Privacy Policy

Who is responsible for your data

Trazza Pro is a platform for beauty businesses operated from Santiago, Chile. This policy explains what personal data we process, for what purposes, where it is stored, and what rights you have.

Trazza is the controller of user account access data (name, email, password, language, notification preferences, and security records), of the demo requests that come in from our website, and of the analytics for public pages.

The data each business uploads about its end customers and its team, and its users' roles, assigned branches, and activity records, belong to that business, which is the controller. Trazza processes them on the business's behalf, as a processor, under the Data Processing Agreement.

What data we process

User accounts: name, email, language, photo if you add one, role, assigned business and branches, notification preferences, and the notifications you receive within the platform. Your password is stored only as a hash, never in readable text.

Security: failed sign-in attempts, with the email used, the browser, and an irreversible fingerprint of the IP address, and usage-limit records. In these records we do not store the IP address in readable text.

Demo requests: your name, your business's name, your email, your WhatsApp number, your Instagram if you provide it, your message, and your language.

Data each business uploads: for its end customers, name, email, phone, ID number, date of birth, district or neighborhood, preferred contact channel, contact consent, notes, appointments, and purchases; and for its team, name, contact details, job title, schedules, absences, commissions, salaries, advances, and tips.

Files: expense receipts, photos of POS receipts, logos, and team photos for the public site.

Activity records: who made each change and when, and a record of each email sent with its recipient, its subject, and its content.

Business data: legal name, tax ID, industry, phone numbers, addresses, and social media. We do not store payment card data.

What we use data for and on what legal basis

Providing the service: creating and protecting your account, showing each user only what their role allows, and running the schedule, the cash register, sales, and reports. The basis is the performance of the contract with the business and, for the people it invites, our legitimate interest in providing them with the service the business contracted.

Protecting the platform: limiting access attempts, detecting abuse, and logging changes so they can be audited. The basis is our legitimate interest in keeping the service secure.

Responding to demo requests by WhatsApp or email. The basis is your own request, and we use that data only to contact you about Trazza.

Sending service emails, such as password recovery, invitations, and cash register notifications. On behalf of each business, also appointment confirmations and reminders to its end customers, only when the business has recorded their email and their contact consent.

WhatsApp reminders are not sent from our servers: the business sends them from its own device using a WhatsApp link, and only if the person gave their consent. Trazza has no integration with the WhatsApp API.

Measuring the use of public pages with Google Analytics, only if you accept analytics. The basis is your consent, which you can withdraw at any time.

Complying with legal obligations and responding to requests from competent authorities.

We do not sell personal data, we do not use it for third-party advertising, and we do not use it to train artificial intelligence models.

Where data is stored

The application runs on Vercel, in the São Paulo (Brazil) region, and the database is on Neon, on AWS infrastructure in São Paulo (Brazil). The files you upload are stored in Vercel's file storage, whose region we are still confirming.

Some providers we need in order to operate are outside Brazil, probably in the United States: Resend for email, OpenAI for artificial intelligence, Google for analytics and maps, and Cloudflare for DNS and bot protection. Vercel's file storage could also be outside Brazil. Using them involves international data transfers.

We limit what we send to each provider to what is necessary for its function. When a country's law requires specific safeguards for these transfers, such as contractual clauses, we work to apply them; the details for each country are in the Legal Framework by Country.

Providers that process data

We use these providers to deliver the service: Vercel (hosting, functions, and files), Neon (database), Resend (email), OpenAI (artificial intelligence, only if your plan includes it and it is turned on), Cloudflare (DNS and bot verification), Google Analytics (analytics, only with your consent), and Google Maps (map on business sites).

Those that process businesses' data on Trazza's behalf, with the purpose and location of each, are listed in the Data Processing Agreement. We use Google Analytics and Cloudflare Turnstile for our own purposes, as controller.

Fonts are served from our own servers, so your browser does not connect to Google to load them.

How long we keep data

Some data is deleted automatically: failed sign-in attempts after 30 days, usage-limit records after 7 days, artificial intelligence quota counters after 62 days, and QR links for uploading POS photos 24 hours after they expire.

Password recovery codes are valid for 15 minutes and for a single use. Invitations expire after 48 hours. Sessions last 30 days.

All other data is kept while the business's account is active and, afterward, for the time needed to comply with legal obligations or until the business requests its deletion. That deletion is done on request and includes, in a separate step, the business's activity logs and files.

A business can delete an end customer who has no sales or appointments; if they have any, it can deactivate them. Even so, the audit log keeps the name, ID number, email, and phone of the deleted record to preserve the traceability of changes.

There are currently no automatic deletion periods for audit logs, sent-email records, or demo requests. Nor is there automatic deletion of artificial intelligence usage records, verification codes, expired invitations, in-platform notices, or expired sessions. If we set periods, we will update this policy.

Your rights

Depending on the law of your country, you may request access to your data, its rectification and deletion, object to certain uses, request its portability and, where applicable, the restriction or blocking of processing. You may also withdraw your consent where you gave it, without affecting what was done before.

The names of these rights vary by country: ARCO rights in Mexico and Peru, ARCO-POL in El Salvador, habeas data in Colombia and Argentina, direitos do titular (data subject rights) in Brazil. The Legal Framework by Country summarizes each case.

If we do not respond or you are not satisfied with the response, you may file a complaint with the data protection authority of your country, where one exists.

How to exercise your rights

If you have a Trazza account or wrote to us through the demo form, write to us through the contact channel listed at the end of this page.

If you are a customer or staff member of a business that uses Trazza, contact that business first: it is the controller of your data and can correct it from the platform and, for customer records, export them as CSV; for other data it can ask us for a copy. If you write to us, we will forward your request to the business and help it respond.

We may ask you to confirm your identity before providing or changing data. We respond within the time limits set by the applicable law.

How we protect data

Passwords are stored with scrypt, a hashing algorithm with a random salt, and session tokens are stored only as hashes. Recovery codes and invitation links are checked against a hash, but a copy of the email that contains them remains in the sent-email log.

All traffic is encrypted over HTTPS with HSTS, and pages use a Content Security Policy (CSP) with a unique value in each response. The connection to the database is also encrypted.

We limit sign-in, password recovery, and form submission attempts, and we review attack signals every day, such as mass password-guessing attempts.

Each business sees only its own data. Isolation between businesses is checked on the server for every action, the database rejects cross-references between businesses, and automated tests verify it.

Private receipts and documents are stored in separate storage and are delivered only after verifying the session and permissions of whoever requests them.

Access by the Trazza team to customer accounts is recorded in the audit log.

No system is infallible. If we detect an incident that affects your data, we will notify you as required by law.

Artificial intelligence

The assistant and POS receipt reading use OpenAI. Calls are made only from our servers: your browser does not connect to the artificial intelligence provider.

What is sent: your question, the conversation history stored by your browser, your display name, your role, and the business name. For questions about numbers, aggregated results that your permissions let you see are also sent, such as team members' names with their services, sales, commissions, and advances, product and service names, expenses, and the number of appointments by status. For receipt reading, the photo of the receipt is sent.

What is not sent: no assistant report reads end customers' records, so the system does not send their names, emails, phone numbers, ID documents, or dates of birth. However, if you type personal data into your question, it is sent exactly as you typed it, so avoid including it.

For the assistant, Trazza does not store the text of your questions or of the answers, only usage data such as the model, tokens, cost, and outcome. For receipt reading, we store the photo and the extracted reading with the cash close. OpenAI may retain the data it receives according to its API policies.

The assistant does not make decisions with legal effects on anyone: it only queries and answers.

Minors

Trazza is a service for businesses and is not directed at children or adolescents.

A business may register end customers who are minors, for example with their date of birth. It does so under its own responsibility and must have the authorization of their parents or legal guardians where the law requires it.

When the Trazza team enters an account

Some Trazza team members may enter a business's dashboard to provide support, help with setup or, if that account is assigned to them, review its use and setup. The business authorizes that access in the Terms and Conditions.

To do so, they need a platform role and, except for Trazza's general administrators, must be assigned to that business. Each entry is recorded in the audit log along with their role, and access lasts at most 8 hours before they have to sign in again.

That access is used only for those purposes.

Changes to this policy

If we change this policy, we will update the date on this page. If the change is material, we will also notify you within the platform or by email.

Contact

For any privacy question or to exercise your rights, use the contact channel listed at the end of this page.