Terms of use and data processing agreement
These texts govern the host's use of SynCal, and ZRS's processing of the host's guests' data on the host's behalf. They are accepted by a checkbox in the account creation or access request form.
Version of 12 October 2026
Terms of use
1. Publisher
ZRS-Holding Sàrl, Le Chenit (Vaud), Switzerland, contact@zrs-holding.com ("ZRS").
2. Purpose
These terms govern the use of SynCal, the appointment booking page published by ZRS (app.syncal.ch), by the host, meaning the person or company that opens an account to offer appointments. They apply as soon as the host ticks the acceptance box in the account creation or access request form.
3. Access to the service
The host creates their account themselves, with their email and a password, or signs in with their Infomaniak account (option). An access request remains possible to be supported: ZRS reviews it and may refuse it.
4. Plans and prices
Free: CHF 0, for one person, one appointment type, one connected calendar and 30 confirmed bookings per month, with the "with SynCal" mention on the page. Pro: CHF 12 excl. tax per user per month, or CHF 120 excl. tax per year. Team: CHF 19 excl. tax per user per month, or CHF 190 excl. tax per year, minimum 2 users. Two months free on the annual plan. 14-day Pro trial with no payment card: it starts when the account is created, then automatically returns to the Free plan, with no charge.
5. Moving to Pro or Team
There is no online payment. The host requests the move from their space, and ZRS activates the plan manually.
6. Invoicing
Invoices are payable within 30 days net of receipt. Failing that, late-payment interest of 5% per year may be applied.
7. Termination
Monthly plans: termination with 30 days' notice before the next due date. Annual plans: termination takes effect at the end of the subscribed period, subject to 60 days' notice, with no pro rata refund. The Free plan may be abandoned at any time; account deletion is requested at contact@zrs-holding.com.
8. Host's obligations
The host uses SynCal in accordance with Swiss law. The host is responsible for the content they enter (appointment types, questions, welcome message) and informs their guests about the processing of their data, for which the host is responsible (see the data processing agreement below).
9. Availability
SynCal is provided "as is", within the limits of applicable law. ZRS guarantees no numerical availability.
10. Intellectual property
All code, trademarks, logos and documentation are the exclusive property of ZRS-Holding Sàrl. No assignment or licence is granted beyond the strict use of the service.
11. Liability
ZRS's liability is limited to the total amount invoiced to the host over the last twelve months. ZRS is not liable for indirect damages, data loss or service interruptions, except in case of gross negligence or wilful misconduct.
12. Host's data
The host keeps ownership of their data and of the guests' data they process. It can be exported through the provided functions (iCal and CSV export, depending on the plan).
13. Governing law and jurisdiction
Swiss law. Any dispute falls under the exclusive jurisdiction of the Cantonal Court of Vaud.
14. Language and version
French is the reference language; in case of discrepancy between translations, the French version prevails. The accepted version and the date of acceptance are recorded.
Data processing agreement (art. 9 nFADP)
This agreement supplements the terms above. It is concluded between the host, the controller, and ZRS-Holding Sàrl, the processor, within the meaning of article 9 of the Swiss Federal Act on Data Protection (nFADP).
1. Roles
The host is the controller of their guests' personal data. ZRS is the processor: it hosts this data and processes it on the host's behalf, with SynCal.
2. Purpose, scope and duration
Offer slots, record and confirm appointments, send reminders and cancellations. The agreement lasts as long as the host uses SynCal.
3. Data and data subjects
Guests: name, email address, phone, company, message, answers to the host's questions, page language, chosen slot, video call link, cancellation token, creation, cancellation and attendance confirmation dates. Host: Name and email address of the account, language, organisation name, page address, title, colour, logo and welcome message if set; accepted terms version with date and time; account creation and email confirmation dates. Two sign-in modes: email and password (the password is never stored, only a hash is), or the Infomaniak account (OIDC: SynCal never sees the Infomaniak password). Access to their calendar (CalDAV app password or private iCal address) is stored encrypted.
4. Instructions
ZRS processes the data only on the host's instructions, that is, to operate SynCal as described here. It only carries out processing that the host would be entitled to carry out itself. No resale, no advertising.
5. Confidentiality
ZRS keeps the data confidential and gives access only to people who need it to operate SynCal.
6. Security
ZRS takes the technical and organisational measures described in the annex to prevent any data security breach (art. 8 nFADP).
7. Sub-processor
The host authorises Infomaniak Network SA, Geneva, Switzerland, to act as ZRS's sub-processor: hosting, email, kMeet video calls, calendar and backups (Swiss Backup). ZRS adds no other without the host's prior authorisation (art. 9 para. 3 nFADP).
8. Disclosure abroad
None by default. If the host chooses to have a Google or Microsoft calendar read through an iCal address, that is their choice and responsibility: Google and Microsoft are not ZRS sub-processors.
9. Data subjects' rights
ZRS helps the host answer access, correction and deletion requests. A person who writes to contact@zrs-holding.com receives a reply within thirty days; they may also contact the host.
10. Data security breach
ZRS notifies the host of any data security breach no later than 72 hours after becoming aware of it (art. 24 para. 3 nFADP: as soon as possible). The contact person at ZRS can be reached at contact@zrs-holding.com. Notification to the Federal Data Protection and Information Commissioner is the host's responsibility, where the breach is likely to result in a high risk for the persons concerned (art. 24 para. 1 nFADP).
11. Retention and deletion
Appointments and guest data: deleted automatically twelve months after the end of the appointment, whatever its status. Refused access requests: deleted twelve months after the refusal. At the end of the contract, the host may request deletion of their data by writing to contact@zrs-holding.com, and export their appointments beforehand (iCal and CSV export, depending on the plan). A host can delete their account themselves (Account, at the bottom of the page): this erases their types, appointments, guests' data, tokens, connected calendar and logo; upcoming guests are notified.
12. Information and checks
On written request, ZRS provides the host with the information needed to verify compliance with this agreement.
13. Governing law and jurisdiction
Swiss law. Any dispute falls under the exclusive jurisdiction of the Cantonal Court of Vaud.
Annex: security measures (as of 12 October 2026)
Measures actually in place, as recorded by the SynCal team. Known limits are stated.
Hosting
Server in Geneva, at Infomaniak. This server also hosts other ZRS products.
Encryption in transit
Everything goes over HTTPS; HTTP is redirected; HSTS of one year; the server accepts only TLS 1.2 and 1.3 (configuration).
Encryption at rest
Calendar credentials (CalDAV app password, private iCal address) and guests' data (name, email, phone, company, message, answers to questions, and the waiting-list name and email) are encrypted by the application (AES-256-GCM), the key being kept outside the database, in the server configuration, and backed up encrypted off site. This protects against reading a copy of the database; it does not protect against someone who controls the application server. Hosts' names and email addresses and appointment dates remain readable. Disk encryption has not been recorded.
Access control
PostgreSQL database reachable only locally, with a dedicated application role. Server access by SSH key only (password disabled), with one administration account. SSH logins are logged; database reads are not. Local firewall active: inbound denied by default, only SSH and the web (ports 80 and 443) are open.
Host authentication
Sign-in by email and password, or by the Infomaniak account (OIDC: SynCal never sees the Infomaniak password). For an email and password account: at least 12 characters, trivial passwords refused, password never stored (scrypt hash with a random salt per password); address confirmed by a single-use link valid for 24 hours; forgotten password by a single-use link valid for 1 hour; 15-minute lock after 5 failures in a row and attempt limits per IP address; identical answers whether the address exists or not. Two-factor authentication is not available for these accounts today; for Infomaniak sign-in, it depends on the host's Infomaniak account.
Separation between hosts
Every request from the host space is filtered on the signed-in host. This is covered by automated tests and was reviewed in ZRS's internal security audit of 16 September 2026. There has been no external audit.
Calendar access and minimisation
Calendar reading: free or busy periods only, with no title, participant or detail. The guest's time zone and IP address are not stored.
Cookies
No cookie is set for guests, no analytics tool. A technical session cookie is set when a host signs in.
Backups
Daily backup of the database at Infomaniak (Swiss Backup), with a daily check and alert. A restore was tested on 12 September 2026.
Logs
Errors and email sending (code and domain) without message content; server access logs kept for 14 days.
Automatic deletion
A daily run deletes data that has reached the end of its retention period, with a log containing only numbers.