaded images and database backups, in the EU.
- Resend: email delivery, from its EU region.
- Stripe Payments Europe, Limited: card payments, subscriptions and refunds. A customer's card payment is processed on the business's own Stripe account, and Stripe is also an independent controller for its own purposes, such as fraud prevention.
- Epassi: employee-benefit payments, when you choose Epassi. You sign in on Epassi's own site.
If you choose “Continue with Google” or “Continue with Apple”, you sign in on that company's own page, and it tells us your email address and whether it is verified — Google also your name and language. We never see your Google or Apple password. Google (Google Ireland Limited) and Apple (Apple Distribution International Ltd.) are independent controllers of a sign-in with them, under their own privacy policies; they are not Vuoroin's sub-processors.
5. Transfers outside the EU and EEA
Our database, backups, uploaded images and email are stored in the EU. Stripe, Cloudflare and Resend belong to groups based in the United States, and personal data may also be processed there, for example to deliver email, protect the network or prevent payment fraud. These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses. Google and Apple belong to groups based in the United States and handle a sign-in with them under their own terms and transfer safeguards.
6. How long data is kept
- Your account is kept until you erase it (see section 7).
- A business's records about you, such as bookings, are kept while the business uses Vuoroin, unless the business deletes them sooner. When a business's trial or subscription ends, all of its data is deleted 90 days later.
- Unfinished business sign-ups are deleted after 7 days. Bookings left unpaid expire within minutes.
- Password reset links expire after a short time.
- Vuoroin's own billing records are kept for as long as accounting law requires, up to 10 years.
- Database backups are kept for up to 30 days, so erased or deleted data also disappears from backups within 30 days.
- Server logs are rotated and kept only for a short time.
7. Your rights
- Access: you can see your details and bookings in your profile, and ask us for a copy of all data about you.
- Portability: when signed in, you can download your account details, bookings, waitlist entries and loyalty points from your profile at any time, as a machine-readable JSON file.
- Rectification: you can correct your name and phone number in your profile. Contact us to change anything else.
- Erasure: your profile has a self-service erasure. It removes your name, email address, phone number, check-in code and password, and clears the free-text answers you gave when booking. Your past bookings remain only as anonymous records, which businesses need for their bookkeeping and attendance history. Notes a business's staff have written about you are deleted too.
- Restriction and objection: you can ask us to restrict processing, and object to processing based on legitimate interest.
- Complaints: you can lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi).
We answer requests within one month. Where a business is the controller, send requests about your data with that business to the business. If you contact us instead, we pass the request on and help the business respond.
8. Security
- All connections are encrypted (HTTPS).
- Each business's data is kept apart by access rules enforced in the database itself, not only in the application.
- Passwords are stored as one-way hashes, and payment provider credentials are encrypted.
- Sign-in attempts are rate limited, and changing your password ends your other sessions.
- Card details are entered into Stripe's payment forms and never reach our servers.
- Staff access is limited by role, and actions platform administrators take inside a business's account are logged.
If a personal data breach occurs, we inform the affected businesses without undue delay. Where Vuoroin is the controller, we notify the Data Protection Ombudsman and the people affected as the law requires.
10. Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Some things happen automatically under a business's published terms, for example a refund calculated from its cancellation terms, or a class cancelled and refunded when too few people signed up.
11. Changes
When our processing changes, we update this policy and the date at the top. We tell businesses about material changes by email in advance.
Contact
Questions and requests about privacy: