Politique de confidentialité

Last updated: 20 October 2026

1. Controller

Cronema UG (haftungsbeschränkt)
Isabellastrasse 9, 80798 München, Germany
Represented by the managing director Manfred Sandner
Phone: +49 163 4517633
Email: support@cronema.com

This privacy policy applies to our website about the Shopify app Bookique (the “website”) and to the Bookique app itself (section 9).

2. Overview

• We don’t use advertising cookies. We use Google Analytics only with your consent, to improve the website (section 5).
• You can change or withdraw your consent at any time via the shield icon at the bottom left or the “Cookie settings” link at the bottom of every page.
• Fonts are loaded from our own web server, not from Google.
• The website has no forms. Bookique is installed through the Shopify App Store.
• In the Bookique app we process your customers' booking data solely on your behalf (section 9).

3. Hosting and server logs

When you visit the website, our hosting provider processes technically necessary data sent by your browser: IP address, date and time of access, page requested, referrer URL, browser type and version, operating system. This data is needed to deliver the website and to keep it secure and stable (e.g. to fend off attacks). It is not combined with other data sources.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure and error-free provision of the website. Server logs are deleted by the hosting provider after a short time, usually within 30 days, unless they are needed to investigate a security incident.

Hosting provider: Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. A data processing agreement (Art. 28 GDPR) is in place. Transfers to the USA are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). The website is delivered through a worldwide network of servers.

4. Browser storage, cookies and consent

Under § 25 (1) TDDDG, storing information on your device or accessing it generally requires your consent, unless it is strictly necessary for a service you have expressly requested (§ 25 (2) no. 2 TDDDG). We set no cookies without your consent. As strictly necessary we store only one entry in your browser’s local storage (localStorage):

• “bookique-consent”: your choice in the consent banner and when you made it, so the banner does not appear on every page view. Valid for 12 months, then we ask again.

This entry does not leave your browser. You can delete it at any time in your browser settings.

For web analytics with Google Analytics (section 5) we ask for your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Without consent Google Analytics is not loaded; all content of the website remains fully usable. You can withdraw your consent at any time with effect for the future by opening the settings via the shield icon at the bottom left, the “Cookie settings” link at the bottom of every page or the button at the top of this page. The lawfulness of processing before the withdrawal remains unaffected (Art. 7 (3) GDPR).

5. Web analytics with Google Analytics (only with consent)

If you consent to the “statistics” category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). Google Analytics records which pages you view, how long you stay, which website you come from, and details of your browser, operating system, device, screen size and approximate location (country, region, city). For this, cookies (_ga, _ga_<ID>) valid for up to two years are stored on your device. Google Analytics 4 does not store your IP address; it is used only briefly to determine the approximate location. We use the reports only in aggregate to improve the website and our offer; they are not combined with your name or contact details. Google signals and personalised advertising are switched off.

Google processes the data on our behalf; a data processing agreement (Art. 28 GDPR) is in place with Google. The data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; transfers are therefore based on the European Commission’s adequacy decision (Art. 45 GDPR), supplemented by the Standard Contractual Clauses. Analytics data is kept by Google for 14 months.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Without consent Google Analytics is not loaded. If you withdraw consent in the cookie settings, we stop measuring and delete the Google Analytics cookies in your browser. More information: policies.google.com/privacy.

6. Fonts

The fonts used on the website (Inter, Inter Tight) are stored on and loaded from our web server. No connection is made to servers of Google or other font providers.

7. Contact by email or phone

If you contact us by email or phone, we process your details (e.g. name, contact details, content of your request) to answer your request. The legal basis is Art. 6 (1) (b) GDPR if your request relates to a contract or its preparation, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering requests).

8. Links to the Shopify App Store

The website links to Bookique's listing in the Shopify App Store. Data is only sent to Shopify when you click such a link; Shopify's privacy policy then applies (Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland).

9. Using the Bookique app

9.1 Roles

Bookique is installed by Shopify merchants (“merchants”) in their store. We process the merchant's data as our customer (store domain, store name, name and email address of the store owner, phone, country, plan) as controller to perform the contract (Art. 6 (1) (b) GDPR).

The data of end customers who book in the store (e.g. name, email address, phone number, answers to form fields, booked service, date and time, tickets, passes, waiting list entries, notes) and the data of staff, performers and venues the merchant adds are processed solely on behalf of the merchant. In this respect we act as processor under Art. 28 GDPR; the merchant is the controller of this data. Shopify's terms for app developers apply in addition.

9.2 Servers and storage

The app, its database and uploaded and generated pictures run on servers in Germany (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany). Payments are made in the Shopify checkout; we do not receive payment data. We read store data (e.g. orders for paid bookings) only within the permissions granted by the merchant through the Shopify API.

9.3 Emails

Booking emails (e.g. confirmation, reminder, follow-up, cancellation) are sent through the SMTP server the merchant has entered in the app. Without an own server we send them through our email service on the merchant's behalf. The merchant can see the sending history in the app.

9.4 AI features

If the merchant uses the AI assistant or AI pictures (PROFESSIONAL and UNLIMITED plans), their chat messages or picture descriptions are sent to OpenAI together with the details from their Bookique account needed for the task (e.g. names of services, staff or events) to generate answers and pictures. The provider is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; processing may also take place by OpenAI, L.L.C. in the USA. Transfers to the USA are based on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses. Under OpenAI's API terms, the submitted content is not used to train models; OpenAI may keep it for up to 30 days to detect abuse. Generated pictures are stored on our servers. End customer data is not sent for the AI features; merchants should not enter their customers' personal data in the chat. The legal basis is Art. 6 (1) (b) GDPR.

9.5 Customer management (CRM)

On installation, reinstallation and uninstallation and when the plan changes, we send the store owner's contact details (name, email address, store name, phone, country) and the plan to our CRM system to look after and inform our customers. The CRM provider is HighLevel, Inc. (with LeadConnector LLC), 1801 N. Lamar St., Suite 600, Dallas, Texas 75202, USA; the data is processed in Google Cloud and Amazon Web Services data centres. A data processing agreement (Art. 28 GDPR, Data Processing Addendum including the EU Standard Contractual Clauses) is in place with HighLevel. HighLevel is certified under the EU-US Data Privacy Framework; transfers to the USA are therefore based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR), supplemented by the Standard Contractual Clauses (Art. 46 (2) (c) GDPR). The legal basis is Art. 6 (1) (b) and (f) GDPR (customer care). End customer data is not sent to the CRM.

9.6 Calendar sync and online meetings

For calendar import, the app fetches the iCal addresses the merchant has entered (e.g. from Airbnb, Booking.com or Google) and takes busy times from them. A staff member's own calendar link shows busy times only, without customer data. For online appointments the app stores the meeting link (Zoom, Google Meet, Teams) entered by the merchant and adds it to the emails; Bookique does not send any data to these providers.

9.7 Error monitoring

To detect and fix errors in the app, technical error reports (e.g. error message, affected feature, time, browser and device details) may be sent to the Sentry service (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA). A data processing agreement with Standard Contractual Clauses is in place. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in an error-free app).

9.8 Retention and deletion

A store's data is kept after uninstallation until Shopify requests its deletion (usually 48 hours after uninstallation); we then delete it unless statutory retention obligations apply. If an end customer requests deletion of their data through Shopify, we remove their personal data from the store's bookings. Billing-related subscription data is kept for up to ten years under commercial and tax law.

10. Your rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent with effect for the future (Art. 7 (3) GDPR)

If you are an end customer of a store, please contact the merchant first; they are responsible for your booking data. We support them in fulfilling your rights.

Right to object (Art. 21 GDPR)

Where we process data on the basis of Art. 6 (1) (f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If your data is processed for direct marketing, you can object at any time without giving reasons.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

To exercise your rights, an informal message to support@cronema.com is sufficient.

11. Data security

The website and the app are transmitted exclusively encrypted via HTTPS (TLS). We take technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

12. Changes to this privacy policy

We update this privacy policy when the website, the app, our services or the law change. The version published here applies.