Privacy Policy

NexaVella ("NexaVella", "we", "us"), operated by Purple Hardstone LLC, provides a business management platform for beauty businesses, including hairstyling, barbering, nail care, skin care, massage & spa, and cosmetology providers. This policy explains what data we collect through our web app and mobile app, why we collect it, and how it's handled.

Information We Collect

• Account information: name, email address, and business details you provide when signing up, either directly or via Google Sign-In.
• Sign-up source:for an account created through our website outside the European Union, the EEA, the UK, Gibraltar, Switzerland, Cameroon and Quebec, and when the visitor has not opted out, where the visit began (for example a search engine, a social network or a campaign link), the campaign tag, the country of the sign-up request and the device type. These labels are kept with the account, are included in the account owner's data export, and are deleted with the account.
• Pictures: pictures a business uploads for its services, products and categories (see Your Own Pictures).
• Activity timestamps:we record when your account last signed in and, at a coarse interval (roughly every 15 minutes at most), a lightweight signal that your session is actively in use. This is used only to keep our own records of account activity accurate and to help secure your account, never for advertising. The business owner can see, in Login Activity, each team member's name, role and sign-in time and, when that person pressed Log out, the sign-out time (a sign-out that could not be sent, such as closing the app or losing the connection, is not recorded); these entries are part of the login logs kept for about 12 months (see Data Retention). To match a sign-out to its sign-in, the entry also carries an internal session identifier generated by our authentication system; it is not a device identifier. Separately, each business's records show which team member created or last changed them; see "Record History: Who Created or Changed a Record" below.
• Business data you enter: customer records (name, contact info, appointment and purchase history), staff records, product and service listings, invoices, and subscription details. This data is entered and owned by the business using NexaVella.
• Record history: for each customer, product, service, appointment, invoice, stock document and credit memo, the name and NexaVella user ID of the team member who created it and of the one who last changed it, and when; or, if no person did it, the source (such as AI Assistant, Online booking, AI Phone Line, Stripe or Customer).
• Invoice change history: for each invoice, an entry when it is created and an entry for each later change (for example a change of customer name, status, line items, amounts, discount, tip, dates, staff member, payment method or card refund), and an entry if the invoice is deleted (with the invoice number, customer name, status and total at that moment), each with the date and time and the name and NexaVella user ID of the team member who made it (or a source such as Stripe or System), including the customer names and amounts involved.
• Communications:when a business sends appointment or invoice notifications to its customers, we process the customer's email address and/or phone number solely to deliver that notification.
• Language preferences:a customer's preferred message language (English or French), stored when the customer picks it on the booking page, taken from the browser language on that page, or set by a team member; it is never guessed from a name. A business can also set its default language for customer messages (French, English or both). These are used only to write messages and pages in the right language.
• Country confirmation: the country of the business, and the date on which the account owner or a manager confirmed it. At sign-up we pre-fill the country from the country our hosting provider derives from your IP address (the x-vercel-ip-country header); the owner or a manager then confirms or corrects it. The country decides which features (such as deposits), currency and default message language apply to the business.
• Appointment deposits:When this feature is in use, we store the business's deposit settings and each version of its deposit and refund policy, with the date, the name and role of the person who saved or confirmed it, the version of the statements they confirmed, and the country; a log of changes to which team members may send, record, waive or settle deposits, with who changed it and when; and, for each deposit asked of a customer, a record linked to the appointment with its amount, status, how it was paid or settled (refunded or kept), who recorded it, and the policy version it was booked under. For a customer, the business may also set a deposit exception ("no deposit" or "always require") with an optional short note of up to 200 characters, and each change is logged with the name of the team member. The business decides what to write in that note; it should not contain health details. For card deposits, the payment is handled by Stripe on the business's own Stripe account (see Third-Party Services); NexaVella does not receive card numbers. NexaVella keeps, with the deposit records, a reference for each card payment attempt (the Stripe payment identifier), its status, amount, Stripe fee and dates, and the refund if there was one; it never keeps card details. These logs stay even if the customer or team-member record is later deleted (the name and note stay in the log), because the business may need them for its tax, accounting and dispute purposes. The business owns these records and can export them at any time before its data is deleted (90 days after the plan ends, after advance notice; see Data Retention). On the business's instruction, a free-text note can be removed from a specific entry, and on a customer's erasure request the business may keep the entries it is legally required to keep.
• Online bookings that ask for a deposit: we store, for each held booking, the deadline, a payment reference, whether the customer said they had paid (with the reference and method they typed), the business's terms as shown, the version of the acceptance wording the customer ticked and when, the page language, a one-way hash (not the raw value) of the IP address and browser details, and whether the device was a phone or a computer, kept as evidence of the acceptance. The payment link is stored only as a one-way hash. The hashes are cleared 24 months after the deposit is settled or closed; the rest of the acceptance record stays with the deposit records described above.
• Cameroon booking consents and acceptance record: for a business in Cameroon we store, for each acceptance on the booking page, a record that cannot be altered: the wording version of each box the customer ticked, the exact text shown and its sha-256 fingerprint, the languages shown, the price and the tax display (TTC or "TVA non applicable"), the time, and keyed fingerprints (not the raw values) of the connection (IP address and device). The customer also gets a confirmation copy by e-mail. The keyed fingerprints are removed after 24 months; the core record (versions, fingerprints of the texts, language, time, amount) is kept with the deposit record and for at least 5 years. For each client, NexaVella also stores whether the client agreed to promotional e-mail (the version of the wording, the time, the language and the source: booking page, or confirmed by a team member), and when it was withdrawn.
• Business legal details (Cameroon): the business's legal name, NIU, RCCM or entreprenant number, VAT position and policy texts in French and English, shown on its booking page, deposit pages and confirmation copies.
• AI Phone Line carrier-verification details:if you set up an AI Phone Line, we collect the details needed to verify your business for text messaging: business name and type, registration number (registered businesses only), a contact person's name, email address and phone number, a business or home address, your website address, and a description of the texts you send. We keep a draft while you fill the form and a snapshot of what you submitted. We share these details with our telephony provider (Twilio) and, through it, the mobile carriers, solely to obtain verification; a home address is used only for that purpose and is never shown to your customers. The details are deleted when your number is released and, in any case, with your account (see Data Retention); only the non-personal record that a verification was filed (its status and dates) is kept.

How We Use Information

We use collected data to:

• Provide and operate the scheduling, billing, and customer-management features of the app.
• Record, for each business, who created or last changed its records and when, so the business can keep accurate records, settle disputes and detect mistakes or misuse.
• Send transactional emails and SMS messages (appointment confirmations, invoice notices, deposit payment requests and reminders, appointment reminders) on behalf of a business to its own customers.
• On a business's instruction, send waitlist messages and win-back e-mails to that business's own clients, and keep a record of them.
• Maintain account security and authenticate sign-ins.
• Improve the reliability and performance of the platform.

We do not sell personal data or share it for cross-context behavioral advertising, and we do not use it for third-party advertising.

We keep simple usage counters to run and size the platform: how many signed-in people and businesses are active in an hour, and how many times a public booking page is opened. A person or business is counted through a one-way code that changes every day and is never stored with your account. The codes are deleted within 3 days, and after that nothing can link them to anyone; only the hourly totals (kept 90 days) remain. These counters hold no names, e-mail addresses, IP addresses or business details, and use no analytics or advertising cookies.

Website statistics. On our public website (the home page, Terms, Privacy, help and guides, never inside your account or a booking page) we count visits, which home-page sections are viewed, and how many visitors open the sign-up form, create an account, start a trial or subscribe, to learn which pages are read and which links bring people to us. Our legal basis is our legitimate interest in understanding which channels bring customers, with the least data possible: counts only. For each visit we keep only the page, the website the visitor came from (its name only, never the full address), the campaign tags in the link used (utm_source, utm_medium, utm_campaign), the country (taken from the request, never a precise location), and the device type, browser family and operating system family (never the full browser description). To count a visitor only once a day we compute a one-way code from the visitor's IP address and browser description inside the server's memory, using a random key that changes every day; the code is deleted within 3 days and the connection details themselves (including your IP address) are never stored in these statistics. Website statistics use no cookies. Outside the European Union (including its overseas regions such as Réunion, Guadeloupe, Martinique, French Guiana, Mayotte and Saint-Martin), the EEA, the UK, Gibraltar, Switzerland, Cameroon and Quebec, one short entry in your browser's sessionStorage remembers the source of your visit until you close the tab, so that a sign-up can be linked to the link that brought it; in those places website statistics store nothing on your device and a sign-up keeps no source label. Visits are not counted, and nothing is saved on your account, when your browser sends Do Not Track or Global Privacy Control, or inside the mobile app. Sign-ups and first paid subscriptions, including those bought through the App Store or Google Play, are still counted as totals without any label; an account created through our website outside the places above keeps the source label, campaign tag, country and device type of its sign-up (see "Sign-up source" above). The resulting totals, which do not name anyone, are kept 25 months. You can object at any time: turn on Global Privacy Control or Do Not Track in your browser, use the switch on this page, or write to support@nexavella.com and we will remove the sign-up labels from your account.

SMS Messaging & Consent

By providing your mobile phone number and checking the SMS consent box on our sign-up or booking forms, you agree to receive text messages from NexaVella related to your account and appointments: login verification codes, appointment confirmations and reminders, and invoice/payment notices (including, for businesses that use deposits, a request to pay a deposit, its confirmation and reminders about it). These are transactional messages only — we never send marketing or promotional text messages.

• Message frequency varies based on your account activity (bookings, invoices, deposits, and login events).
• Message and data rates may apply, depending on your mobile carrier plan.
• Opt out at any time by replying STOP to any message to opt out. Where we can receive replies in French, ARRET (and the other accepted French words: ARRÊT, ARRETE, ARRETER, STOPPEZ, DESABONNER, DESABONNEZ, DESABONNEMENT, with or without accents) also works; you can always opt out by contacting the business or support@nexavella.com. Reply HELP for help. Reply START or REPRENDRE to receive messages again. The word ANNULER is deliberately not an opt-out word (it is used to cancel an appointment).
• Your mobile number is never sold or shared with third parties for marketing purposes. It is used solely to deliver the notifications described above, via our messaging providers (see Third-Party Services below).

Waitlist & Win-back Data

When a business uses the optional Waitlist or Win-back tools, NexaVella processes the following on the business's behalf (the business decides whether and how to use them):

• Waitlist. The request a client makes (service, staff member, days and part of the day), the name, phone number and/or e-mail address they give, the time they agreed to be contacted about the request and the version of the wording they agreed to, and a record of each offer sent (the time offered, the channel and its outcome). An offer link contains a random code that is stored only as a one-way hash. When a freed time is detected, a short queue entry (staff member, date and time of the slot) is kept for up to 7 days.
• Win-back e-mail.Each campaign (its name, filters, any offer line the business typed, who created and who approved it), the e-mail text prepared for each client and whether it was sent, skipped or failed, and a log of campaign actions that cannot be edited. We read the business's existing customer, appointment and invoice records to choose who is overdue and to count bookings that followed an e-mail. Clients can unsubscribe with a one-click link; the unsubscribe list stores only a keyed one-way hash of the e-mail address, per business, so that an unsubscribe continues to be honoured even if the client record is deleted and created again.
• Consent and your choices.A waitlist consent covers messages about that request only and is not a consent to promotions. Win-back is open for the United States and Cameroon (and any other country we add). In the United States, previously served clients are eligible. Elsewhere, only clients the business has actually served or booked are eligible (never purchased lists). The audience builder shows consented clients and, by default, includes only clients who ticked the separate promotions e-mail box; the business can explicitly choose to also include previously served clients who did not tick it. Each e-mail names the business, shows its postal address and contact (for Cameroon also its NIU), is written in the client's language (one language per e-mail) and has a one-click unsubscribe; unsubscribes are honoured permanently, and a client who unsubscribes also has their promotions consent marked as withdrawn. Per-business sending limits and a cooldown apply. We do not send marketing text messages. A client can stop waiting from any waitlist message, reply STOP to any text (which also ends their waitlist requests with that business), or unsubscribe from a business's marketing e-mail; none of this affects transactional messages such as reminders and receipts.
• How long.Waitlist requests are kept while they are open and for 90 days after they close; after that the name and contact details are cleared. A business can delete a request at any time, and deleting a customer record also clears the contact details on that customer's requests and prepared e-mails. The log of messages sent (who a message went to, when, and whether it was delivered, never the text of a waitlist or win-back message) follows the message-log period in Data Retention. Win-back campaign records are kept with the business's other data and deleted with it (see Data Retention). The unsubscribe list is kept while the business's account exists so unsubscribes remain in effect. These records are included in the owner's data export, except the one-way hashes.
• Who is responsible.The business is the controller of its clients' data and the sender of the messages; NexaVella is its processor. Messages are delivered through the providers listed under Third-Party Services (Amazon SES for e-mail, Twilio for texts).

Your Own Pictures

On Professional and Enterprise, a business can upload its own pictures for its services, products and categories. What we store: two small resized copies of the picture (the original file is discarded, and photo details such as the camera, the location (GPS) and any text embedded in the file are removed when it is re-saved), the item or category it belongs to, its size, the date, and the team member who uploaded it. Who sees it: your team in the dashboard. Pictures of services and service categories are shown to anyone who opens your public booking page; product pictures appear only in your dashboard. The address of a picture is a long random code, and the booking page is the only place that lists it. Only upload a picture of a person who has agreed to it being published on your booking page (for a child, a parent or guardian). For anyone shown in a picture, the business is the controller and NexaVella processes the picture on its behalf. A person who appears in a picture and wants it removed can ask the business, or write to support@nexavella.com: we forward the request to the business within 10 days, and we remove a picture that is clearly unlawful. Where: in our database, hosted by Supabase (see Third-Party Services); no new provider is involved.

How long. A picture is kept until you delete it, until the service or product it belongs to is deleted, or until your business data is deleted (see Data Retention). If your plan stops including your own pictures (for example a downgrade to Starter, or a trial that ends), they stop showing at once. After a downgrade (you still have a paid plan, just one without this feature) they are permanently deleted by our next daily job, about 24 hours later, and do not come back if you return to a plan that includes them. When your plan ends (a trial that is not converted, a cancellation once the paid period is over, an unpaid or expired subscription, a full refund, or an account suspension) they are kept for 7 days in case you come back, return automatically if your plan includes them again within those 7 days, and are then permanently deleted by the first daily job after that: the 7 days start when the plan ends, not when you press Cancel. Either way, save your own copies first (we never keep the original file). Backup copies of a deleted picture age out within about 35 days, as described in Data Retention. Copies cached by our content delivery network (CDN) or by a browser can remain reachable at their address for up to an hour after a picture is deleted. The list of your pictures (not the image files) is included in your data export.

Third-Party Services

NexaVella relies on the following infrastructure providers to operate:

• Supabase — authentication and database storage (PostgreSQL).
• Google Sign-In — optional OAuth authentication.
• Amazon Web Services (SES, SNS and Polly) — email delivery, SMS fallback delivery, and text-to-speech.
• Stripe — payment processing, subscription billing and refunds.
• RevenueCat — manages subscriptions and in-app purchases (such as credit packs) bought through the Apple App Store or Google Play; receives your NexaVella account identifier and the store's purchase records (not card data).
• Twilio — SMS delivery and, for the AI phone line, voice calls (including ConversationRelay for live call audio).
• Deepgram — speech-to-text for AI phone calls, used through Twilio ConversationRelay.
• Fly.io — hosts the voice relay that connects AI phone calls to the assistant.
• Google Maps Platform — address autocomplete and geocoding when you enter an address.
• Sentry — error monitoring, to find and fix faults in the app. On a small share of visits, and on visits where an error happens, Sentry also records how the page behaved (clicks, page changes and layout). On-screen text and typed values are masked, and payment-link pages are never recorded.
• OpenAI — generates AI Business Assistant replies, speech-to-text and text-to-speech. Messages and voice audio sent to the assistant are processed by OpenAI to produce a response. The Learning Center assistant (the how-to helper for your own team) also sends the question you type, your earlier questions in the same conversation, and excerpts of NexaVella's own published guides, to OpenAI; e-mail addresses and phone-like numbers are removed from what you type before it is sent or saved, and it never sends your customers, invoices, prices, staff or settings.
• Vercel — application hosting.
• Cloudflare Turnstile / hCaptcha — a bot check on public booking pages when a business has many held times; receives the visitor's IP address and browser signals.

Card payments made directly to NexaVella (not through an app store) are processed by Stripe and appear on your card statement as "PHARDSTO* NEXAVELLA". Purple Hardstone LLC is the company behind NexaVella.

For those payments we give Stripe your business name, account email, your NexaVella account identifier, and the plan or item and amount. Card details and billing country are entered directly into Stripe's payment form, and Stripe also collects device and fraud-prevention data under its own privacy policy. We do not store full card numbers.

If a business connects its own Stripe account to take card payments from its clients, those payments are processed by Stripe on that business's own account. The business is the merchant for them; NexaVella does not receive or store the clients' card details and does not keep Stripe access tokens for the connected account. When a client chooses "Pay by card" on a deposit page, the card form is Stripe's own: card details are entered directly into it, and Stripe collects device and fraud-prevention data (which can include cookies) under its own privacy policy.

Stripe's permission screen for this connection says NexaVella "will be able to see" the account's data; that is Stripe's standard wording for every app connected this way. NexaVella uses the connection only to create card payments for the business's invoices and deposits, to cancel deposit payments that were started and not finished, to refund a deposit card payment automatically when it could not be applied to the booking, to read the Stripe fee of those payments (sending the invoice reference, the amount and the client's name and contact details to the business's own Stripe account with each payment; for a card deposit, the payment reference and the business's name, plus the client's e-mail address when one is on file so that Stripe can send the receipt, never the client's name or phone number), to check whether the account can accept card payments, and to receive Stripe's notices about those payments, refunds, account updates and disconnection, which it records only for payments it created itself. NexaVella does not read the account's balance, payouts or customer list. The business can disconnect at any time in NexaVella (Settings, then Payments) or in its Stripe dashboard.

A business can also store its own payment instructions in NexaVella (such as a bank account, mobile money number or other payment details) so they are shown to its clients on invoices, and can record that an invoice was paid in that way, with an optional reference. NexaVella then stores, with the invoice, that reference (if given), the name of the team member who recorded the payment and the time it was recorded, and keeps a history of changes to the stored payment instructions (who changed them and when). NexaVella stores and displays this text on the business's behalf; it does not receive or hold those payments, does not connect to the business's bank or mobile money account, and does not verify them.

For purchases made through the Apple App Store or Google Play, payment and billing data are handled by Apple or Google under their own privacy policies. We receive only subscription status and purchase records (such as the product, price and transaction id), through our subscription-management provider RevenueCat, not card data. Refunds for subscriptions or purchases made through the Apple App Store or Google Play are handled by Apple or Google under their own policies; NexaVella cannot issue them, so please request them from Apple or Google.

Each provider processes data only as needed to deliver the functionality above, under their own security and privacy commitments. Data Processing terms are available on request at support@nexavella.com.

International transfers

We are based in the United States and our providers process data in the US and other countries; where required we rely on appropriate safeguards such as standard contractual clauses.

Data Storage & Security

Business and customer data is stored in Supabase (PostgreSQL) with tenant-level isolation, so each business only has access to its own data. We use industry-standard encryption in transit (HTTPS/TLS) for all network communication.

Our Role: Controller and Service Provider

For the personal data of a business's own clients (the customers, appointments, and messages a business enters or generates in NexaVella) and of its own team members (its staff records and the record history described below), and of anyone shown in a picture it uploads, NexaVella acts as a service provider (processor) on that business's behalf. The business decides what to collect and why, and we handle the data only to run the service for it. For the account owner's own information and NexaVella billing data, Purple Hardstone LLC is the controller (the business responsible for that data). For the limited SMS consent and opt-out record described under Data Retention, we act as an independent controller. Our postal address is Purple Hardstone LLC, 5555 Whittlesey Blvd Suite 1200 #1145, Columbus, GA 31909, United States.

Record History: Who Created or Changed a Record

NexaVella automatically records, on each customer, product, service, appointment, invoice, stock document and credit memo, who created it and who last changed it, and when. For a team member (owner, manager or staff) this is their name as it appears in the business's staff list (or the owner's account name) and their NexaVella user ID. When a record is created or changed automatically, a source is recorded instead (for example AI Assistant, Online booking, AI Phone Line, Stripe, or Customer when a client confirms or cancels through a reminder link). Only the creation and the most recent change are kept on the record itself; invoices also keep a change history (see "Invoice change history" below). NexaVella does not use any of this to track screens viewed, time spent or anything else outside these records.

• Why. So the business can see who did what in its own records, resolve disputes with clients or within its team, and find and investigate mistakes, misuse or fraud (for example an invoice changed or cancelled without permission).
• Invoice change history. For each invoice, NexaVella also keeps an entry when it is created and an entry for each later change (for example customer name, status, line items, total, discount, tip, due or issue date, staff member, payment method, card refund, and when it was sent or paid), each with the date and time and the name and NexaVella user ID of the team member who made it, or a source such as Stripe or System when no person did it. It contains the names of team members and the customer names and amounts involved (a payment reference you type is not copied into it, only the fact that it changed), and it only starts from the day the feature was enabled. Who can see it:only the business's owner and managers, in the business's own time zone; it is never shown to the business's clients (not on the invoice link, payment page, PDF, printout, email or text message). Entries cannot be edited or removed from the dashboard. However, where the law allows or requires it (for example a valid erasure request), a business may ask NexaVella support, and on the business's instruction we may remove or replace a person's name (and, for a team member, their NexaVella user ID) in specific history entries. This does not change the invoice itself, the appointment, the customer file or the payment records, and data that the business must keep for tax or accounting purposes, or needs to establish, exercise or defend legal claims (for example a payment dispute), may be kept. We do not promise removal in every case. Copies already exported by the business, and backups, are outside this and age out as described in Data Retention. The history is kept after an invoice is deleted (invoices can be deleted by the business in some cases), together with a record of who deleted the invoice and when (the invoice number, customer name, status and total at deletion), and owners and managers can still see it. It is deleted only together with the business's data (see Data Retention), and it is included in the owner's data export. Customer names and amounts in the history can remain after an invoice is deleted or a customer record is corrected or deleted, because the business keeps it as a reliable record of its invoicing and to investigate mistakes or fraud.
• Who can see the created-by and last-changed-by information.The business's owner and managers, and team members on the records they can already open in the dashboard (this does not apply to the invoice change history above, which only owners and managers see). It is shown in the business's own time zone. It is never shown to the business's clients: it does not appear on invoices, payment pages, PDFs, emails or text messages sent to them. It is included when the owner exports the business's data.
• The created-by and last-changed-by information cannot be edited by anyone, including the business, so that it stays reliable. It shows the name in use at the time; if a name in the staff list is later corrected, earlier records keep the earlier name.
• How long.As long as the record it belongs to. It stays on the record if the team member leaves or their login is removed, and it is deleted with the record or with the business's data (see Data Retention). The invoice change history follows its own rule (see above): it is kept until the business's data is deleted, even if the invoice is deleted.
• Who is responsible.The business is the controller of this information about its own team, and NexaVella processes it on the business's behalf. Businesses subject to the GDPR or UK GDPR normally rely on their legitimate interest in keeping accurate business and financial records and preventing fraud, not on employee consent. The business is responsible for telling its team about this recording and for any notice or consultation its local employment law requires.
• Team members' rights. Depending on where you live (for example under the GDPR, the UK GDPR or California law), you may have the right to access this information, to ask for it to be corrected, deleted or restricted, and to object to it. Because the business controls it, please send your request to the business first. If you write to us, we will forward your request to the business promptly, and in any case within 10 days, and tell you we have done so. Some requests may be limited where the business must keep the record for legal claims or for tax or accounting reasons.

Data Retention

How long we keep your data depends on what it is. While your plan is active, we keep your data so the service works, except for the logs and message history shown in the table below, which are kept for a shorter, fixed period even on active accounts.

After data is deleted from our systems, copies in our backups age out within about 35 days. Copies held by our service providers (Twilio, OpenAI, AWS, Stripe, Sentry) are deleted or expire under their own retention periods, and a business's Twilio sub-account data is closed when the account is deleted.

We may keep data longer where needed to resolve an open billing matter, refund or dispute, or where the law requires it.

A business's own records (deposits, refunds, invoices)

Deposit, refund, payment and invoice records are the business's own accounting records. The business keeps them for the period its own legal, tax and accounting obligations require, owns them, and can export them at any time before its data is deleted. NexaVella keeps a business's data while the plan is active and for 90 days after it ends (with advance notice by email), so the export is available until then; after that the data is deleted as described above. Periods vary; check the rules that apply to your business. Typical minimums:

Your Choices: Export and Deletion

• Export. The account owner can export their business data as a file at any time, including after the plan has ended, until the data is deleted. Your data export lists your pictures but does not include the image files, so keep your own copies of the originals. The sign-up source labels of your account (see Website statistics) are included in the export.
• Deletion.The account owner can ask us to delete the account at any time: in the dashboard under Settings, from the "plan ended" screen, or on our public page at nexavella.com/delete-account. You can also email support@nexavella.com.
• Timing. Deletion is carried out after a 7-day cancel window, during which you can change your mind. We complete deletion within 30 days of your request, unless the law requires or allows us to keep it longer or we cannot complete it yet - in that case we will contact you. This is within the 45 days that laws such as the California Consumer Privacy Act allow. Requests sent by email to support are handled the same way and acknowledged within 10 business days.
• What is kept anyway.Even after deletion, we keep NexaVella's own subscription billing records for 7 years, or longer where tax law requires (not the business's own invoices or deposit records, which the business exports and keeps itself), and the SMS consent and opt-out records we keep to defend legal claims, for the periods in the table above. Backups and provider copies age out as described above. Staff and manager logins are deleted together with the business account; a staff member or manager who wants their own account removed sooner can ask the account owner or email support@nexavella.com. When a staff or manager login is removed, that person's name stays on the records they created or last changed and in the invoice change history, including entries for invoices they deleted (see Record History above).
• Clients of a business.If you are a client of a business that uses NexaVella and want your data corrected or deleted, please contact that business first; it controls that data. If you write to us, we will forward your request to the business promptly, and in any case within 10 days, and tell you we have done so. If the business no longer uses NexaVella, its data is deleted on the schedule above. Invoices, including their change history, keep the name used at the time. Customer names and amounts in the history can remain after an invoice is deleted or a customer record is corrected or deleted, because the business keeps it as a reliable record of its invoicing and to investigate mistakes or fraud, and may need to keep invoices for tax or accounting purposes. If you are a client and the law gives you the right to have your name erased from that history, ask the business to contact NexaVella support; where the law allows or requires it, and on the business's instruction, we may remove or replace your name in specific history entries, without changing the invoice, the appointment, the customer file or the payment records. Data the business must keep for tax or accounting purposes, or needs to establish, exercise or defend legal claims (for example a payment dispute), may be kept, and removal is not guaranteed in every case. Copies already exported by the business, and backups, are outside this and age out as described in Data Retention.

Your Rights

Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected (rectification), deleted, or restricted, to object to how we use it, and to receive a copy of it. If you are a client or a team member of a business that uses NexaVella, that business controls the data in its records, so please contact it first (see "Clients of a business" and "Record History" above). If you write to us instead, we will forward your request to the business promptly, and in any case within 10 days, and tell you we have done so; for data in your own NexaVella account, write to us at support@nexavella.com. If you are a team member named in an invoice's change history and the law gives you the right to erasure, ask your business to contact us: where the law allows or requires it, and on the business's instruction, we may remove or replace your name and NexaVella user ID in specific entries, subject to what the business may need to keep for tax, accounting or legal claims, and not affecting exports and backups already made (see "Record History"). To use any of these rights, email support@nexavella.com. You also have the right to complain to your data protection authority if you think we have handled your data unlawfully.

Children's Privacy

NexaVella is a business tool intended for beauty-industry professionals and is not directed at children. We do not knowingly collect personal data from children. A business may record appointments for minors at a parent's or guardian's request; the business is responsible for having the authority to do so. Booking pages are for adults or a parent or guardian booking for a child. In Cameroon, people under 18 book with the agreement of a parent or legal representative.

Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Contact Us

Questions about this policy or your data can be sent to support@nexavella.com. Controller: Purple Hardstone LLC, 5555 Whittlesey Blvd Suite 1200 #1145, Columbus, GA 31909, United States.