Privacy policy

Resaly is an online booking tool for beauty professionals, published by [Raison sociale] (“Resaly”, “we”). This policy explains which personal data we process, why, for how long, and how to use your rights.

We process data in two different roles:

for the professionals who use Resaly and their team members, we are the controller;
for the customers who book with a business, the business is the controller: we are its processor and process this data on its behalf, following its instructions (see the data processing agreement).

Professionals and their teams

We process:

your account: email address, password (stored hashed, never in plain text), language, and the version of the terms you accepted;
your business: name, category, address, phone, email, description, logo and cover photo, booking rules;
your team: names, photos, hours, time off, and the logins of invited members (their email address);
technical data: IP address, login times, error logs.

We use it to provide the service (legal basis: performing the contract, that is our terms of service), to send you the emails the service needs (address confirmation, new password, bookings), and to keep the service secure (legal basis: our legitimate interest in preventing abuse). We don’t sell it and don’t use it for advertising.

We keep it as long as your account exists. When you delete your account (in Settings), your business, your team and their logins, your services, your customers and their bookings are erased at once; backup copies are overwritten within 7 days. Technical logs are kept for 30 days at most.

Customers of businesses

When you book with a business on its Resaly page, or it records your appointment itself, the business is responsible for your data. We store and process it on the business’s behalf, only to provide it with the service.

The data concerned is:

your first name, last name, email address and phone;
your appointments: date, service, price, team member, status, and any message you left;
the private notes the business takes about you;
the language you booked in;
technical data: IP address and a bot check, to protect the booking form from abuse.

It is used to manage your appointment: confirm it, remind you the day before, let you cancel or move it with the link you get by email, and let the business see your history. The legal basis is the contract you make with the business when you book. No account is needed, and you get no marketing emails from us.

The business decides how long it keeps your data: it is erased when the business removes you from its customer list or deletes its account.

To see, correct or erase your data, contact the business: its details are on its booking page. You can also write to us at contact@resaly.app: we will pass your request on to the business.

Sub-processors

We use the following providers, which process personal data on our behalf and are bound by contract to protect it:

Supabase Pte. Ltd.: database, logins and files. Location: European Union (Paris, France). Safeguards: data hosted in the European Union; standard contractual clauses for remote support.
Railway Corporation: website hosting and execution, audience measurement (Umami, which we host ourselves). Location: European Union (Amsterdam, Netherlands). Safeguards: data hosted in the European Union; standard contractual clauses for access from the United States.
Resend (Plus Five Five, Inc.): sending emails. Location: European Union (Ireland) and United States. Safeguards: EU–US Data Privacy Framework; standard contractual clauses.
Sentry (Functional Software, Inc.): monitoring the website’s technical errors. Location: European Union (Frankfurt, Germany) and United States. Safeguards: EU–US Data Privacy Framework; standard contractual clauses.
Cloudflare, Inc.: protecting the booking form from bots (Turnstile). Location: Cloudflare’s global network. Safeguards: EU–US Data Privacy Framework; standard contractual clauses.

The website, the database and files are hosted in the European Union. When a provider may access data from a country outside the European Union, the transfer is covered by an adequacy decision (including the EU–US Data Privacy Framework) or by the European Commission’s standard contractual clauses.

Audience measurement

To know which pages are visited, we count visits with Umami, an audience measurement tool we host ourselves in the European Union: these statistics go to no other provider. Umami sets no cookie, doesn’t keep the IP address and doesn’t follow visitors from one site to another. It records the page viewed (without booking management links, ids or the address’s parameters), the referring site, the type of device, the browser, the language and an approximate location (country, city) derived from the IP address. Legal basis: our legitimate interest in improving the service. These statistics are kept for 25 months at most.

Cookies

Resaly only uses strictly necessary cookies: the session of logged-in professionals, and the language choice. The bot check on the booking form (Cloudflare Turnstile) is only used for security, and audience measurement uses no cookies. We use no advertising or tracking cookies, so no consent is asked for.

Security

Connections are encrypted (HTTPS), passwords are never stored in plain text, and the database keeps each business’s data apart: a professional can only reach their own business’s data, and a team member only their own agenda.

Your rights

You have the right to access, correct, erase and port your data, and to restrict or object to its processing.

Professionals: you can change your details, download all your business’s data and delete your account from Settings.
Team members: the business’s owner can remove your access, which deletes your login.
Customers: contact the business (see above).

For any question or request, write to us at contact@resaly.app. If you think your rights are not respected, you can complain to the CNIL, the French data protection authority (www.cnil.fr).

Changes

We may change this policy. If we make an important change, we let professionals know by email. The date of the last update is at the bottom of this page.