Privacy policy

Last updated 30 September 2026 · Slovenská verzia

1. Who is responsible

The controller of your data is MONTBERG s. r. o., Oravská 3237/15A, 903 01 Senec, Slovak Republic, company ID (IČO) 57 659 729, registered in the Commercial Register of the Municipal Court Bratislava III, section Sro, file no. 200096/B. Contact for anything in this policy: hello@bergbooking.com. We have no data protection officer; the law does not require one for a company of our size and activity.

This policy covers bergbooking (formerly booq): the iOS app, the web app at app.bergbooking.com and the website bergbooking.com. Businesses you book with receive some of your data and are separate controllers for it (section 5). If the English and Slovak versions differ, the Slovak version prevails.

2. What we collect and why

• Account. Your email address (used to sign you in and to reach you about your account), first name (required), and optionally a last name, gender (the default is "prefer not to say"), date of birth, profile photo, a short bio, skill levels per activity, and a @bergbooking tag handle we create from your first name and you can change once. We also record when you accepted the terms and when you joined. Other signed-in users see your name, tag, gender, age (computed from your date of birth; the date itself is never shown), photo, bio, skill levels and the month you joined. Your email is never shown to other users or to businesses.
• Sign-in providers. You sign in with a one-time email code, with Sign in with Apple or with Google. From Apple or Google we receive an account identifier, your email and, on first sign-in, your name to prefill the form. We access nothing else in your Apple or Google account. Apple's "hide my email" relay addresses work.
• Bookings. The reservations you create or join: time, place, zone, the number of players, any note you write, add-ons, whether you use a benefit card and how many, payment status, and a no-show flag the business may set. Also your waitlist entries, reminder settings, favorites, followed places, open-game requests and invitations.
• Messages. Chats are stored so they can be delivered and re-read, and are visible only to the members of each conversation. They are not end-to-end encrypted. "Delete" in a chat only hides it for you; individual messages cannot be edited or deleted. Your messages are removed when you delete your account.
• Friends, run clubs, reviews. Friend requests and friendships; run clubs you create or join; reviews you leave after a finished booking. A review shows your full name and photo to signed-in users and is visible, without your name, to people browsing without an account. You can edit a review; it is deleted with your account or with the business's listing.
• Card payments for bookings. Where a business accepts cards, payment is processed by Stripe on the business's own Stripe account. We send Stripe the amount, a description (place, zone, time), a booking reference and your email address for the receipt. Apple Pay on iPhone is handled by Apple and Stripe on your device. We store the amount, bergbooking's fee, payment and refund identifiers and their times. We never see or store card numbers.
• Bank-transfer payments. If you pay a business by transfer, the app builds a QR code and payment links on your device from the business's bank details, a variable symbol and a note containing your @bergbooking tag, the date and the zone. We store only the variable symbol and the paid status you and the business set.
• Notifications. A device token (Apple Push Notification service), a browser push subscription, or Live Activity tokens, used only to deliver the notifications you enable. The content of a notification, for example a sender's name and the first 140 characters of a message, passes through Apple or your browser's push service. A weekly "free weekend" reminder naming a place you follow or booked before is on by default; switch it off in your Account settings.
• Location. Sorting places by distance happens on your device. Your coordinates are not sent to or stored on our servers. One exception: when you create a business or run club, the map pin starts at your current location, and the point you confirm is saved as that place's public location.
• Weather. For weather warnings we send the place's coordinates, rounded to about one kilometer, and the booking hour to Apple Weather. Nothing about you is sent.
• Website updates list. If you enter your email in the "Keep me posted" form on bergbooking.com, we store that address and where you signed up, nothing else, to send occasional news about bergbooking.
• Business managers. If you manage a business, the details you publish (name, address, phone, photos, prices, hours, cancellation policy and, if you enable transfers, IBAN or Revolut tag) are public by design and visible to anyone browsing, including people without an account. For plans and card payouts we pass your email, the business name, billing address, IČO and VAT number to Stripe, and we store Stripe customer, subscription and account identifiers and your plan status.
• Support and moderation. Our administrator can look up accounts by name, email or tag, see account flags, booking counts and all bookings including notes, send a message to a user, reset abusive profile content, block an email address from registering again, and delete an account. The administrator cannot read chats through the app.
• Technical. Server logs of our functions contain identifiers and error details, not emails or message text, and are kept for a few days. We use no analytics, crash-reporting or advertising software and set no cookies of our own.

3. Legal bases

• Contract (GDPR Art. 6(1)(b)): your account, bookings, messages, payments and the notifications you enable.
• Consent (Art. 6(1)(a)): optional profile details, the updates list, push permission. Withdraw at any time by removing the detail or turning the setting off.
• Legal obligation (Art. 6(1)(c)): invoices and accounting records; tax reporting about businesses where the law requires it.
• Legitimate interest (Art. 6(1)(f)): keeping the service secure and fair (payment holds, rate limits, moderation) and the weekend reminder to existing users, which you can switch off.

To hold an account you must give us an email address and a first name; everything else is optional, and you can use bergbooking without it. We make no automated decisions with legal or similar effect and do no profiling for advertising. bergbooking is for people aged 16 and over; under 16 you may use it only with a parent's or guardian's consent. We do not verify age technically.

4. Who processes data for us

• Supabase — database, sign-in and file storage, hosted in the EU (Frankfurt, eu-central-1); our server functions run on Supabase's edge network in the region closest to the caller and store nothing themselves.
• Cloudflare — hosting and delivery of the web app and this website.
• Resend — email delivery: sign-in codes, plan and billing emails, invoices, and booking exports to businesses.
• Stripe (Stripe Payments Europe Ltd. and Stripe Technology Europe Ltd., Ireland) — business subscriptions and card payments for bookings. Stripe also processes data for its own purposes as an independent controller under stripe.com/privacy.
• Apple — push notifications and Live Activities, Sign in with Apple, Apple Pay, Apple Weather (WeatherKit) and Apple Maps.
• Google — Sign in with Google.
• Browser push services (Google, Mozilla, Apple, Microsoft) — delivery of web push notifications you enable.

Some of these providers are in the United States. We rely on the EU-US Data Privacy Framework where the provider is certified and on the EU Standard Contractual Clauses otherwise; copies are available on request. We do not sell your data and show no advertising.

5. Who else receives your data

• The business you book with sees your name, tag, photo, bio, gender and age, the booking details, your note and the payment status. Businesses on the Pro plan can receive a daily, weekly or monthly export of their bookings by email, containing the name of who booked and the note. Each business is a separate controller and may use this only to run your booking, in line with data-protection law.
• Other users see your profile card, the games and clubs you take part in, and the chats you are in.
• Authorities when the law requires it, including tax reporting about businesses under the DAC7 rules.

6. How long we keep it

• Account data: for as long as you have an account. Deleting it (Account → Delete Account, in the app or on the web) permanently removes your profile and photo, skill levels, friendships, chat memberships and your messages, reviews, notification tokens and the run clubs you created. Bookings a business relies on for its records stay, without your name: time, note, payment status and payment identifiers are kept.
• Messages: for as long as the conversation and your account exist.
• Invoices and payment records: 10 years after the end of the year they relate to, as Slovak accounting and VAT law require. Stripe keeps its own records under its policy.
• Updates list: until you ask to be removed. Slot waitlist entries: deleted once the slot has passed.
• Technical logs: a few days.

7. Your rights

Under the GDPR you can ask for access to what we hold about you, have it corrected or deleted, restrict or object to processing, receive a copy in a portable format, and withdraw consent at any time. Editing your profile and deleting your account work directly in the app; for everything else, one email to hello@bergbooking.com does it and we answer within one month; for complex requests the law allows two more months, and we would tell you. You can also complain to the Slovak data protection authority: Úrad na ochranu osobných údajov SR, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.

8. Storage in your browser

The website stores your theme and your player-or-business tab choice in your browser. The web app stores your sign-in session, your language and dismissed banners. This storage is strictly necessary to provide what you asked for and needs no consent under §109(8) of Act No. 452/2021 Coll. We use no analytics or advertising cookies. Stripe's checkout and billing pages set Stripe's own cookies under Stripe's policy.

9. Security

Data travels encrypted (TLS). Our database and files are stored in the EU; some processors listed in section 4 handle data in the USA under the safeguards described there. Access rules in the database limit every account to its own data and to what it is entitled to see. You have no password with us: you sign in with one-time codes or your Apple or Google account, and sessions are stored in your iPhone's secure keychain or, on the web, in your browser's storage. Our administration tools require a second factor and biometric confirmation.

10. Changes

If this policy changes in a way that matters, we tell you by email or in the app before the change takes effect. The date at the top shows the current version.