Privacy Policy

1. Who we are

Aura Beauty OS (“Aura,” “we,” “us”) is an operating suite for beauty and wellness professionals, built and operated by Zelus Labs, 21601 Vanowen St, Canoga Park, CA 91303. This Privacy Policy explains what we collect, why, and the choices you have. It covers our public marketing site, our authenticated application, and the booking pages, websites, landing pages and forms we host for the studios that use Aura. It is part of our Terms of Service.

Aura also runs a suite rental portal for a business that rents beauty suites to professionals (the “rental business”). It has a public page where anyone can apply for a suite, and a portal where tenants sign their lease, pay rent and look after their suite, and where the rental business and its co-owners run the rentals. If you rent a suite, your landlord is the rental business named in your lease, not Aura. This policy covers the portal too.

2. Two kinds of data, kept separate

Your account data, the information you and your team enter to run your business: studio profile, service catalog, appointments, client (CRM) records, campaigns, media, and any service notes you choose to store. You control this data; we process it on your behalf to provide the service. If you rent stations to other professionals, their agreement details are part of it too.

Tenant data: if you rent a suite through the suite rental portal, the details about your rental that you, the rental business and its co-owners enter there. We hold it for the rental business, to run your rental. If you also turn on Aura for your own business, that workspace is your account data and is kept apart from your rental: the portal shows the rental business whether you turned it on, not what is in it.

Site-visitor data: basic, mostly anonymized information collected when anyone visits our public marketing pages or our sign-in page (see our Cookie Policy).

We keep these environments separate. The analytics and advertising scripts used on the public site and the sign-in page are never loaded past sign-in, inside your authenticated workspace.

3. What we collect

Information you provide: your name and email at sign-up, your studio profile and onboarding answers, catalog and scheduling data, CRM contacts (typed in or imported from a spreadsheet), and billing details you enter with our payment processor. If you connect your own payment, email, Google or Canva accounts, the credentials or tokens for those connections.

Information created by using Aura: bookings, campaign sends, opens and clicks, task and usage logs, AI credit and phone minute usage, and audit records that help secure the workspace, including the network address a change was made from.

Information collected automatically on the public site: anonymized page views, referrers, approximate region, and device/browser type, via an analytics script, and, if you accept marketing cookies, advertising measurement by Meta (see the Cookie Policy).

Information your clients give us on your behalf: what they type into a booking (name, email, and a phone number if they give one), a lead form on one of your landing pages (plus the campaign link that brought them there), and any intake, consent or waiver form you published, including a typed signer name, a drawn signature, the time of signing, and the network address and browser used to sign it. When a client opens one of your forms through its link, the time and the network address of that first opening may be kept with their submission. You can download a client's signed form as a PDF that carries a document ID on every page and ends with a signing record listing when it was first opened and signed, where each was recorded, with the signer's name and email and the time, network address and browser kept with each. Whether a client ticked the box to hear from you by email, and when, and if they did, whether they had accepted marketing cookies on your booking page. When someone fills in a Meta lead form for your studio's ads, the name, email address and phone number they enter, which Aura stores for your studio.

Information from your callers: if you switch on the AI Front Desk, a completed call can create a client record in your workspace from any name, email or phone number the caller gave, along with a written record of the call.

Information from professionals who rent from you: if you use the Booth and Chair Rental Suite, the name, contact details, agreed terms, licence and insurance details a renter enters, and the state of their rent payments. Their card is held by Stripe, never by us.

Information from people who apply to rent a suite: when someone applies, the application details they enter (name, email, phone, specialty and message) are kept to review the application and reply to them, and the network address and browser used to send the application are kept with it to spot abuse.

The rental business, not Aura, decides on every application. If it puts an application on its waiting list, we email the applicant once when a suite they asked about opens.

Information from suite tenants: if you rent a suite through the suite rental portal, your name and email; the details you choose to add (phone, business name, what you do and a booking link); your lease and every signature on it; your rent, deposit and charge payments; the licence and insurance documents you upload; your maintenance requests and their photos; the condition reports and their photos; the messages and forms you send; the guest passes, extras and shared space bookings you ask for; your notice to move out; and the name and contact details of anyone you refer. Each signature is kept with the name you typed, your drawn signature, the time, and the network address and browser you signed from. The rental business may countersign your lease, and its countersignature is kept the same way. The first time you open a document in the portal, and the first time the rental business does, we record the time, the network address and the browser it was opened from. Every document signed in the portal carries a document ID on every page and ends with a signing record listing when it was created, sent, first opened, signed and countersigned, where each was recorded, with the names and email addresses of the people involved and the time, network address and browser kept with each event. You and the rental business can both download it. If you choose to be listed in the tenant directory, other tenants see your name, business name, what you do, your suite and your booking link, never your phone number or email.

Door codes and door activity: where your suite has a connected door lock, the door codes you set for yourself and for your guests, with the name you give each guest code, and a record from the lock of each time it was unlocked or locked and which code or method was used. The digits of a code are stored encrypted and shown only to you. When you open your door from the portal, we record that you asked.

Texts to tenants: if you turn on texts about your rental, your mobile number, the sentence you agreed to (“Text me about my rental at this number. Message and data rates may apply. Reply STOP to stop.”), when you agreed, and the network address and browser you agreed from; and a record of each text sent to you, never its words. Turning texts off keeps that record and adds when you turned them off.

Information the rental business adds: the rental business and its co-owners can write private notes about a rental, which the tenant never sees, and every change to a rental is written to an activity log with who made it.

4. How we use it

We use account data to operate and secure the service, provide support, process payments, send the messages you ask us to send to your clients, and power the AI tools you invoke. We use site-visitor data to understand which pages are useful, to improve the site, and to measure our own advertising. We may send you service and account emails; product and marketing emails are optional and you can unsubscribe at any time.

We use tenant data to run the suite rental portal for the rental business: to take rent and other payments through its Stripe account, to keep the signed lease and the rental's records, to send the letters and texts the portal sends, to set and remove door codes, to answer an application, and to show the rental business and its co-owners what they need to run your rental. We do not use it for anything else.

5. AI features and your data

When you use an AI feature (copywriting, campaign planning, image generation, the phone agent, note summaries, and similar), the specific content you submit is sent to an AI provider to generate a response. Text goes to Google's Gemini models through Google Cloud; images you generate or edit go to the image generation providers our platform uses; the phone agent's speech and transcripts go through the telephony and AI providers named in section 6. Names are redacted from client notes before they are sent for summarising.

To make suggestions better across studios, the marketing text you produce with Aura's tools (campaign titles, ad headlines and image or video prompts) may be kept as anonymized patterns that never name your studio, your clients or your prices. Client records, contact details, notes, photographs, form answers, transcripts and financial data are never used to train or improve anything, and no third party trains on your content through us. We do not sell or lease your data or your clients' data, and we do not use the contents of your workspace for third-party advertising.

6. Where your data lives, and who helps us process it

Your data is stored and processed in the United States. Google Cloud and Firebase hold the database, the sign-in system and the files you upload, in Google's US regions. If you are outside the United States, including in Canada or the European Economic Area, you are sending your data and your clients' data to the United States by using Aura, and you are responsible for any notice or consent your own law requires for that.

We share data only with vendors that help us run Aura, under agreements that require them to protect it, and only what each one needs:

Running the application: Google Cloud and Firebase (database, files, sign-in), Render (the application servers), Cloudflare (every request passes through it). Billing you: Stripe. Text AI: Google's Gemini models on Google Cloud. Image and video generation: the generation providers our platform uses for the model you pick (MuAPI's models among them), which receive your prompt and any reference image you attach. Phone and text: Twilio carries the phone number, the voice calls and, once available, the text messages behind the AI Front Desk. Email: SendGrid delivers the mail Aura sends for you; if you connect your own Resend, SendGrid or SMTP account, that provider delivers it instead. Search add-on: DataForSEO and Google Search Console receive keywords and page addresses, never client data. Domains: Namecheap registers domains you buy, and receives the registrant details you enter; Render receives a custom domain name you connect. Design: Canva, only if you connect it, receives the design title and brand kit you ask for.

Services you connect or switch on yourself: your own Stripe or PayPal account takes your clients' payments, so those payments are governed by their agreements with you; Google Calendar receives your appointments (client name, service, staff and studio) if you connect it; Meta receives booking and lead events from your booking and landing pages under your own pixel, as described in the Terms of Service and the Cookie Policy.

Meta and your studio's own ads: a booking is sent from our servers to your Meta pixel only when the client both ticked the box to hear from you by email and accepted marketing cookies, and it tells Meta that a booking was made and its value, never which treatment it was for. When a client agrees to receive your marketing emails, you may upload a hashed copy of their email address to Meta, so that Meta can show your ads to them or to people like them without being sent the address itself. A client can stop this at any time by unsubscribing from your emails, and they are left out of every upload after that.

The suite rental portal: rent, deposits and any other charges are paid to the rental business's own Stripe account, never to us, by card or, where the rental business turns it on, from a US bank account, entered on Stripe's own pages. Your card and bank details are held by Stripe, never by us. Where a suite has a connected door lock, a door lock service provider receives what it needs to run the lock: which lock, the name of each code (your suite's, or the name you gave a guest code), the code's digits and the times it works, and each request to open the door; it tells us when the lock was unlocked or locked. Letters and texts to tenants go through the email and phone providers named above.

Aura runs on a shared platform operated by Zelus Labs, which makes Aura. That platform relays transactional email, owns the phone line and its transcripts, runs image and video generation, and holds the Meta, Google Business, YouTube and TikTok connections used for social features. This list changes when our vendors change, and we update it here.

We may disclose information if required by law or to protect the rights and safety of our users. If our business is transferred, data may move as part of that transaction; we'll notify you of any material change.

7. Security, support access and retention

We protect data in transit with TLS. Data at rest is encrypted by our cloud provider, and the credentials you connect to Aura are encrypted again by us on top of that. Access to production systems is limited and logged. Everyone you add to your team can see the client records, media and audit history of your workspace, so who you add is your decision.

To help you, a member of our team can open your workspace as you for up to one hour at a time. Every such session is recorded with who opened it and why, you are emailed when it starts, and inside it we cannot spend your money, change your team, reach your connected credentials, send to your client list, or export or erase a client. We do this to support you and to investigate abuse, and for nothing else.

We keep your account data for as long as your account exists. Closing your account from Settings stops billing and takes your booking page and phone line down at the end of your paid period; your records are kept for 30 days so you can reopen, and after that until you ask us to delete them, so that you can come back to them later. Ask us and we will delete or de-identify your workspace. Some records we cannot remove on request: audit logs, billing and tax records the law requires us to keep, executed agreements, and the record that a person unsubscribed or texted STOP, which we keep so we never contact them again.

In the suite rental portal, the rental business and every co-owner it adds can see what the portal holds about a tenant: their details, lease and signatures, rent and deposit records, uploaded documents, maintenance requests and photos, condition reports and photos, messages, forms, the activity log, and the private notes the owners write. The keys that connect the rental business's Stripe account and door lock service are stored encrypted and are never shown to anyone. A door code's digits are shown only to the tenant it belongs to, never to the rental business or to our support team.

The lock's record of when a suite was unlocked or locked is kept for 90 days and then deleted. A tenant sees their own suite's door activity during their rental. The rental business sees a suite's door activity only while the suite is empty, and only for the times no one was renting it, and is told if a door code opens a suite's lock within 14 days after a rental of it ends. During a rental it sees, in the activity log, when a door code was made or removed and when the door was opened from the portal, never the digits. Inside a support session, door codes and door activity are hidden and nothing in the portal can be changed.

When a rental ends, the tenant can still sign in to read it, and the rental business keeps the lease and the signed documents, the payment records and the activity log. Rent records, applications, notes and uploads are kept for as long as the rental business needs them to run the rental and keep its records. To ask what is kept about you, or to have something corrected or removed, ask the rental business, or write to us at privacy@zeluslabs.dev.

8. Your rights and choices

Depending on where you live (for example under GDPR, PIPEDA or CCPA), you may have the right to access, correct, export, or delete personal data, and to object to or restrict certain processing. You can edit most of your data directly in Settings, export your clients, appointments and everything else as files from Settings, or contact us to exercise these rights. Because you control your clients' records, requests from your clients should be directed to you as the data controller; we'll support you as your processor. We do not sell personal information; declining marketing cookies on our site opts you out of the advertising measurement described in the Cookie Policy.

If you rent a suite or applied for one, the rental business decides what it needs to keep about your rental or your application, so ask it first. You can also write to us at privacy@zeluslabs.dev, and we will help the rental business answer you. A tenant can change their own details, their place in the tenant directory and their texts choice in the portal's Settings at any time.

9. Children

Aura is a business tool intended for use by adults. It is not directed to children, and we do not knowingly collect personal information from children under 13.

10. Changes and contact

We'll update this policy as the product evolves and note the effective date above. For privacy questions or requests, contact us at privacy@zeluslabs.dev. For anything else, hello@aurabeautyos.com.