Data controller
The data controller is XLab Services, 24 B route de Saint-Nazaire, 44160 Pontchâteau, France. For any question about personal data: confidentialite@getalldone.app.
Data processed and purposes
GetAllDone processes only the data strictly needed to run the service:
- Professional account: identity, contact details, business, booking page — performance of the contract.
- Client bookings: name, phone number, optional email address, service address for home visits, appointment history — performance of the contract between the professional and their client, for which GetAllDone acts as processor.
- Messages exchanged around an appointment, notifications (email, SMS) — performance of the contract.
- Payments and gift cards: operated by Stripe; GetAllDone stores no card numbers — performance of the contract and accounting obligations.
- Usage analytics: PostHog (EU hosting), enabled only with your consent, with no individual profile and no session recording — consent.
- Technical logs and error reports, with email addresses and private links removed before sending — legitimate interest (security and reliability).
Retention periods
- Professional account: for as long as the service is used, then deleted or anonymised within 3 months of account closure.
- Client records and booking history: managed by the professional; deleted with their account, or on request addressed to the professional.
- Accounting records linked to payments: 10 years (legal obligation).
- Technical logs and error reports: 90 days at most.
- Unsubscribed or bounced email addresses: kept on a suppression list for as long as needed to honour the objection.
Processors and recipients
Data is never sold or shared for advertising. It is entrusted to the following processors, each for its sole function:
- Convex, Inc. (United States) — application database hosting, EU standard contractual clauses.
- Vercel, Inc. (United States) — website hosting and delivery, standard contractual clauses.
- WorkOS, Inc. (United States) — professional account authentication, standard contractual clauses.
- Stripe Payments Europe, Ltd. (Ireland) — online payments and payouts.
- Resend, Inc. (United States) — transactional email delivery, standard contractual clauses.
- SMS Partner (France) — SMS delivery.
- PostHog EU — anonymous usage analytics, hosted in the European Union, with consent.
- Routing providers (Mapbox, Google Maps Platform or IGN) — route calculation; only the address concerned is transmitted, never your full identity.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability provided by the GDPR. To exercise them, write to confidentialite@getalldone.app; we reply within one month. You may lodge a complaint with the CNIL (cnil.fr), the French supervisory authority.
If you are a client of a professional using GetAllDone, your first contact for your client record is that professional, who is the controller of their client relationship; we assist them in handling your request.
Cookies and trackers
The website uses no advertising cookies or third-party trackers. PostHog analytics only runs after your explicit consent, which you can withdraw at any time from the application's Privacy page. The only technical storage (sign-in session, display preferences) is necessary for operation.
Security
Traffic is encrypted (TLS), data access is limited to what the service requires, and booking links use private per-client tokens. GetAllDone stores no banking data.
Updates
This policy may evolve with the service; it was last revised on 17 September 2026. Notable changes are announced to professionals by email.