Privacy policy

Last updated: September 2026

1. Controller

The controller for personal data processed through Zelua is FFS Conseil, established in France.

Contact: admin@ffsconseil.fr

We have not appointed a data protection officer (DPO). For any question about your data, write to that address.

Zelua is not a physical salon. Zelua is not Ipanema. Zelua is not funded by advertising.

2. What Zelua is

Zelua is software for independent beauty professionals. It is used for a calendar, clients, online booking, and payments when you use them.

  • Android application: applicationId app.zelua.app
  • Web app: app.zelua.app and staging.app.zelua.app
  • API: api.zelua.app
  • Public marketing site: zelua.app

The intended audience is professionals aged 18 and over (B2B). Zelua is not directed at children.

3. Data we process

Depending on the features you use, we may process:

  • Account: email address and name
  • Google sign-in, if you use it: the information Google sends us to create or open your session (typically email and name, sometimes a profile photo)
  • Email one-time codes used to sign in
  • Professional data you store: clients, appointments, services, notes, and any finance information you enter
  • Payments, when you use them: the data needed to record or follow a transaction. We do not store full payment card numbers.
  • Android app usage analytics via Firebase / Google Analytics (screens opened, basic device and app events — not used for advertising)
  • Product and marketing analytics via PostHog (EU): screens and features used in the app, completed actions such as bookings or charges (without your clients’ names, emails, or phone numbers), and, on this marketing site only after you accept cookies, pages viewed and buttons clicked

We do not sell your data. We do not show ads. The product is not funded by targeted advertising. This marketing site uses an analytics cookie only if you accept it in the banner. The logged-in app uses product analytics to improve Zelua, not to advertise.

4. Purposes and legal bases

We process this data to:

  • Provide Zelua (performance of the contract): account, calendar, clients, online booking, and payments when you use them
  • Authenticate you (performance of the contract / legitimate interest): email, Google OAuth if used, and email one-time codes
  • Keep the service secure and running (legitimate interest)
  • Understand how Zelua is used and improve the product (legitimate interest, logged-in app and API). On this marketing site, audience measurement runs only with your consent
  • Meet legal obligations where they apply, including minimum retention periods

5. Processors and hosting

We use the following processors:

  • Render: hosting for the API and PostgreSQL database in the Frankfurt region (European Union), and hosting of the web applications
  • Google: sign-in through Google OAuth, if you choose that option
  • Resend: transactional email, including sign-in codes
  • PostHog: product and marketing analytics, hosted on PostHog’s European Union cloud

We do not share your data with other recipients for their own marketing. Google (OAuth) and Resend (email) may process data on their own infrastructure, which can include locations outside the European Union. We use them only for the purposes described above. PostHog is configured on the EU cloud.

6. Retention

We keep your account data and the professional data you store for as long as the account exists.

After the account is closed, we keep only what the law requires (for example minimum accounting or tax periods, where they apply), then we delete or anonymise it.

Email sign-in codes are temporary and expire after a short time.

7. Your rights

Under the GDPR, you may request:

  • Access to your data
  • Rectification of inaccurate data
  • Erasure
  • Portability
  • Objection to certain processing
  • Restriction of processing, where applicable

To exercise these rights, write to admin@ffsconseil.fr.

You may also lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), the French supervisory authority: www.cnil.fr.

8. Children

Zelua is for professionals aged 18 and over. We do not target children.

9. Changes

We may update this policy. The date at the top of the page is the last update. The version in force is the one published on this page.