Політика конфіденційності

Останнє оновлення 5 жовтня 2026 р.

This policy explains what personal data STOL collects, why, who else handles it, how long we keep it and what you can ask us to do with it. STOL is the booking page at heystol.com for cafés, bars, small restaurants and workshops.

It covers three groups of people: owners and staff who run a venue on STOL, guests who book at a venue through STOL, and anyone who visits our website.

Questions and requests go to support@heystol.com.

  1. 1. Who we are

    STOL is operated by Ergodic s. r. o., Bauerova 1205/7, 040 23 Košice, Slovakia, IČO 57859892, registered in the Commercial Register of the Municipal Court Košice, section Sro, insert 67484/V ("we", "us").

    Write to support@heystol.com about anything in this policy. We are a small company and the law does not require us to appoint a data protection officer, so we have not; the same address reaches the people responsible.

  2. 2. Our two roles

    For the data of venue owners and staff, and for our own website, we decide what is collected and why. There we are the controller.

    For guest bookings, the venue decides. Each venue is the controller of its guests' data and we are its processor. We store and send that data to run the venue's booking page, Board and emails, on the venue's instructions and for no purpose of our own. Our Terms of Service contain the data processing terms between us and each venue.

    If you booked at a venue, the venue's own privacy notice applies to your booking, and the venue is the one to ask to see, correct or delete it. You can also write to us. We will pass your request on, help the venue answer it, and tell you who operates the venue if you do not know.

    A few things around bookings are ours, not the venue's: protecting the booking form from abuse, our hosting provider's request logs, and counting visits to booking pages. For those we are the controller, as described below.

  3. 3. Owners and staff: what we collect

    If you own a venue or work at one, we keep:

    • Account: your email address, name and the language you pick.
    • Google sign-in, if you use it: the name, email address and profile picture Google shares with us, and the sign-in tokens Google issues. We use them only to sign you in.
    • Passkeys: the public key and a label for the device. Your fingerprint, face or device PIN stays on your device and never reaches us.
    • Sessions: when you sign in, the time, your IP address and your browser's user agent.
    • Venues: which venues you belong to and your role there (owner or staff), staff invitations with the invited email address, and the venue details you enter, such as name, address, phone, public email, logo and photos.
    • API keys and AI connections: the API keys you create, stored only as a hash, and the tokens, names and settings of the AI assistants you connect, with the venue each one may reach.
    • Activity: a log of changes to a venue's bookings, events and series, with who made each change, when, how (in STOL, with an API key or through an AI assistant) and what changed.
    • Admin log: actions our platform administrator takes on an account or venue, such as suspending a venue or blocking an account, with the reason. The administrator can read account and venue data to help you and to run STOL, and never signs in as you.
    • Support: what you write to us by email.
    • Billing: once paid plans start and you subscribe to one, your billing details and invoices (see Payments).

    There are no passwords. You sign in with a link and a six-digit code sent by email, with Google, or with a passkey.

    Venue details you publish, such as the phone, email and address on your booking page, are public by design.

  4. 4. Why we use it and on what legal basis

    • To provide the service: your account, sign-in, venues, staff access, and emails about bookings, alerts and the daily summary. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
    • To keep STOL secure and stop abuse: sessions, sign-in rate limits, the Activity and admin logs, and suspending accounts that break our Terms. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).
    • To send a staff invitation to the address an owner gives us. Legal basis: the legitimate interest of the venue and of us in letting a venue add its team (Art. 6(1)(f) GDPR). In this case the data comes from the owner, not from you.
    • To answer support requests. Legal basis: our contract with you, or our legitimate interest in answering people who write to us.
    • To bill paid plans and keep accounting records. Legal basis: our contract with you and our obligations under Slovak tax and accounting law (Art. 6(1)(b) and (c) GDPR).
    • To keep sign-in and the booking form safe from abuse and to deliver pages, for everyone who uses STOL, guests included: counting requests per IP address as a keyed code, and our hosting provider's request logs. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).
    • To count visits to our website and to booking pages (see Our website). Legal basis: our legitimate interest in knowing how STOL is used (Art. 6(1)(f) GDPR).

    Where we rely on our legitimate interest, we have weighed it against your rights, kept the data to the minimum and you can object (see Your rights).

    You need an email address to have an account; without one we cannot sign you in.

    We do not sell personal data, show ads or send marketing emails, and we make no decisions about you by automated means that have legal or similarly significant effects.

  5. 5. Guests of a venue

    When you book at a venue through STOL, we process for that venue:

    • your name and party size;
    • your email address, phone number and a note such as dietary needs, as far as the venue asks for them;
    • the date and time, the event and number of seats, the language of the page you booked on, where you came from (for example Instagram or the venue's website) and the booking's status, such as confirmed, arrived or cancelled;
    • for paid tickets, the amount due, the amount paid and any refund;
    • the link in your confirmation email that lets you cancel the booking;
    • changes to the booking, in the venue's Activity log.

    Staff can also enter a booking for you, for example when you call the venue.

    We email you a confirmation, a reminder on the morning of the booking, and a message if the booking is moved, your ticket is cancelled or the event is cancelled. When the venue has set a public email address, your replies go straight to the venue, not to us.

    Each venue has its own guest record per email address, with the latest name, phone number and language you gave that venue. It links your bookings there, so the venue can see in its statistics how many guests came back. Venues do not share these records: a venue never sees your record or your bookings at another venue, and a booking at one venue does not change what another holds.

    The venue's staff see your booking on their Board and in alert emails, and the owner can download the venue's bookings as a CSV file.

    To protect the booking form from abuse, we count bookings per IP address over ten minutes. The address is turned into a keyed code before it is stored, so the counter never holds your IP address.

  6. 6. Payments

    Paid tickets are paid through Stripe, on the venue's own Stripe account. The venue is the seller. You enter your card details on Stripe's page; we never see or store your card number and receive only the payment status and amounts. We send Stripe only the event's name, the price and our own reference for the ticket, not your name or contact details.

    Stripe processes the payment under the venue's own agreement with Stripe, and is an independent controller for its own duties, such as preventing fraud and checking payments as the law requires, under its privacy policy at stripe.com/privacy. Stripe's payment page is Stripe's and sets its own cookies.

    Paid STOL plans for owners are not switched on yet. Once they are, owners who subscribe pay us through Stripe as well. Stripe holds the card; we receive the subscription status, your billing details and invoices.

  7. 7. AI assistants

    An owner can connect an AI assistant, such as Claude or ChatGPT, to a venue with an API key or by signing in to STOL from the assistant. The assistant can then read and change that venue's data, guest bookings included.

    What the assistant reads goes to its provider under the owner's own agreement with that provider, and that provider's privacy terms apply. We do not send data to AI providers on our own, and we do not use anyone's data to train AI models.

  8. 8. Our website

    We use Vercel Web Analytics to count visits to our home page, the legal pages and venue booking pages. It sets no cookies, stores nothing on your device and shows us only totals, such as pages, referring sites, countries and device types. To count a visitor once a day, Vercel makes a code from your IP address and your browser's user agent, stores neither, and discards the code after 24 hours. Pages that carry a booking link or belong to a signed-in account are never sent to it, and addresses are sent without their query strings. Legal basis: our legitimate interest in knowing how our site is used.

    We also count a few actions on our own website, such as which button started a sign-up, which way someone signed in, and whether a booking was made or a ticket payment began, through Vercel Web Analytics. These counts carry no name, email address, phone number, note or account or booking identifier, use no cookies, and are not linked to you.

    For each venue we also count how often its booking page and website button are opened, per day and per source, such as Instagram or the venue's website. The count is a plain number. We store no IP address and nothing that identifies the visitor, and we skip known bots.

    Our hosting provider processes technical data, such as IP addresses, to deliver pages, and keeps request logs for a short time.

  9. 9. Cookies

    We use only cookies that STOL needs to provide what you asked for, or that remember a choice you made. The Slovak Electronic Communications Act (§ 109(8) of Act No. 452/2021 Coll.) allows these without consent, so we show no cookie banner. We set no advertising or cross-site tracking cookies. Booking as a guest sets no cookies of ours; Stripe's payment page sets its own.

    • better-auth.session_token keeps you signed in. It lasts 7 days and is renewed while you use STOL.
    • better-auth.session_data holds a signed copy of your session so pages load faster. 5 minutes.
    • better-auth.last_used_login_method remembers how you last signed in, to mark that button. 30 days.
    • better-auth-passkey holds a one-time challenge while you sign in with a passkey. 5 minutes.
    • better-auth.state protects a Google sign-in while it is in progress. 5 minutes.
    • NEXT_LOCALE stores the language you picked. 1 year.
    • sidebar_state remembers whether the sidebar in your venue's dashboard is open. 7 days.

    On a secure connection the sign-in cookies carry the prefix "__Secure-". Your browser's local storage keeps the light or dark theme you pick and, in the dashboard, your events list filter. Both stay on your device and never reach us.

  10. 10. Who else handles data

    These providers process data for us, only on our instructions and under data processing terms:

    • Vercel Inc. (USA): hosting of the website and server functions in Frankfurt, storage of venue images, and website analytics.
    • Neon (USA): the database, hosted on Amazon Web Services in Frankfurt, Germany.
    • Resend (USA): sending email, from its EU region in Ireland.
    • Upstash (USA): short-lived counters for rate limits and page opens. It holds no account or booking records.
    • PostHog (USA), in its EU region in Frankfurt: reports of errors in the app, with the page address cut short of any link or code, the browser and the technical cause. No name, email address or account, and nothing stored on your device.
    • Google (Ireland and USA): our support mailbox.
    • Stripe (Ireland and USA): billing for STOL plans, once they start.

    If you sign in with Google, Google is an independent controller of your Google account under its own privacy policy. For ticket payments Stripe works for the venue and as an independent controller (see Payments).

    Venue staff, the AI assistants an owner connects, Google and Stripe receive data as described above. We disclose data to public authorities only when the law requires it.

  11. 11. Transfers outside the EEA

    Our database and server functions are in the EU. Several of our providers are US companies, and some data can be accessed from the US, for example when a provider gives support. These transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses. You can ask us for a copy of these safeguards.

  12. 12. How long we keep data

    • Account data: while your account exists. When you delete your account in STOL, it goes at once; when you ask us to, we delete it within 30 days. Either way we keep what the law requires us to keep.
    • Sign-in: a session stops working 7 days after it was last used. Its record, with the time, IP address and browser, is deleted when you sign out of it, and otherwise stays with your account. Sign-in links and codes expire after 5 minutes, staff invitations after 7 days.
    • Admin log: while the account or venue it concerns exists. When we delete an account or venue, we delete or anonymise its entries.
    • Venue data, bookings and the Activity log: while the venue exists. When its Owner deletes the venue in STOL, they go at once; otherwise we delete them within 30 days after the venue closes its account or instructs us to.
    • Guest records: while the venue's account exists, or until the guest or the venue asks us to delete them. We act on such a request within 30 days.
    • Rate-limit counters: minutes. Page-open counters: 4 days, after which only daily totals per venue remain. Website analytics: the daily visitor code is discarded after 24 hours, and only totals remain.
    • Support emails: as long as needed to handle your request and any follow-up.
    • Invoices and accounting records: 10 years, as the Slovak Accounting Act requires.

    Deleted data can stay in our database provider's recovery history for a short time before it is overwritten.

  13. 13. Security

    Data travels encrypted over HTTPS. Each venue's data is separated in the database by row-level security, and every request is checked against the person's role at that venue. There are no passwords to leak, API keys are stored only as hashes, and IP addresses used for rate limits are stored only as keyed codes. Only the people who run STOL can reach the production systems.

    If a breach puts personal data at risk, we will tell the supervisory authority and, where the law requires, the affected venues and people.

  14. 14. Your rights

    Under the GDPR you have the right to:

    • access the personal data we hold about you and get a copy;
    • have inaccurate data corrected;
    • have your data erased;
    • restrict how we use it;
    • receive data you gave us in a machine-readable format (portability);
    • object to processing based on our legitimate interest;
    • withdraw consent at any time, where we rely on it.

    Write to support@heystol.com from the email address of your account, or tell us how we can check it is you. We reply within one month.

    Guests: send requests about a booking to the venue. If you write to us, we forward the request to the venue and help it answer. You can cancel a booking yourself through the link in its confirmation email.

    You can also complain to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk, or to the authority in the EU country where you live or work.

  15. 15. Children

    STOL is not meant for children under 16, and we do not knowingly create accounts for them.

  16. 16. Changes to this policy

    We update this policy when STOL changes. The date at the top shows the current version. Before a material change takes effect, we email venue owners.

Оператор STOL — Ergodic s. r. o., Bauerova 1205/7, 040 23 Košice, Словаччина. IČO 57859892, DIČ 2123319803. Зареєстровано в Торговому реєстрі Міського суду Кошице, розділ Sro, запис № 67484/V. Ел. пошта support@heystol.com. Наглядовий орган: Словацька торговельна інспекція (SOI), Інспекторат Кошицького краю, Vrátna 3, 043 79 Košice.