Privacy
Last updated: 28 July 2026
This instance of Nexo Agenda is open source and self-hosted. We collect the minimum a booking needs, and nothing else. There are no tracking cookies, no third-party analytics and nothing is sent to advertising networks.
Two different relationships
Two kinds of people meet here: the business, which opens an account to take bookings, and the person who books an appointment on that business's page without creating any account. Whoever runs this instance processes both sets of data so the service works. The business, in turn, is the one answerable to its own client: it decides what happens with those details after the booking. If you booked an appointment and want your data corrected or deleted, you can ask the business or whoever runs this instance — both can do it.
What we store about the business account
Name, email and an encrypted (hashed) version of the password. For the business we also store what it publishes on its page: name, category, city, address, WhatsApp number, description, colour, logo and timezone, along with its services and the names of its team members. If you sign in with Nexo ID, we also store the identifier that service gives us to recognise you.
What we store about the person booking
The name you type when booking, an email or a phone number so we can confirm the appointment and reach you, the note you leave if you want to, and the language you booked in — so we write to you in that one and not another. That is what makes up the booking: service, professional, day and time. We do not create an account and never ask you for a password. Those details are visible to the business you booked with — it is the one that needs to know who is coming — and appear in its calendar, its client list and the CSV files it downloads.
The link to manage your appointment
When you book, you get a link of your own to view, cancel or reschedule the appointment without an account. That link is the key: the database only stores its fingerprint (a hash), never the link itself, so even someone with access to the database could not rebuild it. Anyone holding the link can manage that appointment, so it is best not to share it.
Waiting list and reminders
If you join the waiting list for a day, we store your name and email to let you know if a slot frees up. The appointment reminder (24 hours before) uses the same contact detail you left when booking. None of this is used to send you advertising.
Reviews
If your appointment was marked as attended, you can leave a rating and a comment. They are published on the business page next to the name you booked with, and the business can hide them.
Cookieless metrics
We count how many distinct people viewed a business page using a fingerprint computed with the current date and then discarded: we do not store your IP or your browser, and today's fingerprint cannot be matched against tomorrow's. We do not know who you are and cannot follow you across sites.
Ecosystem counter
If this instance turns it on, the business dashboard pages send an anonymous visit (which tool and which path, no personal data) to the Nexo hub. It is never sent from a business's public page, and it honours the browser's "Do Not Track" signal.
Cookies
Only the ones the site needs to work: the session cookie (to keep a signed-in business identified) and the ones remembering the language and the light or dark theme you chose. None of them is for advertising or tracking.
Confirmations, reminders, cancellation or reschedule notices and account emails are sent through an external email provider, which necessarily processes the destination address and the message content in order to deliver it.
A professional's calendar subscription
Each professional can subscribe their agenda to an external calendar through a secret link. That calendar includes the name of the person who booked and the service, so the link should not be shared; the business can regenerate it at any time and the previous one stops working.
Contact form
If you write to us through the contact form we store the message, the type of enquiry, the page you wrote from and your email if you leave one, so we can reply.
How long we keep it
Appointments, reviews and statistics are kept for as long as the business keeps its account: they are its history. Nothing is deleted automatically by age. When an account is deleted, its business, services, team, appointments, waiting list, reviews and metrics are deleted along with it.
Your rights
You can ask for access to your data, its correction or its deletion. If you have an account, write to whoever runs this instance (the contact is below and on the help page): today an account is deleted on request, there is no button for it. If you booked an appointment, you can cancel it from your link and ask the business to remove your details from its list.
Other instances
Nexo Agenda can be installed on any server. Each installation is independent and responsible for its own data: this policy covers this instance only.
Who runs this instance
This instance is operated by Alvaro Carrizales. For anything about your data you can write to contact@alvarocdev.com.
Privacy · Terms · Help center