This Policy covers two different groups of people whose data we handle. Please read the section that applies to you:
For personal data of Subscribers, the Data Controller is:
We have not appointed a Data Protection Officer. Whether one is required for the final operating model remains under assessment. You can contact us at the address above.
| Category | Examples | Purpose |
|---|---|---|
| Identity & account | Business name, your name, email, hashed password | Create and secure your account, log you in |
| Contact | Owner WhatsApp number, notification email | Send you booking notifications and service messages |
| Billing | Stripe customer ID, subscription status, invoices | Process subscription payments; provide receipts |
| Business content | AI context, FAQ, business hours, brand colour, welcome message, allowed domains, widget settings | Configure the widget on your website |
| Usage | Message counts, appointment counts, login timestamps, last-activity dates | Enforce your plan limits and improve the Service |
| Technical | IP address of dashboard access, browser type | Security, fraud prevention, debugging |
We do not ask for identity documents, health or other special-category details, biometric data or payment-card numbers in the widget; payment-card entry is handled by Stripe. Free-form chat can nevertheless contain sensitive information a visitor chooses to type. Please do not submit medical or other sensitive details through the chat.
When a website visitor chats with your widget, the following data is captured on your behalf:
| Category | Examples |
|---|---|
| Chat content | Every message the visitor sends and every reply the assistant produces |
| Booking details | Name, phone number, requested service, requested time (only if the visitor provides them for a booking) |
| Session | A pseudonymous session id stored in the visitor's browser localStorage after chat starts; used to keep the conversation coherent |
| Technical | IP address — used in a short-lived abuse-prevention counter (up to 1 hour for chat), not written to the conversation record. Edge/security logs may follow separate provider retention. A chat-start notice step is required before the first message; new chats do not record that step as GDPR consent. |
Before sending a first chat message, the visitor sees a short privacy notice and chooses whether to start the chat. The widget can load configuration and process technical request metadata before that choice; a previously saved chat session is read only when the visitor starts chat. Starting chat is not presented as GDPR consent. A new conversation and message are created only after the first message is sent.
For Visitors, the Data Controller is the business that embedded the widget. Nelyma acts as that business's Data Processor. Visitors should contact the business first if they wish to exercise their GDPR rights; we can only act on the business's documented instructions.
| Processing | Legal basis |
|---|---|
| Providing the Service to Subscribers | Contract (Art. 6(1)(b)) — necessary to perform our Terms with you |
| Sending billing notices, service updates | Contract (Art. 6(1)(b)) |
| Fraud prevention, security logging | Legitimate interest (Art. 6(1)(f)) — protecting the Service from abuse |
| Processing Visitor chat data | The business operating the widget must identify and explain its lawful basis for ordinary chat and any separate booking step in its visitor notice. The widget's Start chat action is not itself GDPR consent. |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) — e.g. tax and accounting |
The following providers support the Service or are listed for a future inactive channel. Their legal roles vary by activity: Stripe and Cloudflare may also process some data for their own purposes. Contractual data-protection arrangements are not all verified for the current account; Railway DPA execution remains unconfirmed before commercial launch.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Railway Corp. | Hosting the application and the database | Service data, logs and backups | Production app/database: Amsterdam, Netherlands (EU); backup/support geography not fully verified |
| Anthropic PBC | Generate assistant replies | Business context + the recent chat turns | US workspace; inference is not configured as EU-only |
| Brevo (Sendinblue SAS) | Booking alerts, email verification, password resets | Recipient email + message content | France (EU) |
| Stripe Payments Europe Ltd. | Subscription payments; separate regulatory and security purposes may apply | Subscriber name, email, card (entered on Stripe) | Irish entity; international processing may also occur |
| Cloudflare | DNS, TLS, caching, bot protection | Request metadata (such as IP and user agent), security and analytics records | Global edge (EU entity: Cloudflare Germany GmbH) |
| Twilio Inc. | WhatsApp messaging — not currently in use | Phone number + message, only if the WhatsApp channel is enabled | USA (SCCs) |
Our production application and primary database run in the EU (Amsterdam). This does not mean all provider processing, logs or backup copies remain in the EEA.
We do not sell or rent personal data to third parties. We do not use it for cross-context advertising.
The primary application and database are hosted in Amsterdam, Netherlands. AI requests, global edge processing, provider support and some onward processing can involve countries outside the EEA; EU hosting is not an EU-only processing guarantee.
Current international processing is not limited to a fixed number of transfers. Relevant providers include:
Twilio's WhatsApp channel is inactive and is not counted as a current visitor-chat transfer. Applicable contractual transfer safeguards and the launch transfer assessment require final review; this summary does not claim that every transfer has already been approved.
Under Articles 15-22 GDPR you have the right to:
We aim to respond to all valid requests within one month. If your request is complex or high-volume we may extend by two further months and will tell you why.
Exercising your rights is free. Where a request is manifestly unfounded or excessive we may either charge a reasonable fee or refuse — we would explain and give you a chance to appeal.
The widget code does not set an analytics or advertising cookie. Browser-storage and any security technology used by the business website or our edge provider require a separate ePrivacy assessment. Do not assume that a cookie or storage banner is never required.
Cookies set on our own website:
_cfuvid) — set by Cloudflare, our security layer, to tell humans from bots. Around 30 minutes. We cannot read it and it is not used to profile you.Our site also uses localStorage for one preference:
theme — remembers whether you chose the light or dark appearance. Without it the site simply follows your device setting.The chat widget code on our customers' websites does not set cookies. It uses localStorage for chat continuity after a visitor chooses to start chat:
sa_widget:<id>:session — a pseudonymous session id and local expiry so the assistant can continue the requested conversation. The key is read when the visitor starts chat, and its local lifetime is capped at 90 days.The widget also removes the older sa_widget:<id>:consent flag when a visitor starts or deletes chat; it is not used as proof of GDPR consent. The session key is cleared only after the deletion endpoint confirms success. Whether other technology on the business website or Cloudflare needs a banner or prior storage consent must be assessed separately.
When you subscribe, payment happens on Stripe's own checkout pages, which set their own cookies under Stripe's privacy policy.
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and, where the risk is high, notify affected users without undue delay. Notifications will describe the nature of the breach, the categories of data affected, the likely consequences and the measures we have taken.
The Service is a B2B tool aimed at adult business owners and is not directed at children. Subscribers must be 18 or over. Teenage visitors may still contact a salon through its widget. The business must assess any age-related requirements for its chosen lawful basis; the widget does not collect a date of birth or claim to obtain parental consent.
We may update this Policy occasionally. Material changes will be announced by email to Subscribers at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.
Questions or complaints: [email protected].
You also have the right to lodge a complaint with the Data Protection Commission in Ireland, which is our lead supervisory authority under Article 55 GDPR:
If you live in another EU country, you may also lodge a complaint with your local supervisory authority.