Data controller
The data controller is XLab Services, 24 B route de Saint-Nazaire, 44160 Pontchâteau, France. For any question about personal data: confidentialite@getalldone.app.
Data processed and purposes
GetAllDone processes only the data strictly needed to run the service:
- Professional account: identity, contact details, business, booking page — performance of the contract.
- Client bookings: name, phone number, optional email address, service address for home visits, appointment history, birthday (day and month, without the year, entered by the professional or given by the client, optional) and the information in fields the professional adds to their records (member number, reference…), if they fill them in — performance of the contract between the professional and their client, for which GetAllDone acts as processor.
- Messages exchanged around an appointment, notifications (email, SMS) — performance of the contract.
- A professional's news and offers to their clients (invitations to book again, loyalty rewards, offers, birthday message), by email or text message: sent only to people who booked or bought from them, informed by a box on the form that they can untick. Every email lets them object (unsubscribe link), as does the box on the booking, and the objection applies to that professional; replying STOP to a text message stops all text messages sent to that number — legitimate interest of the professional (marketing to their own clients for similar services, article L34-5 of the French Postal and Electronic Communications Code), for whom GetAllDone acts as processor.
- Client area: the email address entered to find one's appointments is used only to send, to that same address, the links of upcoming appointments booked with it. It is not added to any record: it only remains in the technical logs of the sending, deleted within seven days by our host, and a non-reversible fingerprint is used for one hour to limit repeated requests. The page never reveals whether the address is known — performance of the contract between the professional and their client, and legitimate interest (service security).
- Payments and gift cards: operated by Stripe; GetAllDone stores no card numbers — performance of the contract and accounting obligations.
- Subscriptions of a professional's clients: name, phone, email address, plan, paid months and sessions used; the payment method and charges are processed by Stripe on the professional's account — performance of the contract between the professional and their client, for which GetAllDone acts as a processor.
- Professional subscriptions: payment method, billing address, VAT number and invoices, processed by Stripe; GetAllDone only keeps the subscription status (plan, billing period, renewal date) — performance of the contract and accounting obligations.
- Usage analytics: PostHog (EU hosting), enabled only with your consent, with no individual profile and no session recording — consent.
- Technical logs and error reports, with email addresses and private links removed before sending — legitimate interest (security and reliability).
Retention periods
- Professional account: for as long as the service is used, then deleted or anonymised within 3 months of account closure.
- Client records and booking history: managed by the professional; deleted with their account, or on request addressed to the professional.
- Accounting records linked to payments: 10 years (legal obligation).
- Technical logs and error reports: 90 days at most.
- Unsubscribed email addresses and phone numbers, bounced addresses: kept on a suppression list for as long as needed to honour the objection.
Processors and recipients
Data is never sold or shared for advertising. It is entrusted to the following processors, each for its sole function:
- Convex, Inc. (United States) — application database hosting, EU standard contractual clauses.
- Vercel, Inc. (United States) — website hosting and delivery, standard contractual clauses.
- WorkOS, Inc. (United States) — professional account authentication, standard contractual clauses.
- Stripe Payments Europe, Ltd. (Ireland) — online payments and payouts; billing of professional subscriptions (payment method, billing address, VAT number, sending of invoices and receipts); charges for the subscriptions professionals sell to their clients.
- Resend, Inc. (United States) — transactional email delivery, standard contractual clauses.
- Octopush (France) — SMS delivery.
- Umami — audience measurement for the marketing website, without cookies or persistent identifiers; the application is not measured by Umami.
- PostHog EU — anonymous usage analytics, hosted in the European Union, with consent.
- Routing providers (Mapbox, Google Maps Platform or IGN) — route calculation; only the address concerned is transmitted, never your full identity.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability provided by the GDPR. To exercise them, write to confidentialite@getalldone.app; we reply within one month. You may lodge a complaint with the CNIL (cnil.fr), the French supervisory authority.
If you are a client of a professional using GetAllDone, your first contact for your client record is that professional, who is the controller of their client relationship; we assist them in handling your request.
Cookies and trackers
The website uses no advertising cookies and no tracker that follows you across sites. The marketing pages are measured by Umami, without cookies or persistent identifiers. Professionals' booking pages keep a simple daily count of views, with their origin (search engine, social network, direct visit), and of booking steps (service chosen, time slot chosen), without cookies, identifiers or stored IP addresses. In the application, PostHog analytics only runs after your explicit consent, which you can withdraw at any time from the application's Privacy page. The only technical storage (sign-in session, display preferences) is necessary for operation.
Security
Traffic is encrypted (TLS), data access is limited to what the service requires, and booking links use private per-client tokens. GetAllDone stores no banking data.
Updates
This policy may evolve with the service; it was last revised on 10 October 2026. Notable changes are announced to professionals by email.