Privacy policy

01Who we are

TrainCove is software for businesses in Greece: customers, messages, bookings and follow-ups in one place. It is in early preview and no paid service is offered yet.

For anything about your data, email us at the address below.

Company name

[to be added]

Address

[to be added]

VAT number

[to be added]

Email

info@traincove.app

02Two roles

For the accounts of businesses and their team members, TrainCove is the controller.

For the data of a business’s customers (contacts, bookings, messages, notes), the business is the controller. TrainCove is the processor: it processes that data only on the business’s behalf and on its instructions, under a data processing agreement (GDPR Article 28).

If you are a customer of a business, contact that business first about your data. If you write to us, we pass your request on to the business.

03If you booked from a booking page

• The details you enter (name, email or phone, notes, answers to the form’s questions) go to the business named on the page, so it can arrange your appointment.
• The business is the controller. TrainCove hosts the page and stores the details on its behalf.
• Legal basis, as a rule: the steps for the appointment you asked for (GDPR Article 6(1)(b)).
• We email you about the booking (confirmation, change, cancellation). We send reminders only if you tick the box, and you stop them from the management link.
• To prevent abuse we keep, for up to about one day, a cryptographic fingerprint of your network address, not the address itself.
• The business decides how long it keeps your details. [Suggested: 24 months after the appointment; automatic deletion does not exist yet.]
• For access, correction or deletion, contact the business.

04Business accounts: what we keep and why

• Account details: name, email, password (stored only in a one-way form), language and time zone. To run the account you asked for (Article 6(1)(b)).
• Sign-ins: the IP address and browser of each session, and request limits per address. To keep the account secure (legitimate interest, Article 6(1)(f)).
• Change history: who changed what, and when, inside the business. For security and accountability (Article 6(1)(f)).
• Account emails: email confirmation, password reset, invitations. We send no marketing emails.
• We make no automated decisions with legal effects on you.

05Cookies and storage on your device

We use only what is needed for what you ask the service to do. There are no analytics, advertising or third-party cookies. That is why we do not ask for consent with a pop-up.

06Who else processes it

We use a few providers, who process data only for us:

• Hosting: Hetzner Online GmbH, Germany.
• Transactional email: Brevo (Sendinblue SAS), France.
• DNS: Cloudflare, for the domain’s DNS only; no traffic to the service passes through it.
• SMS: BulkGate, Czech Republic, only if the business turns SMS on.
• Phone answerer: not offered yet. Its providers will be listed here before it is switched on.

We do not sell data and we do not use it for advertising.

We aim to keep data in the EU. If a provider transfers it outside the EEA, we will say so here, with the safeguards (for example standard contractual clauses).

07How long we keep it

• Account: while it is active. [To be added: how long after closing.]
• Sign-in records: [to be added; today they are not deleted automatically].
• Fingerprints for abuse prevention: up to about one day.
• A business’s customer data: as long as the business decides. When the business leaves, we delete or return it, as the data processing agreement says.

08Your rights

You can ask for access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interest. Email us at the address above. We answer within one month.

If you are a customer of a business, contact the business.

You can complain to the Hellenic Data Protection Authority (www.dpa.gr).

09How to ask about your data

For a copy, a correction or the erasure of your data, email:

info@traincove.app

We answer within one month.

If you are a customer of a business that uses TrainCove, ask the business: it is the controller, and TrainCove, as its processor, helps it answer.

10Security

Encrypted connections (HTTPS), each business’s data kept apart inside the database, passwords only in a one-way form, access by role. If a breach happens, we tell the business without undue delay.

11Changes

If this policy changes, we publish the new version here with a new date.