Version 2026-09-11. Terms of use · Cookie policy · Imprint
This policy is issued by Repito LLC, company number 932380371, registered at Miron 12, Tel Aviv 6602712, Israel, trading as Repito (https://repito.app) (“Repito”, “we”). Represented by Victor Sulema.
Repito is:
The tenant is the controller of its clients. End clients should send access, rectification, and erasure requests about their salon or clinic record to that business. We route those requests to the tenant when they reach us by mistake, except where the request is only about processing we control (cabinet cookies we set, our security logs of cabinet requests).
Repito LLC is established in Israel. Hosting in Germany does not create an EU establishment.
EU representative (Art. 27): European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium. That is the statutory in-Union address for authorities. Day-to-day requests go to the data protection officer, not to EDPO.
Data protection officer: Victor Sulema, repito.app@gmail.com. Operational chat: Telegram https://t.me/doc999tor, Viber +972 54-979-3976.
| Category | Examples | Purpose | Lawful basis |
|---|---|---|---|
| Account | Email, phone, password hash, registration IP | Create and run the owner account | Art. 6(1)(b) contract |
| Billing | Stripe customer and subscription data, amounts, owner email | Take payment; keep invoices | Art. 6(1)(b) and Art. 6(1)(c) tax |
| Marketing-site leads | Name and phone from the lead form | Pre-contract contact | Art. 6(1)(a) consent |
| Product marketing | Owner email, only if you opt in | Repito product news | Art. 6(1)(a). Separate from the terms acknowledgement. |
| Session cookies | Owner or staff session hash | Keep you logged in | Art. 6(1)(b) (strictly necessary) |
| Non-essential cookies | Google Analytics, Google Ads, Sentry browser SDK | Analytics, ads, client-side errors | Art. 6(1)(a), after opt-in. See the cookie policy. |
| Security | IP address, URL, user agent, outcome | Logs, geo-block, rate limits, fraud | Art. 6(1)(f) |
| Product analytics | Pages visited in the app | Improve the product | Art. 6(1)(f) |
| Rights-request log | Request type, dates, minimised subject reference | Demonstrate Art. 12 and Art. 17 | Art. 6(1)(c) and Art. 6(1)(f) |
Accepting the terms at signup is a contractual acknowledgement, not consent. Marketing opt-in is separate.
We store, on the tenant’s instruction: identity and contact, notes, appointment notes, custom fields, gallery files, punch cards, groups, cabinet credentials, and related records.
The tenant chooses the Art. 6 ground and, where needed, the Art. 9 ground. We do not use end-client notes for our own ads, model training, or cross-tenant analytics.
Repito is a salon and clinic CRM. Free-text notes and tenant-defined custom fields can contain health data. We do not tag or encrypt those columns separately.
Special-category content is processed only as processor on the tenant’s instruction. The tenant must have an Art. 9(2) ground (typically Art. 9(2)(h) or explicit consent) and an Art. 6 ground.
Any staff account of that tenant can read every client, note, and appointment through the product. Cross-tenant access is forbidden.
Primary processing is in Germany (Hetzner): application, databases, files, and local backup scratch. That is in the EEA.
| Recipient | What | Transfer |
|---|---|---|
| Google Workspace Drive | Encrypted backups (live copies, 30 days) and hibernated tenant archives (for the life of the account) | Google DPA / SCCs. The files are ciphertext. Keys stay on our host. |
| Google (Gmail) | Transactional email content | Google DPA / SCCs |
| Stripe | Subscription billing | Stripe DPA / SCCs / DPF as applicable |
| Sentry (EU ingest, organisation repito-eu) | Error events | EEA ingest. Some Sentry account metadata may still sit in the US. |
| Telegram | Operations alerts with identifiers, not record bodies | Telegram. We minimise what is sent. |
| Store | Period |
|---|---|
| Live CRM record of an end client | Until the tenant deletes it, or until cabinet self-delete: hidden from processing immediately, then physically deleted after 30 days unless the owner asserts a legal hold |
| Appointments that remain after a client is deleted | The appointment row stays for occupancy statistics. The client note fields are cleared at deletion. |
| Owner account | Life of the account, then a 30-day grace period, then deletion of the tenant database and files |
| Repito invoices | 7 years after the end of the financial year of the last invoice |
| In-app page visits | 13 months |
| Application logs | 90 days |
| Sentry | 90 days |
| Live backup copies | 30 days |
| Hibernated archives | Life of the account |
| Rights-request log | 3 years |
| Erasure markers that contain no personal data | Kept so an old backup cannot silently restore an erased person |
Processors and sub-processors: Hetzner (hosting, Germany), Stripe, Google (Gmail and Drive), Telegram, and Sentry. We do not sell personal data.
Owners (Repito as controller): access, rectification, erasure of the account with the tax carve-out above, restriction, portability of the account and billing data we hold, objection to marketing, and withdrawal of cookie or marketing consent. Security logging needed to run login is not optional.
End clients (the tenant as controller): exercise rights with the business. The personal cabinet can export and delete a client record. Deletion hides the record immediately. The owner has 30 days to assert a legal hold. Then we delete it.
We aim to answer requests we handle as controller within one month. We log them.
You may lodge a complaint with a supervisory authority in the Member State of your habitual residence, place of work, or of the alleged infringement. Repito LLC has no EU main establishment, so there is no single lead authority.
See the cookie policy. Necessary session cookies are not gated. Analytics, ads, and the Sentry browser SDK load only after opt-in.
The service is for businesses and their adult clients. We do not knowingly offer owner accounts to children.
Material changes bump this version. Cookie consent is asked again when the cookie-policy version changes.