Your data should remain understandable and controllable.

As of October 11, 2026

This data protection declaration provides information about the processing of personal data Frisys.de, in the Frisys application at app.Frisys.de and when contacting us. It applies to the currently actually implemented functions. Functions that are not activated are not shown as active.

1. Responsible person

The person responsible within the meaning of the General Data Protection Regulation (GDPR) is:

Constantin Härle
Bayerische Straße 15
10707 Berlin, Deutschland
constantin.haerle@outlook.de

A data protection officer has not currently been appointed unless and until there is a legal obligation to appoint one.

2. Accessing the website

When accessed, technically necessary connection data is processed, in particular IP address, time, URL accessed, referrer, browser and device information as well as status and error data. This serves for secure provision, error analysis and protection against misuse. The legal basis is Article 6 Paragraph 1 Letter f GDPR. The data is only retained for as long as necessary for operation and security; The specific log storage depends on the settings of the hosting used.

3. Hosting and technical service providers

The websites and parts of the application are delivered via Vercel, Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes technical access data and – to the extent necessary for operation – content as a technical service provider. The applicable guarantees apply to data transfers to third countries, in particular standard contractual clauses, to the extent that they are agreed or necessary. Further information is available in the Vercel privacy policy and in Vercel Data Processing Addendum.

4. Contact form and demo request

If you request a demo by email, the information you provide will be processed: name, email address, salon name, number of employees and your request. The processing serves to answer your inquiry and pre-contractual communication on the basis of Article 6 Paragraph 1 Letter b GDPR or – in the case of general contact – Article 6 Paragraph 1 Letter f GDPR.

The demo form prepares an email in your own email application. The website does not transmit the information entered to a form server. Only when you send the prepared email yourself will the provider receive your request.

5. Frisys Accounts and Application

Depending on the activated functionality, Supabase services for authentication, database and private file storage can be used for login, client and application data. In particular, account and profile data, roles, salon and location data, appointments, customer and communication data, consents, images, sales and financial data as well as protocol and authorization data are processed. The legal basis is Article 6 Paragraph 1 Letter b GDPR for contract fulfillment, Article 6 Paragraph 1 Letter c GDPR for legal obligations and Article 6 Paragraph 1 Letter f GDPR for security and protection against misuse.

Frisys is designed for salons as business software. The respective salon, as the controller, decides on the processing of its customer data. Frisys processes this data as a processor. For productive use, an order processing agreement with the specific instructions, categories, deletion periods and sub-processors is required between the salon and Frisys.

6. Email integrations

When an authorized salon manager connects Gmail, Microsoft Outlook, iCloud or Resend, the respective provider is called for authorization. Frisys only receives the permissions required for the selected function. For Gmail, Frisys only requests identity information openid email and the authorization https://www.googleapis.com/auth/gmail.send to. Frisys does not read, modify, or delete Gmail inbox messages. Gmail permission is only required to send messages that an authorized user creates in Frisys or triggers from a Frisys feature from their own Gmail account.

When sending via the selected provider, the recipient addresses required for sending, the subject and the message content are transmitted to this provider. This data is not used for personalized advertising, sales to data brokers, or training AI models. The connected sender address and connection status are saved to manage the account.

6a. Technical protection measures for connected email accounts

OAuth access and renewal tokens as well as SMTP credentials are processed and stored exclusively on the server side. Frisys does not store these secrets in the browser, does not store them in the source code, and does not return them to the UI. Before storage, they are protected with authenticated AES-256 GCM encryption; a random initialization vector and integrity protection are used for each value. The key material required for encryption is located exclusively in server-side environment variables.

The OAuth status is signed with a server-side HMAC SHA-256 key and is only valid for ten minutes. Invalid, tampered or expired returns will be rejected. Connections and shipping transactions are associated with an authenticated salon membership and its client; Management, authorization, and shipping actions are limited to the Owner, Administrator, and Manager roles. Only administrative data such as provider, sender address and connection status are transmitted to the browser.

Communication with the provider APIs takes place via HTTPS. Frisys requires TLS for SMTP connections. Message content is cleaned up on the server side by scripts, frames, and inline event handlers before being passed as HTML. You can disconnect in Frisys; The saved connection is deleted and – as far as technically possible – the OAuth authorization is revoked. In addition, revocation may be required in the respective Google, Microsoft, Apple or Resend account.

6b. Google Limited Use Statement

Protection of sensitive integration data: The transmission between the browser, Frisys server and the provider APIs takes place via HTTPS. Provider access tokens and stored provider access data are stored encrypted on the server side. Client secrets and internal service keys are not delivered to the browser. Protected features check login, salon membership and required role. Database rules separate the salon data; Provider connection tables are blocked from direct browser access. OAuth logins are time-limited and tied to eligible users and salons. If a connection is terminated, the saved provider access data will be removed.

Frisys uses Google user data exclusively for the expressly requested functions: sending emails and the separately related management of company reviews. The use and transfer of raw data or derived user data from Google APIs will be in accordance with the Google API Services User Data Policy, including the limited use requirements. The Gmail integration does not read mailbox content. Google API data is not transferred to AI models, nor used for advertising or to train general models.

6c. Instagram and Facebook integrations

When an authorized salon owner or admin connects an Instagram or Facebook account, Frisys redirects to Meta's official login and does not receive any passwords. The account or page ID provided by Meta, the display name, granted permissions, the connection status and an access token are processed. On Facebook, the pages that can be managed by the user are accessed. This data is used exclusively to display the selected connection, publish posts after approval, retrieve the publication status and manage the connection.

Access tokens are encrypted, stored exclusively on the server side and separately from clients and are not returned to the browser. They are not sold or used for personalized advertising or training AI models. A connection can be disconnected at any time in Frisys. If Meta sends a validly signed deletion request, Frisys automatically removes the associated Instagram/Facebook connection record including tokens. Information on this can be found below app.Frisys.de/data-deletion.

7. Optional integrations

Google Business Profile: The connection requires separate consent business.manage. Frisys retrieves manageable locations and their ratings including display names, texts, stars, and existing replies. Reviews are loaded live for display and are not permanently copied. Answers are published upon explicit click. Automatic replies are initially off and require explicit approval from the owner or administrator for a specific location, a fixed reply text and a minimum number of stars. The release also applies to suitable reviews that are already open. The person, time and version of consent are saved; the rule can be switched off at any time.

TikTok: After officially registering, Frisys will receive account ID, display name, encrypted tokens, available publishing options and post status. Selected texts, media and labels will only be transmitted to TikTok after the respective contribution has been expressly approved. The release is saved with the user, time and reference to the content.

WhatsApp Business: Once connected, Frisys processes account ID, business number, encrypted tokens, approved templates, selected recipients, messages and shipping status. Recipients must have agreed to be contacted. Outside the service window, a Meta-approved template is required. Connections to Google business profiles are separated under Reviews, TikTok under Social Media, WhatsApp and Email under Communication. Saved access data will be removed; Content that has already been published or sent remains with the provider.

Depending on the range of functions booked and actually activated, additional service providers can be used:

Stripe for payment and subscription transactions;
Google and Microsoft for the respective connected authentication and email API;
Meta Platforms Ireland for explicitly connected Instagram and Facebook accounts and shared publications;
OpenAI for explicitly launched AI functions;
Microsoft Azure Document Intelligence for explicitly activated receipt and document processing;
Resend or Apple for the selected email delivery.

An optional integration will only be used if it is activated in the respective account or explicitly started by you. The required provider information and authorizations are added to the list of processing activities and - if necessary - in the contract documents before productive use.

8. AI and document processing

If AI or receipt functions are explicitly started, the selected inputs, texts, images or documents can be transferred to the technical service provider configured for this purpose. Content that is not required should not be entered. Special categories of personal data, in particular health data or allergy information, may only be processed if the salon has a suitable legal basis and an appropriate protection concept.

9. Cookies, local storage and optional website analytics

When you first visit, our website host Vercel determines the approximate country based on your IP address and selects a suitable language. We only receive the country code and do not store any location history. Your manual language selection takes priority. If no country is available, we use the browser language.

The manually selected language is shown below frisys-website-language stored locally until you change it or clear the browser storage. Translations are provided as local language files; When changing languages, no visitor data is transferred to a translation service. The separate one Cookie overview and the cookie symbol allow you to make a new selection at any time.

Your decision

The following services apply exclusively to the public website Frisys.de. These analysis scripts are not integrated into the salon software or administration. A deactivated service will not be loaded even if you agree.

Google Analytics 4: Available after consent. Microsoft Clarity: Available after consent.

Use is voluntary. Rejecting, closing or continuing to browse does not constitute consent and has no disadvantages. Before consent is given, no analysis scripts are loaded and no measurement data is sent to these providers; also no measurement requests without cookies. You can select each service individually and revoke your consent at any time with future effect using the cookie symbol or the following buttons. The revocation does not affect the lawfulness of the previous processing.

The legal basis for optional storage and access to your device is Section 25 Paragraph 1 TDDDG and for the subsequent processing of personal data Art. 6 Paragraph 1 Letter a GDPR. Language and consent selection are stored locally to provide the settings you have chosen (§ 25 Para. 2 No. 2 TDDDG; Art. 6 Para. 1 lit. f GDPR for the administration and proof of the selection).

Your decision will be retained for 180 days frisys-privacy-consent-v1 saved. The entry contains the permitted providers, the information version as well as the time and process of the selection. After expiry or a change in providers or purposes, a new decision will be requested. Any previous blanket selection will not be used as consent to these services. If local storage is blocked, your selection only applies to the current page visit.

Google Analytics 4

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. After activation and your separate consent, we measure page views, approximate origin, device and browser information, active usage time, scroll depth and selected clicks. Google processes technical connection data and pseudonymous cookie identifiers. According to Google, IP addresses from the EU are discarded before being stored. Pseudonymous data is not anonymous data.

We do not send form content, names, email addresses, customer IDs or payment details. Page addresses are transmitted without search parameters and fragments; Referral addresses are shortened to the source domain. Preparing a demo email counts as preparation and not as an actual request sent. Google signals, ad storage and personalized advertising are deactivated in this integration.

The cookies _ga and _ga_* Differentiate between visits and sessions and are valid for up to 180 days in this integration, without automatic extension. Personal user and event data is retained in the Analytics account for two months; summarized reports may last longer. If you revoke your consent, we will stop the measurement and delete the analysis cookies that are accessible to us.

Google also processes data in the USA. Transfers to certified US recipients are based on the adequacy decision for the EU-US Data Privacy Framework (Article 45 GDPR); If necessary, the agreed standard contractual clauses also apply. Google is integrated as a processor based on the data processing conditions.

Further information: Google privacy policy, Data processing conditions and Google Analytics cookies.

Microsoft Clarity

Under its terms of use, Microsoft may also use Clarity data for its own purposes, including product improvement and user profiles for advertising. This may involve personal data. Our signal denying advertising storage does not guarantee that Microsoft gives up all these purposes of its own.

The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. After activation and your separate consent, Clarity analyzes page views, clicks, mouse movements, scroll depth, technical device and connection data as well as pseudonymous cookie identifiers. This creates heatmaps and recordings of interactions within the website. A camera or screen recording of other applications does not start.

Website content is masked. Pages with forms, data protection and cookie pages as well as pages with search parameters or fragments are excluded from this integration. No user IDs are passed on to Clarity. Allowance for advertising storage is expressly denied. Microsoft is an independent controller for its processing under the Clarity Terms and may use non-personal data for product improvement, research, development and model training.

The cookies _clck (visit identifier, up to one year) and _clsk (Assignment of page views to a session, up to a day) can be used with consent. Session recordings are typically retained for 30 days; Click and heatmap data, as well as starred or favorited sessions, can last up to 9 months. Microsoft's cookie overview also describes cross-provider identifiers. Advertising storage is not enabled in this integration.

Microsoft also processes Clarity data in US data centers. Transfers to certified US recipients are based on the adequacy decision for the EU-US Data Privacy Framework (Article 45 GDPR); Where necessary, the agreed standard contractual clauses apply. If you revoke your consent, we will stop recording, delete the Clarity cookies accessible to us and reload the page. We cannot delete cookies on third-party provider domains ourselves; you can remove them via your browser.

Further information: Microsoft privacy policy, Clarity conditions, Clarity cookies and Retention periods.

Google Search Console does not require an analytics tracker on your device and is not part of this cookie consent.

10. Storage period and deletion

Personal data will be deleted as soon as the purpose no longer applies and there is no legal retention or legal defense to prevent this. Account and salon data will be removed at the end of the contract following the agreed export and deletion process. Documents to be retained under tax and commercial law remain stored to the extent necessary and are then deleted. Backup copies can continue to exist until the next technically planned overwrite.

11. Your rights

In accordance with the legal requirements, you have the right to information, correction, deletion, restriction of processing, data portability and objection. You can revoke your consent at any time with effect for the future. Contact us to do this constantin.haerle@outlook.de.

You also have the right to complain to a data protection supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information.

12. Changes

This statement will be adjusted if functions, service providers or legal requirements change. The current version is available at any time Frisys.de/datenschutz/ available.

To the home page