Privacy policy

The service is published by Benjamin Lepaul, sole trader (entrepreneur individuel) operating under the trade name CréaWeb Conseil, whose registered office is located at 17 rue Jules Ferry, 25600 Nommay, France, registered in the French National Business Register (Registre national des entreprises) under SIREN number 804 460 921 (SIRET of the registered office 804 460 921 00039).

For any question relating to your data: contact@rezalia.fr.

This distinction governs the rest of this document.

For practitioner accounts, Rezalia is the data controller: we determine which data is necessary to provide the service and the purposes for which it is processed.

For end clients' data, meaning the people who book an appointment, Rezalia acts as a processor within the meaning of Article 28 of the GDPR. The practitioner remains the data controller: it is the practitioner who determines why this information is collected. We process it solely on the practitioner's instructions, in order to operate the booking.

Practitioners: email address, encrypted password or identifier from the sign-in provider, business name, description, telephone number, business address, opening hours, services and prices, as well as the payment account identifier.

End clients: name, email address, optional telephone number, date and time of the appointment, chosen service, and answers to any questions asked by the practitioner. Where applicable: consent given to receive the practitioner's offers by SMS, and the contact details entered to purchase a package or enrol in a training course.

Technical data: server logs necessary for the operation and security of the service. Rezalia uses no advertising cookies. On its public pages only, and if you accept, Google Analytics audience measurement may be enabled (see the "Cookies" section).

Provision of the service: creation and management of appointments, sending of confirmations, reminders and cancellation notices. Legal basis: performance of the contract.

Collection of deposits, packages and training courses, where the practitioner has enabled it. Legal basis: performance of the contract.

Appointment reminders by SMS, where the practitioner has enabled them and the client has provided a mobile number. Legal basis: performance of the contract.

Practitioner offers by SMS, sent only to clients who expressly agreed to receive them when booking. Legal basis: consent, which may be withdrawn at any time by replying STOP or by asking the practitioner.

Security and abuse prevention. Legal basis: legitimate interest.

Accounting and tax obligations. Legal basis: legal obligation.

No data is used for advertising purposes, nor sold, rented or transferred to third parties for commercial purposes.

A practitioner may connect their Google calendar to Rezalia. This connection is optional, made solely on the practitioner's own initiative, and may be revoked at any time.

When it is active, we access strictly:

• The list of their calendars (the name of each), so that they can choose the ones that matter: personal calendar, work calendar, etc.
• The busy periods of the chosen calendars, via Google's "freeBusy" interface, so that only free time slots are offered to their clients. Clients never see the content of these calendars.
• The title and times of events in the chosen calendars, displayed only to the practitioner in their Rezalia calendar so that they can link them to a service. They are read when displayed and are not stored. Only the identifier of an event that the practitioner decides to link is saved with the appointment created. Rezalia does not read the description, the attendees or the location.
• The creation and deletion of events corresponding to Rezalia appointments, so that the practitioner's calendar stays up to date. An event created by the practitioner themselves and linked to Rezalia is never deleted.

This data is used exclusively to prevent double bookings, to display the practitioner's calendar and to keep it up to date. It is never used for advertising, is not transferred to third parties, and is not used to train generalised artificial intelligence models. No human being views it, except with the practitioner's express consent, to resolve an incident, or where required by law.

The Google authorisation token is stored encrypted, in an isolated storage area that cannot be accessed from the public interfaces of the service. Disconnecting from the account settings permanently deletes this token. The practitioner may also revoke access from the permissions of their Google account.

We use the following service providers, each contractually committed to protecting the data entrusted to them:

• Supabase: database hosting, on infrastructure located in the European Union (Ireland region).
• Vercel: application hosting.
• Stripe: payment processing. Rezalia neither sees nor stores any bank card data: it is entered directly on Stripe's secure pages.
• Resend: delivery of transactional emails.
• Allmysms, a French provider: delivery of SMS messages, where the practitioner uses SMS reminders or campaigns.
• Google: calendar synchronisation, only if the practitioner has enabled it.

Some of these providers may process data outside the European Union. Such transfers are governed by the European Commission's standard contractual clauses.

Practitioner account: retained for the entire duration of the subscription, then deleted within twelve months of its closure.

Appointments and end clients' data: retained for three years from the last appointment, the customary duration of the business relationship, unless deletion is requested earlier.

Accounting records: ten years, in accordance with the legal obligation.

Google data: no lasting retention. Busy periods are read on the fly and are never stored.

You have the right of access, rectification, erasure, restriction of processing, objection and portability with respect to your data, as well as the right to set out instructions regarding what happens to it after your death.

If you booked an appointment with a practitioner, please contact them first: they are the controller of this data. We assist them in handling your request. For any other question, write to contact@rezalia.fr.

You may also lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL, the French data protection authority).

Communications are encrypted in transit. Access to data is partitioned: each practitioner can only view their own, and this partitioning is enforced at the level of the database itself, not only at the interface level. Sensitive credentials, including calendar access tokens, are stored in an isolated area that cannot be accessed from the public pages.

Session notes written by a practitioner receive additional protection: they are encrypted in their browser with a key derived from a passphrase that only they hold. Rezalia can neither read nor restore them. The Security and health data page explains this mechanism and what the regulations expect depending on the profession.

Rezalia sets cookies that are necessary for the operation of the service: keeping a signed-in practitioner's session active and protecting against request forgery. As these cookies are strictly necessary, they do not require prior consent. No advertising cookies are set.

Audience measurement (Google Analytics). On the public pages of the site (home, pricing, comparisons, blog, guides, pages by profession, support), Rezalia may measure visits with Google Analytics, a Google service. This measurement is enabled only with your consent, requested on your first visit: until you accept, nothing is loaded or set. You can refuse, or change your choice at any time with the "Gérer les cookies" link at the bottom of the page. It never takes place in the practitioner area, on booking pages or in cancellation links, and Google signals and ad personalisation are disabled. Google may process this data in the United States under its transfer safeguards.

Any change to this policy will be published on this page, with the date shown at the top updated accordingly. Practitioners will be notified by email of any substantial change affecting them.