Privacy Policy

This policy explains how ZN Consulting, the operator of JustBraid (the “Platform”), processes personal data under Regulation (EU) 2016/679 (the GDPR) and applicable French data-protection law.

The Platform includes justbraid.com, professionals’ public pages, the online administration area, and the JustBraid mobile app for iOS and Android (package identifier com.justbraid.admin). The same account and business data are used across the website and app unless stated otherwise.

JustBraid is a data controller for professionals’ account data, including account management, billing, security and service improvement.

JustBraid is a data processor for end-client data entered by a professional for bookings, such as contact and appointment details. The professional determines the purposes of that processing, must inform their clients, and is responsible for any consent required. JustBraid processes that data only to provide the service and on the professional’s instructions.

For account holders:

• identity and contact data, including name, email address and phone number;
• business data, including trading name, profile, services, photographs, payment links and address;
• authentication data, including the account identifier, email address, linked identity and provider used (email, Google or Apple when offered), plus session data managed by Supabase Auth;
• subscription data, including an internal account identifier, store and product, purchase receipt or token, transaction identifiers, subscription status, and purchase, renewal and expiry dates;
• technical data, including logs, IP address and browser type, for security and diagnostics;
• a push-notification token and the device operating system when the mobile app is installed.

For end clients whose data is entered by a professional:

• name, email address and phone number;
• booking details, including the chosen service, date, time, amount and optional notes.

The mobile app is the professional’s administration area on iOS and Android. It accesses the same business data as the web version. Processing specific to the device, in-app purchases and notifications is described below.

Mobile subscriptions:

When you view or purchase a Pro subscription, the app uses RevenueCat to communicate with the App Store or Google Play. RevenueCat receives the internal identifier for your JustBraid account (not your email address as its user identifier), technical device and platform information, and purchase data needed to provide the subscription: product and store, Apple receipt or Google purchase token, transactions, subscription status and dates. This is used to display available offers, validate the purchase, prevent fraud, restore access across your devices and keep Pro access current. Apple or Google processes your full payment-card details; those details are not sent to JustBraid or RevenueCat.

Push notifications:

If you allow notifications, the app stores a technical token for that app installation, associated with your account, and the device operating system. The token is used only for alerts about salon activity, such as new or cancelled bookings. It is not used for advertising or tracking. It is removed from our servers on sign-out when the app can still identify that installation. All tokens associated with the account are removed when the account is deleted. You can also disable notifications in device settings or in the app.

Camera and photo library:

The app requests access only so you can add service, profile and banner photographs. A photograph is uploaded only when you select or take it for that purpose. The app does not browse the library or read other images in the background. You can refuse or withdraw access in device settings; only photo upload will stop working.

Data kept on the device:

Your session is stored in secure operating-system storage, such as Keychain on iOS or Keystore on Android. It is cleared when you sign out. After uninstalling or reinstalling the app, whether secure storage remains available depends on the operating system, device and its settings.

No advertising tracking:

The mobile app has no audience-measurement SDK, advertising network or cross-app advertising tracker. No data is sold to advertisers or data brokers. RevenueCat is used for subscription functionality, not for advertising or cross-app tracking.

JustBraid offers Google sign-in and may offer Sign in with Apple depending on the app version and platform. If you choose one of these methods, the provider authenticates you and sends Supabase Auth the information you authorised: a provider-specific identifier, your email address (or an Apple private relay address), and your name and basic profile information when shared. Apple provides a name only on the first authorisation and only if you choose to share it. JustBraid never receives your Google or Apple password. The information is used to create or find your account, secure sign-in and avoid duplicate accounts.

• Providing the service, including account creation, bookings and administration: performance of the contract.
• Email, Google or Apple authentication: performance of the contract and account security.
• Subscription and billing management: performance of the contract and legal accounting obligations.
• Security, fraud prevention and technical monitoring: legitimate interests.
• Service communications: legitimate interests; marketing requires consent where applicable.
• Mobile push notifications: consent given through the device permission and withdrawable in device settings.

We do not sell personal data. It is available only to authorised staff of ZN Consulting and the technical providers needed to operate the service:

• Supabase, Inc. — EU-hosted database and authentication infrastructure in Ireland;
• RevenueCat, Inc. — subscription offers, validation of Apple receipts and Google purchase tokens, and synchronisation of subscription status and Pro access. See RevenueCat’s Privacy Policy;
• Apple Inc. and Google LLC — purchases, renewals, cancellations and refunds in their respective stores and, when you choose their sign-in service, the authorised identity sent to Supabase Auth;
• Vercel Inc. — hosting and delivery of the web application;
• Sentry (Functional Software, Inc.) — web-only error monitoring using incident context and technical information, with data processed in Germany;
• Expo (650 Industries, Inc.) — mobile push delivery using the notification token and message content.

Processors are governed by data-processing terms that address Article 28 of the GDPR. Where data is transferred outside the European Union, appropriate safeguards such as the European Commission’s Standard Contractual Clauses are used where required.

• Professional account data: while the contract remains active, then up to three years after the last contact for marketing purposes.
• Billing records: ten years where required by accounting law.
• Subscription and transaction data processed by Apple, Google and RevenueCat: under their retention rules, applicable legal duties, and for as long as needed to validate, restore and support purchases.
• End-client data: on behalf of the professional until they instruct us to delete it or close the account.
• Technical logs: no more than twelve months.
• Push tokens: while needed for the service, until removal during a sign-out where the installation can be identified, disabling notifications in the app, or account deletion.

Under the GDPR, you may have the right to:

• access, correct or erase personal data;
• restrict or object to processing;
• receive portable data;
• give instructions about data after death where French law applies.

Contact contact@justbraid.com to exercise these rights. If you are an end client, contact the professional with whom you booked first. You may also complain to the French data-protection authority, the CNIL, at cnil.fr.

Account deletion: professionals can delete their account and associated data in the mobile app under Settings → Account, or request deletion at contact@justbraid.com. Details of deleted and legally retained data are provided on the account-deletion page. Deleting the JustBraid account does not automatically cancel an App Store or Google Play subscription; it must be cancelled separately in the relevant store account.

ZN Consulting uses appropriate technical and organisational safeguards, including HTTPS, separation of professional accounts, access controls and logging. No internet transmission can be guaranteed completely secure, but we apply enhanced reasonable measures.

The Platform uses only cookies needed for operation. See our cookie policy for more information.