1. Who handles your data
Zayra is a management system for beauty professionals, offered by Lorranna Bento dos Santos. This policy covers the app, the zayra.app website and the dashboard at painel.zayra.app.
2. Data we collect
From your account: name, email, phone and tax ID. If you sign in with Google or Apple, we receive from those services only your name, email and profile picture.
From your business: services, prices, opening hours, inventory, financial records and the team you register.
From your clients: the data you enter — name, contact, appointment history and, if you use the forms, intake information, which may include health data.
Technical: access logs, IP address, device type and error reports, to keep the system running and fix failures. Error reports go through automatic masking that strips tax IDs, emails, phone numbers and other personal data before they are sent.
If you join the waiting list from the website, we receive only name, phone, specialty and the form answers.
3. How we use it
To make the system work: keeping your account, your schedule, your clients and your finances; sending appointment reminders; processing your subscription; providing support when you ask for it; and meeting legal obligations. We do not use your clients' data for any other purpose, and we do not sell any data.
4. Your clients' data is yours
For your clients' information, you are the controller and we are the processor. We store and process it only to make the system work, following what you determine. You are responsible for collecting that information with your client's consent — especially the intake forms, which may contain health data.
5. Access to your Google Calendar
Connecting Google Calendar is optional and only happens if you authorise it.
We request the calendar.events permission, which grants access to events only — not to your calendar list or your account settings. We use it solely to: create the event when an appointment is booked in Zayra, move it when the appointment is rescheduled and remove it when it is cancelled.
We store the identifier of every event we create, and those are the only ones we touch — never events from another source. We do not read your calendar, do not list your other commitments and do not keep a copy of your calendar content. On the Google side we store only the access credential, on our own server and never on your device.
You can disconnect whenever you want, from the app or by removing Zayra's access in Google Account → Apps with access to your account. From then on we stop writing, and events already created stay in your calendar until you delete them.
Limited use: Zayra's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it and do not allow humans to read it, except with your express permission, for support you requested, when required by law, or for internal security operations.
6. Zayra team access for support
To solve a specific problem, our team may need to access your account. That access is time-limited, ends when the support case closes and is logged, identifying who accessed it, the date, time and duration. You can request this history at any time.
7. Who we share it with
We do not sell your data. We share it only with what the system needs to run: Google Firebase (database, authentication and hosting), Google Calendar (only if you connect it), Stripe, Apple and Google (payments — we never store your card details), Sentry (error reports, already masked) and EmailJS (sending invitations). Each one receives only what its function requires.
8. How long we keep it
For as long as your account exists. When you request deletion, we remove the data after the legal retention period for tax and financial records.
9. Your rights
You can request access, correction, portability or deletion of your data, and delete your account through the Delete my account page or by emailing contato@zayra.app. We reply within 15 days.
10. Security
Data travels encrypted and access is controlled by rules that limit each person to their own studio. No system is infallible — if an incident occurs that puts you at risk, we will tell you.
11. Changes and contact
We may update this policy; significant changes will be announced in advance. Privacy questions: contato@zayra.app.