Privacy Policy

Last updated: 1 November 2026 · Version 2026-11-01

This Policy explains how we collect, use and protect the personal data of the businesses that use Agento, their users (owners, secretaries, staff) and visitors to agento.gr, in accordance with Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.

1. Who we are

The controller is Spyridon Kaftanis (Σπυρίδων Καυτάνης), a sole proprietor trading as HigherHighLabs, the provider of the Agento service.

• Tax ID (ΑΦΜ): 149091546
• Email: skaftanis@gmail.com

2. Scope

This Policy covers the data for which we are the controller: data of our business customers and their users (owner, secretary and staff accounts), billing data, and data of visitors to agento.gr and of anyone who contacts us.

We process the data of each business’s own customers (e.g. people who book appointments) on behalf of that business, as a processor; see section 10.

3. What data we collect

• Account data: name, email, phone number, role (owner, secretary, staff), business details (company name, store, address, profession, opening hours, services) and photos or logos you upload. Passwords are handled by Firebase Authentication; we do not know them and do not store them in readable form.
• Verification data: one-time codes we send to your email and mobile phone at sign-up. They are stored only in hashed form and are deleted automatically after a short period.
• Billing data: company name, tax ID (ΑΦΜ), tax office (ΔΟΥ), address and profession.
• Subscription and payment data: plan, billing interval, subscription status, payment and SMS-purchase history. Payments are processed by Stripe; we do not store full card numbers (we may receive only limited information, e.g. card brand and last digits).
• Acceptance of terms: the version of the Terms of Use and Privacy Policy you accepted, the time of acceptance and a truncated (partial) IP address.
• Usage and log data: actions in the app, usage counters (e.g. SMS/emails sent), technical and error logs, IP addresses and timestamps.
• Device data: device and operating-system type, app version and push-notification token (when you enable notifications).
• Anti-abuse signals: at sign-up we use Firebase App Check with Google reCAPTCHA Enterprise, which assesses browser or device signals to distinguish real users from automated abuse, as well as request limits per account, email, phone number and IP (stored as hashes).
• Communications: what you send us by email, through the contact form or when subscribing to the newsletter.
• Advertising measurement data, only with consent: agento.gr page views, clicks to the sign-up page, cookie identifiers and technical information (such as IP address, browser, URL and referring page) through the Meta Pixel.

4. Purposes & legal bases

We do not sell personal data, do not use it for third-party advertising and do not take decisions based solely on automated processing that produce legal effects concerning you.

5. Recipients & processors

Data is accessible only to those who need it. We use the following providers, which act on our behalf under data processing agreements:

For advertising measurement, if you consent, event data is shared with Meta Platforms Ireland Limited (EU / potentially USA). Collection and transmission of event data are subject to Meta's Controller Addendum, including joint controllership where applicable. Meta's subsequent processing is described in its Privacy Policy.

Data may also be disclosed to our accountant to meet our tax obligations, to public authorities where required by law, or to a successor of the business in the event of a transfer. Within each account, Users see data according to the role and permissions set by the owner.

6. Transfers outside the EEA

Some providers (e.g. Google, Stripe, OpenAI, Formspree, Meta) may process data outside the European Economic Area, in particular in the USA. These transfers rely on the EU-US Data Privacy Framework, for providers certified under it, and/or on the European Commission’s Standard Contractual Clauses, together with supplementary measures where required.

7. Retention

• Account data: for the duration of the contract. After the subscription ends the account is locked and data is not deleted automatically, so that it can be reactivated; it is deleted or anonymised within a reasonable period after your request, or once the account has stayed locked and inactive for more than 12 months (with at least 30 days' notice by email), unless the law requires longer retention.
• Invoices and accounting records: as required by Greek tax law, generally at least 5 years from the end of the relevant financial year.
• Records of acceptance of the Terms: for the duration of the contract and afterwards for as long as needed to defend possible claims.
• Verification codes and request limits: a few days.
• Technical logs: for a limited period, according to the settings of our infrastructure providers.
• Newsletter: until you unsubscribe.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, objection (in particular to processing based on legitimate interest) and to withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal. To exercise your rights, email skaftanis@gmail.com. We will reply within one month and may ask for information to verify your identity.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (ΑΠΔΠΧ, 1-3 Kifisias Ave., 115 23 Athens, www.dpa.gr).

9. Security

We apply appropriate technical and organisational measures: encryption in transit (TLS) and at rest, authentication and role-based access control, database security rules so that each business can access only its own data, storage of keys in a secrets manager, verification at sign-up and request limits. No method is completely secure; in the event of a breach we will act as required by the GDPR.

10. Data of businesses’ customers

When a business uses Agento to manage its customers (e.g. names, phone numbers, emails, appointments, notes), the business is the controller and we act as a processor, under section 11 of the Terms of Use. The same applies to data entered through a business’s online booking page or customer app.

If you are a customer of a business that uses Agento, please address your requests (e.g. access or deletion, stopping reminders) directly to that business. If you contact us, we will forward the request to the business and assist it in responding.

11. Cookies & local storage

• Cookie choice: we store your advertising-measurement acceptance or rejection locally for up to 180 days so we can respect it on subsequent visits. This storage is necessary to manage consent.
• Meta Pixel on agento.gr: loads only after you accept advertising cookies. It measures page views (PageView) and clicks to the sign-up page (TrialSignupClick). A click is not recorded as a completed registration or trial start. The Pixel may use _fbp and _fbc cookies, typically for up to 90 days, depending on Meta and browser settings. We do not enable automatic advanced matching of form fields or send customer or appointment data. This setup does not install a Pixel in app.agento.gr.
• Other website services: fonts load from Google Fonts, so your IP address is disclosed to Google when they load. The contact form and newsletter sign-up are submitted to Formspree. Google Analytics is not installed.
• Web app (app.agento.gr): uses the browser’s local storage (e.g. local storage / IndexedDB) to keep you signed in and remember your settings, which is strictly necessary for it to work. At sign-up, Google reCAPTCHA Enterprise may use cookies or similar technologies to protect against abuse.

You can reject advertising cookies without restricting your use of the website. Change or withdraw your consent using Cookie settings, available on every page. Withdrawal stops further events from this installation and attempts to delete measurement cookies accessible to the website; it does not undo data already shared with Meta. For Meta's own retention periods and your rights, see its Privacy Policy.

12. Minors

The Service is intended for businesses and professionals, not consumers. Business accounts are not intended for persons under 18. If you believe we have received a minor’s data in breach of this Policy, please contact us so that we can delete it.

13. Changes

We may update this Policy. The date and version are shown at the top of this page. For material changes we will notify you in advance by email or in the app.

14. Contact

For any question or request about your personal data: skaftanis@gmail.com · Spyridon Kaftanis (HigherHighLabs).

Version 2026-11-01 · See also the Terms of Use · Πολιτική Απορρήτου (Ελληνικά)