Skip to content
F9.contact

Privacy Policy

Version: 1.9 · Effective date: October 30, 2026

Who we are

F9.contact ("F9", "we", "us") provides booking, client-records, fiscal-compliance and staff-management software for personal-care businesses in the European Union. Where you are a business operating on the platform, you are the data controller for your customers' personal data and F9 acts as your data processor under a Data Processing Agreement. Where we process data about you directly — your account, billing and support history — F9 is the controller.

For legal-entity, registered-office and contact details, see our Imprint.

What we process and why

We process only the categories of personal data needed to operate the service:

  • Account and identity data — names, email addresses, phone numbers and login credentials of business operators and their staff.
  • Customer data — entered by businesses about their own clients: contact details, appointment history, preferences, optional profile photos and, for clinical verticals, intake-questionnaire answers.
  • Billing data — subscription tier, payment status and invoicing details. Card data is handled by our payment processor and never stored on F9 servers.
  • Technical data — IP address, device and browser information, and audit-log entries recording who accessed what and when.

We rely on the lawful bases of contract (to deliver the service you signed up for), legitimate interest (security, fraud prevention, product improvement) and legal obligation (Croatian fiscal and tax-retention law). Where consent is required — for non-essential cookies — we ask for it explicitly.

Enquiries through our website

When you write to us through the contact or demo form on f9.contact, F9 is the controller of the details you send: your name, your email address, the language you want the reply in, your message and — if you choose to give them — your business name, phone number and team size.

We use these details to answer you and, where you asked for one, to arrange a demo; the lawful basis is taking steps at your request before entering into a contract. We may also write to you later, personally, to follow up on your enquiry about the service; the basis for that is our legitimate interest in staying in touch with businesses that have asked about F9. You can object to this at any time, and we will stop.

Your enquiry reaches us as an email in our team mailbox, on a mail server we operate ourselves. It is not added to a newsletter or any other mailing list, and it does not create an account. We keep it for 24 months after our last correspondence with you and then delete it. To stop the form being abused we also keep a one-way fingerprint of your email address, made with a secret key — not the address itself — and we delete it after 24 hours.

You can ask us to delete your enquiry sooner, or exercise any of the rights described below, by writing to info@f9.contact.

How we protect personal data

Personal data is stored encrypted (AES-256-GCM). Every protected record is locked with a key of its own, and that key is in turn locked with a master key. We keep separate master keys for three kinds of data:

  • one master key for the contact details of the businesses on the platform,
  • a master key for each business, for its staff and workers and its own records about its clients,
  • a master key of its own for the personal data on clients' own accounts, independent of the other two.

Details we need to search by, such as an email address, are stored twice: as a one-way fingerprint made with a secret key, so that the record can be found; and as a separately encrypted copy, so that it can be shown. An email address is never written to disk in readable form. Personal data is held in EU-sovereign infrastructure. Profile photos are saved again without the details embedded in the file (such as where and with what device a photo was taken), and are shown only through links that cannot be forged and stop working after a short time.

One field is deliberately an exception. A client's date of birth, where a business records one, is stored unencrypted, apart from the rest of the record — the only reason to hold a birth date is to search by it, for example to find whose birthday falls in a given week, and encrypted values cannot be searched, compared or sorted by date. It is the only detail about the person themselves that we deliberately keep unencrypted, so that it can be searched by date (a business's own operational records about its clients — for example when a client last visited, or which services they prefer — are held unencrypted as that business's own records and are not part of the encrypted client record); it is kept apart from the encrypted client record rather than hidden inside it, and it is subject to the same access controls and EU-sovereign hosting as every other record.

Retention and deletion

Businesses retain customer data for the duration of their subscription and a configurable cooling-off period afterwards. Records are first marked as deleted and hidden, then kept for a further period after the subscription ends, and then erased as described below. We honour Croatian statutory retention periods for fiscal records, which override deletion requests for the data those laws cover.

When a record is erased, we perform cryptographic erasure: we destroy the key that unlocks it, so the encrypted personal data can never be read again. Which key is destroyed depends on whose record it is:

  • When a client closes their account, we destroy the key to that account 30 days after the client confirms the closure: the name, email address, phone number and photo held on the account can never be read again, their sign-in details are removed, and the account can no longer be used. Each business where they are a client keeps its own record of them, such as its notes and the allergies it recorded, locked with that business's own key, because that record belongs to the business and is not part of the client's account. Only the business's note of how the client found it and the client's notification choices for that business are cleared. A receipt that carries the client's name keeps it for as long as the law requires the receipt to be kept.
  • When a business deletes a client from its client list, the client is hidden at once. 365 days later we destroy the key to that business's notes and allergies about the client, so they can never be read again, and the business's own operational records about the client, described below, are cleared. If the client has no account of their own and every business that had them as a client has deleted them, the name, email address, phone number and photo held on their record are erased in the same way 365 days after the last of those deletions.
  • When a business leaves the platform, we destroy that business's master key after it leaves, normally when its cooling-off period ends. All personal data locked with it — that of the business's staff and workers, its bookings and its records about its clients — can then never be read again. The key to the details of the business's contact person is destroyed with it, and the public profiles of its professionals are deleted outright.

Records that the law requires a business to keep, such as invoices, are kept for the period the law sets, with the details the law requires them to carry. A business's bookings, and the booking and audit history that goes with them, are that business's own record: the business keeps them when a client's account is erased or when it deletes a client. The name a client acted under in that history is erased with their account. If a business deletes a client who has an account of their own, that name stays in the business's history until the account is erased or the business leaves the platform. When a business leaves the platform, the personal data in its bookings can no longer be read, and the names of its staff, workers and clients in its booking and audit history are replaced with a note that they were erased; the names of F9's own operators and of automated processes are kept.

The one exception is the date of birth described above. Because it is not encrypted there is no key to destroy, so it is deleted outright: it is removed from the database when the record is erased. The effect for the data subject is the same — after erasure the birth date is gone and cannot be recovered. A business's own operational records about a client (for example the date of a last visit, or preferred services) are not encrypted either: they are that business's records, and they are cleared under the business's retention rules described above rather than by cryptographic erasure.

Booking requests that are not yet confirmed. When someone requests an appointment on a business's booking page, or books with an account whose email address is not yet verified, the details they type (name, email address, phone number and any note) are kept, encrypted, in a short-lived request store until the address is confirmed. Until then nothing is booked and the business is not told about the request. The details are erased as soon as the request is confirmed, the time turns out to be taken, or the confirmation deadline passes — no later than 24 hours after the request was sent — and a record that the request ended, which holds no personal data, is deleted 24 hours after that.

Your rights

Under the GDPR you can exercise the following rights, several of which are self-service:

  • Access and portability (Art. 15 / Art. 20) — customers can request a downloadable ZIP archive of their personal data from the My Exports page in the portal; the archive is prepared in the background and made available through a time-limited download link.
  • Erasure (Art. 17) — customers can request email-confirmed account closure; after a 30-day cooling-off period the account's personal data is cryptographically erased, as described under Retention and deletion. To have a business's own record of you erased, contact that business.
  • Rectification, restriction and objection — contact the business that holds your record, or us where we are the controller.

You also have the right to lodge a complaint with your national supervisory authority.

Sub-processors

We use a limited set of vetted sub-processors — for hosting, file storage, email delivery, backups and push notifications — selected for EU data residency where personal data is involved. They are named, with what each one handles and where, in Annex 1 of the Data Processing Agreement. Payments for our own subscriptions are processed by Stripe.

Cookies

We use strictly-necessary cookies to run the site and, only with your consent, analytics cookies to understand usage. See the Cookie Policy for the full inventory and how to change your choice.

Website analytics

If you accept analytics in the cookie banner on f9.contact, we use Google Analytics 4, provided by Google Ireland Limited as our processor, to measure how the public website is used. F9 is the controller. The data is a random visitor identifier kept in a cookie, the pages you open, how you arrived, and approximate device, browser and location information (country and city level). Google Analytics does not store your IP address, and we do not send it your name, email address or anything you type into our forms. It runs only on the public website — never inside the application, the customer portal or a salon's booking page.

The lawful basis is your consent, which you can withdraw at any time through the Cookie settings link at the bottom of every page; we then stop measuring and delete the analytics cookies. Google Analytics keeps the detailed record of each visit (the pages opened and when) for 2 months, and the random visitor identifier with the details attached to it for up to 14 months after your last visit; after that only aggregated statistics remain. We do not use the data for advertising and have not enabled Google's advertising features.

Google may process some of this data in the United States. Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as providing adequate protection.

Changes to this policy

We will update this policy as the service evolves and will revise the version and effective date shown above. Material changes will be communicated to account holders.