Privacy policy

Last updated: 7 November 2026 — Version 1.25

1. Who is responsible for your data

Owner of Apoing and data controller: Natalia Chamorro González
Address: Calle del Sol 62, 08201 Sabadell (Barcelona), Spain
Email: support@apoing.com
Website: www.apoing.com

The Apoing mobile app is published on the App Store and Google Play through the developer account of Sergio Viciana, who distributes it on behalf of the owner. The controller of the data processed through the app is the owner of Apoing indicated above.

A Data Protection Officer (DPO) has not been designated, as it is not mandatory under current regulations for an organisation of this size.

2. Two roles: Apoing and each community

• Apoing as controller: your user account, the website and the app, our own communications with you, security, analytics and advertising, and the satisfaction surveys we run.
• Apoing as processor for each community: the community (residents' association, club, school…) decides who its members are and how its facilities are used. For the data the community manages in Apoing (its members and their booking codes, bookings, waiting lists, notices, polls, incidents, invitations, access control, the documents it uploads such as minutes or rules…) the controller is the community, and Apoing processes that data only on its behalf and according to its instructions, under the data processing terms included in our Terms and Conditions (section 13). To exercise your rights over that data you may contact your community or us, and we will pass the request on.
• Businesses (hair salons, clinics, studios…): a business is a community too, and the same applies. It is the controller of its customers’ data in Apoing: the services and notes of each appointment, the photo, presentation and account of its professionals, and the walk-in customers it registers itself (name and phone number or email, so it can give them appointments and send them reminders, even if they have no Apoing account). The first reminder we send a walk-in customer tells them who is responsible for their data and how to ask for it to be changed or deleted. The business can also keep a note about each customer, mark when they did not turn up (“no-show”) and, with the customer’s permission, keep photos on their card (for example, the result of a treatment): only the people who manage its appointments see them, they are deleted after 2 years (or earlier if the business deletes them or the card) and you receive them if you download your data. If that person later creates an Apoing account with the same email, the business can link the record to it: their appointments, notes and no-show marks move to their account. If the business asks questions when you book (for example “is it your first time?”, allergies, or a text you must accept, such as consent for a treatment), your answers are stored with the appointment and the business sees them; when they concern health they are specially protected data, the business is responsible for them and should only ask what the service needs. We keep them until 2 years after the appointment (one month if it is cancelled). If a business has a loyalty card, we count your appointments there to show your stamps and record when you redeem the reward (kept 2 years). If a business turns on the come-back reminder for a service, we use the date of your last appointment there to send you, on its behalf, one notice when it's time to book again (you can turn it off in Notifications › “Time to come back”). If a business lets you book without an account from its public page, we store your name, email, phone and the appointment for that business (its controller) and the connection's IP address for 30 days to prevent abuse; the confirmation email includes a link to cancel. If you write a review of an appointment, it is shown with your first name and the initial of your surname, your ratings and your text, to the members of that business (and on its public page if it has one); if you delete your account, it stays without your name.

3. Personal data we process

• Account: name, email address, password (stored using a one-way cryptographic hash), language, country and notification preferences (for each kind of notification, whether you want it by email and/or push). Optionally, your phone number: only the businesses where you book see it, and only if you tick it, so they can call you or send you a reminder by WhatsApp from their own number. A business can also note the phone you give it on your customer card.
• Communities: the communities you belong to, your role, your booking code and, where applicable, the accounts linked to it.
• Bookings and waiting lists: date, time, facility, participants and credit balance where the community uses credits. If the activity asks for the players of each booking (for example in clubs), the members you play with, or the name of a guest you write, and whether the booking was made on the spot (walk-in) or in advance.
• Matches and sports activity: the matches you create or join, results, sports level, ranking, MVP votes and your tournament registrations, matches and results. Your level in each sport (0 to 5) is calculated automatically from the confirmed results of your matches; the first time you create a match in a sport you can answer 3 optional questions (how long you have been playing, how often you play and whether you have competed) to start with an approximate level. We keep those answers with your level and do not use them for anything else.
• Messages between people: what you write to your community's administrators, to other members and in the chat of a match (only the organiser and the players who joined can see a match chat; whoever leaves the match stops seeing it). We use them only to deliver them and to notify the recipients. You can mute a conversation, block a person (you stop seeing their messages and getting notifications from them; we keep the list of people you have blocked) and report a message: we keep a copy of the reported message, who reported it and why, and Apoing reviews it to remove content that breaks the rules. Community administrators do not read match chats.
• Internal notes: the people who manage users in a community can write a short note about a member (for example, «prefers afternoons»). Only they can see it; you get it if you download your data. It is deleted when you leave the community or delete your account.
• Community participation: notices you receive, polls and your votes, incidents you report (text and, if you add them, photos) and your community’s meetings: whether you say you are attending, not attending or delegating, and the delivery status of each meeting notice we email you (delivered, opened, bounced), which the administrator sees and is deleted after a year. Meeting notices always reach you by email, because your community sends them; you can turn off the phone notification. If you do not have an account yet, your community administrator can add your email as the contact of your home: you receive the invitation and, until you create your account, the community’s meeting notices and document notices; an unaccepted invitation is deleted after 6 months and you can ask your community or us to delete it sooner. If your community runs activities (courses, training sessions…) with sign-up, we store whether you signed up, asked for a place or are on the waiting list, the note you add and, if the administrator takes attendance, whether you came to each session; the administrators of your community see it and you receive notices about your place. We keep it until 2 years after the activity's last session, or until you delete your account.
• Community rules: if your community publishes rules, a record that you accepted them (date, version of the rules and IP address), so that the administrator can prove they were accepted.
• Consent log: each time you accept the Terms and Conditions or this Privacy Policy (when signing up, editing your profile or, when they change, in the notice that asks you to accept the new version on the website or in the app) or, as an administrator, the data processing agreement of your community, we record the date, the IP address and the version you accepted, so that it can be proved. You can see it in your profile («What you have accepted») and it is included in «Download my data»; administrators can download the certificate of their community’s agreement in PDF from the community settings.
• Satisfaction surveys: the answers you choose to give in the surveys we occasionally show (for example, to community administrators). They are linked to your account. If you choose to, also an opinion to be published on our website, with the signature you choose (first name and community, community only, or anonymous).
• People who are not Apoing users: the name and email of external players added to a match and the email of people invited to join a community, provided by the user or administrator who invites them.
• Access control and lighting: if your community connects doors, readers or smart plugs, the access codes generated for your bookings and a log of openings and switch-ons.
• Technical data: IP address, browser and device type, security logs and technical error logs of the website and the app (sent to our own server to fix faults).
• Mobile app: app version, push notification token (Firebase Cloud Messaging / Apple Push Notification service), and — only if you consent — usage statistics and crash reports (Firebase Analytics and Crashlytics) with device identifiers; advertising identifiers as described in section 10.
• Web push: the push endpoint and cryptographic keys of your browser, only if you enable web notifications.
• Communications: messages you send us through the contact form, through «Apoing is listening» (suggestions and cases we do not cover yet) or by email. If your message is about something your community manages (a breakdown, its rules, a booking), we may forward it to that community's administrators so they can answer you, and we will tell you so.

4. Purposes and legal basis

5. What other users can see

Within each community, members can see the name of the people who book or take part in matches and tournaments, match results, levels and rankings, poll results and the notices the community publishes. Administrators see the information they need to manage the community (members, bookings, incidents, waiting lists). In polls that are not anonymous, members and the administrator see what each household (or each person, if the community does not use codes) voted when results are shown; in anonymous polls only the count is shown. Polls are advisory, not formal decisions of the community. Linked accounts see each other's bookings in the communities they share. In activities that ask for the players of each booking, members see who plays in each booking, and the players receive a notice when they are added; the community administrator can export these bookings with their players to keep usage statistics. Administrators can also create subscription links that show the community's bookings (or those of some of its calendars), with the name of whoever booked, in a calendar app such as Google Calendar, Apple Calendar or Outlook, and share them with whoever needs them (for example, the professional of that calendar); those apps download the bookings periodically, and the links stop working when the administrator revokes them or stops being an administrator. We never show your email address to other members, except to the administrators of your communities.

Public page of a community: if a community turns on its public page, anyone can see the information about the community itself: name, type, town, description, photos uploaded by the administrator, what can be booked with its opening hours and main rules, tournaments and matches with free places (date, activity and places, never the players' names), the number of members and the number of bookings in the last month. The street address and the map are shown only if the administrator chooses to; the administrator can also hide the opening hours, the rules, the tournaments and matches and the figures. No member's personal data is published.

«Write to the administration» button: if a community turns it on, a visitor can send it a message from its public page. The name, email and message you write are emailed to the community's administrators so they can reply to you (the community is responsible for that conversation). Apoing does not store the message; it only counts sends for a few hours, by IP address, to stop abuse.

Similar community when creating one: before creating a community we check whether a very similar one already exists (name, town, address or place on the map) and show you its name, town and, if its public page shows it, its address, so you can join it or write to its administrators. If you write, your name, your email and your message are emailed to its administrators so they can reply. Apoing does not store the message; it only counts sends for a day to stop abuse.

6. How long we keep data

• Account and activity: while your account is active. When you delete your account we erase your personal data (profile, photo, email, phone, sessions, notifications, consents, sports level, ranking and your places in matches or bookings that have not taken place yet). What is part of your community's history (past bookings, matches already played, issues, posts and votes) is kept without your name or any data that could identify you, and the IP address is removed from the records that are kept. If you accepted your community’s data processing agreement as an administrator, that acceptance belongs to the community and is kept, without your email or IP address, so that the community can still prove it. Only the minimum data required by law (tax, anti-fraud) is kept separately for the legally required period.
• Invitations to join a community that are not accepted: deleted after 6 months.
• Accounts that are never activated (the activation email was not confirmed): deleted after 14 days, unless a community administrator added them.
• Satisfaction surveys: up to 24 months after the survey closes. Published testimonials: until you withdraw your permission or we stop showing them.
• External players: while the match and its results exist in the community.
• Two-step verification: the secret of your authenticator app is stored encrypted while it is on; it is deleted when you turn it off or delete the account. If you turn it off with the email link (or a superadministrator removes it), we keep when and from which IP it was requested and used, for 12 months, for security.
• Your community's automatic rules: if your community uses them, we keep cancellations made at short notice, bookings the administrator marks as a "no-show" (or that are marked automatically if the community turns it on and you requested the door code without opening the door), and the sanctions they cause (some days without being able to book), with their date and reason. The community's administrator sees them, we email you when there is a sanction, and they are deleted after 12 months.
• Push tokens and web push subscriptions: while notifications are active; they are deleted when you disable them or the device/browser revokes them.
• Crash reports: up to 90 days. Usage statistics: up to 14 months.
• Security and sign-in logs: up to 12 months (including the log of accesses by Apoing support to an account, which records who, when, from which IP, why and which pages were viewed). Cookie consent log: 3 years. Technical error logs of the website and the app: 90 days.
• Match chats: deleted 6 months after the match (if the match has no booking, 6 months after the last message). Reports of messages: 12 months. People you have blocked: until you unblock them or delete your account.
• Notices and notifications already read or deleted: up to 24 months. Stay-signed-in devices not used: 12 months (the browser cookie itself lasts 180 days from the last visit). App sessions: 90 days without use; closed or expired sessions are deleted 90 days later. Devices you have signed in from (browser or phone type, IP address and dates, so we can email you when someone signs in to your account from a new one): 13 months without use.
• Calendar subscription links of a community: while they are in use; once revoked, they are deleted after 90 days.
• A business’s appointment waiting list (name, email, phone, the service, day and time of day you ask for, and your place): deleted 30 days after the requested day; earlier if you leave the list or the business removes you. We manage it on behalf of the business, which is the controller.
• Walk-in customers of a business (registered by the business, without an Apoing account): deleted after 2 years without appointments; their past appointments stay without their name. Photo and presentation of a professional: until the business removes them or changes the calendar.
• Bookings: after 5 years they are no longer linked to your account (they are kept only for the community's statistics, without your name).
• Booking history (who made, cancelled or changed each booking, when and from which IP address): the IP address is removed after 12 months and the history is deleted after 24 months.
• Credit balance moves when changing home (who changed, from which home to which, how many credits and whether they moved): 24 months.
• Log of emails sent (recipient, subject and whether it was delivered; not the content): 12 months.
• Statistics: before deleting the booking history and the email log we keep a monthly summary per community and calendar (number of bookings, cancellations, minutes booked, emails sent…). It contains no personal data, so it is kept indefinitely so that each community can see how it evolves over the years.
• Backups: kept for at most 12 months (daily ones, 10 days). Data you delete, or that we delete when the periods in this list are reached, also disappears from the backups when they expire, at most 12 months later. They are only used to restore the service after a failure.
• Inactive accounts: if you do not sign in on the website or in the app, nor make any booking, for 3 years, we email you and, if you still do not sign in within the next 30 days, we delete the account and your personal data (just as if you deleted it yourself). Accounts that administer a community are never deleted for inactivity.

7. Recipients and service providers

We do not sell your data. We use these providers, which act as processors on our behalf (or, for advertising, as indicated by Google):

• Contabo GmbH (Germany) — hosting of the website, the app back end and the database, within the EU.
• Sendinblue SAS – Brevo (France) — sending of emails, within the EU.
• Google Ireland Limited / Google LLC — Firebase Cloud Messaging (app push), Firebase Analytics and Crashlytics (only with consent), Google Analytics, Google AdSense, Google Ads and Google AdMob (according to your consent), and Google Maps (map and address search in the community finder, and the map on a community's public page, which only loads if you open it).
• Apple Inc. — delivery of push notifications to iPhone (APNs) and distribution of the app.
• Google Sign-In and Sign in with Apple — only if you choose to sign in with them: we receive your name, email address (or Apple's private relay alias) and a stable identifier, used solely to find or create your account.
• Google reCAPTCHA — when you create an account on the website, and when an activity asks for the “I'm not a robot” check before booking on the website; Google receives technical data from your browser to tell people and bots apart. See Google's Privacy Policy.
• Browser push services (Google, Mozilla, Microsoft, Apple) — only if you enable web notifications; this is a technical requirement of the Web Push standard.
• Shelly (Shelly Group) (Bulgaria, EU) — only for communities that connect their Shelly devices: we send it the device identifier and the switch-on time for a booking. No user personal data is sent.

Some of these providers (Google LLC, Apple Inc.) may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission.

8. Your rights

Under the GDPR and Spanish Organic Law 3/2018 (LOPDGDD) you have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability and to withdraw consent at any time without affecting prior processing. You can delete your account at any time from your profile on the website or in the app, and download a copy of your data (profile, communities, bookings, matches, issues, the messages you wrote, people you blocked, reports you made and what you have accepted, in JSON and CSV) with the "Download my data" button in your profile.

To exercise your rights, write to support@apoing.com from the email address of your account (or attach proof of identity). We will reply within one month. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

9. Minors

You must be at least 16 years old to register. People aged 14 to 16 need the consent of their parents or legal guardians.

10. Advertising in the mobile app

The Apoing app (Android and iOS) shows advertising through Google AdMob:

• iOS: on first launch we ask for permission under Apple's App Tracking Transparency (ATT). If you allow it, ads may be personalised; otherwise only non-personalised ads are shown.
• Android: Google's User Messaging Platform (UMP) manages your advertising consent in accordance with the GDPR.
• In both cases some advertising may be shown regardless of your choice, but without personalisation.
• AdMob may collect technical data (device identifiers, IP address, approximate location) to serve ads. See Google's Privacy Policy.

11. Apoing on social media

Apoing has a Facebook page and an Instagram account to explain how the platform works and share news. When you visit them or interact with them (follow, like, comment or send a message), Meta Platforms Ireland Ltd. processes your data under its own policies, and Meta and Apoing are joint controllers for the page statistics (Art. 26 GDPR; see Meta's Page Insights Controller Addendum).

• From Meta we only receive aggregated statistics (reach, views, likes, comments, shares, saves, followers and clicks on the profile link), which we use to see which posts are useful. We cannot identify who is behind them.
• We do not combine that data with your Apoing account. To measure whether a post helps, we compare overall usage figures for Apoing (for example, how many tournaments were created that week), never data about specific people.
• If you write to us on Facebook or Instagram, we only use your message to answer you.
• Legal basis: Apoing's legitimate interest in making itself known and measuring its communication (Art. 6(1)(f) GDPR). You can exercise your rights with Meta (Meta Privacy Policy) or with us at hola@apoing.com.

12. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), passwords stored as one-way hashes, access restricted by role, and servers located in the European Union. We make a backup every night, encrypted (AES-256) before it leaves the server and stored in two different locations within the European Union; we check every day that it arrives intact and every week that it can be restored.

13. Changes to this policy

We will update this policy whenever we change how we process data. Material changes will be announced through the platform.