Privacy Policy

This privacy notice covers two separate things: (1) the website appointly.tscholene.com that you are currently visiting, and (2) the Appointly WordPress plugin (free and Pro) when it is installed on a third-party WordPress site. The data controllers are different for each, so we cover them separately below.

Operator of this website and developer of the plugin: Jolene Lederer / TSCHOLENE, Bergstraße 3, 8712 Niklasdorf, Austria. Email: office@jl-creative.at. Full legal imprint at tscholene.com/impressum.

When you visit appointly.tscholene.com, the hosting provider automatically receives standard HTTP request data: your IP address, the date and time of the request, the URL you requested, the HTTP status, your browser user agent, and the referring URL. These logs are kept by the hosting provider for a limited time as part of standard operations security (legal basis: Art. 6(1)(f) GDPR, legitimate interest in providing and securing the site).

The website itself does not run server-side analytics or tracking pixels.

This website uses self-hosted web fonts. The typefaces Instrument Serif, Plus Jakarta Sans and DM Mono are served from /assets/fonts/ on our own domain. No font requests are sent to Google. Original licence: SIL Open Font License (OFL).

If you use the form at appointly.tscholene.com/feedback, the data you enter (name, email, category, message) is sent to the operator's email inbox. Legal basis: Art. 6(1)(a) GDPR (your consent by submitting the form) and Art. 6(1)(f) (handling your inquiry). The data is retained in the email inbox for as long as needed to answer you and for general business correspondence.

This website does not set tracking cookies. The language switcher (EN/DE) uses a URL query parameter (?lang=de), not cookies. The hosting provider may set a technically necessary PHP session cookie when needed; this is not used for tracking.

Appointly Pro is sold through Lemon Squeezy (Lemon Squeezy LLC, USA), which acts as the Merchant of Record. When you click "Get Pro" on this website, you are redirected to Lemon Squeezy. From that point on, Lemon Squeezy is the data controller for your purchase: payment processing, invoicing, VAT, refunds, and the customer record are all handled by Lemon Squeezy. We only receive: your email address, license key, and instance metadata (e.g. the WordPress site URL where Pro was activated). Legal basis on our side: Art. 6(1)(b) GDPR (performance of the license contract).

Lemon Squeezy's privacy policy: lemonsqueezy.com/privacy.

A future Pro release will allow your end-customers to pay deposits or full amounts via Stripe, using your own Stripe API keys. In that scenario: (a) appointly.tscholene.com and TSCHOLENE are not involved in the payment flow at all. (b) Your WordPress site (running Pro) communicates directly with Stripe using your keys. (c) You become the controller for the Stripe data processing on your installation, and you are responsible for your own Stripe-related privacy disclosures to your end-customers.

This privacy notice will be updated once the Stripe integration ships.

Appointly is a self-hosted WordPress plugin. When it is installed on a third-party WordPress site, the operator of that site is the data controller for any data captured by the plugin (booking inquiries, customer details, etc.). All data stays in that site's WordPress database. TSCHOLENE (the plugin developer) does not have access to any booking data or customer details captured by the plugin.

When a visitor submits a booking inquiry through a plugin-powered form, the following is stored in the operator's WordPress database: name, email, optional phone, optional message, custom field responses (configured by the operator), selected date/time slot/service, and a consent timestamp. Legal basis: Art. 6(1)(b) (pre-contractual measures) and Art. 6(1)(a) (consent via the privacy checkbox, when configured).

The plugin uses a 60-second IP-based rate limit and a hidden honeypot field. A hashed version of the visitor IP is kept in a short-lived transient; the raw IP is not persisted in the database. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in preventing spam.

Appointly Pro validates its license against the Lemon Squeezy API at activation and once per day thereafter. Only the license key and the WordPress site URL are transmitted to Lemon Squeezy. No booking data, no customer data.

The plugin sends transactional emails (inquiry confirmation, quote, booking confirmed, decline, cancellation, reminders) via the WordPress mail system, or via an SMTP server you configure. Recipients are: the customer (their own booking) and the site operator. SMTP credentials are encrypted at rest in the WordPress database using AES-256-CBC.

Sensitive credentials are encrypted with AES-256-CBC. Customer-facing accept/decline links use cryptographic tokens (SHA-256 with timing-safe comparison). All admin REST endpoints require WordPress nonce verification and capability checks. The plugin integrates with the WordPress privacy tools (Tools → Export Personal Data, Tools → Erase Personal Data), so the site operator can fulfil data-subject requests out of the box.

For data held on this website (e.g. from the feedback form), you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent (Art. 7(3)). To exercise these rights, email office@jl-creative.at.

For data held by the Appointly plugin on a third-party site, please contact the operator of that site (they are the controller).

You have the right to lodge a complaint with a supervisory authority. For Austria: Österreichische Datenschutzbehörde (Wickenburggasse 8, 1080 Wien, dsb.gv.at). For complaints about Lemon Squeezy purchases you can also use the EU Online Dispute Resolution platform: ec.europa.eu/consumers/odr.

Jolene Lederer / TSCHOLENE
Email: office@jl-creative.at
Web: jl-creative.at
Full legal imprint: tscholene.com/impressum