Privacy Policy
Last updated: August 2026
1. Who we are
Aura Beauty OS (“Aura,” “we,” “us”) is an operating suite for beauty and wellness professionals, built by Zelus Labs. This Privacy Policy explains what we collect, why, and the choices you have. It covers our public marketing site and our authenticated application.
2. Two kinds of data, kept separate
Your account data, the information you and your team enter to run your business: studio profile, service catalog, appointments, client (CRM) records, campaigns, and any clinical notes you choose to store. You control this data; we process it on your behalf to provide the service.
Site-visitor data: basic, mostly anonymized information collected when anyone visits our public marketing pages (see our Cookie Policy).
We keep these environments separate. Analytics used on the public site are never loaded inside your authenticated workspace.
3. What we collect
Information you provide: your name and email at sign-up, your studio profile and onboarding answers, catalog and scheduling data, CRM contacts, and billing details you enter with our payment processor.
Information created by using Aura: bookings, campaign sends, task and usage logs, and audit records that help secure the workspace.
Information collected automatically on the public site: anonymized page views, referrers, approximate region, and device/browser type, via an analytics script (see the Cookie Policy).
Information your clients give us on your behalf: what they type into a booking, and into any intake, consent or waiver form you published, including a typed signer name, the time of signing, and the network address and browser used to sign it.
Information from your callers: if you switch on the AI Front Desk, a completed call can create a client record in your workspace from any name, email or phone number the caller gave, along with a written record of the call.
4. How we use it
We use account data to operate and secure the service, provide support, process payments, and power the AI tools you invoke. We use site-visitor data to understand which pages are useful and to improve the site. We may send you service and account emails; product/marketing emails are optional and you can unsubscribe at any time.
5. AI features and your data
When you use an AI feature (copywriting, campaign planning, image generation, and similar), the specific content you submit is sent to our AI provider to generate a response. Any datasets we use to improve Aura's own tools are anonymized: they do not include client names, contact details, or treatment records. We do not sell or lease your data or your clients' data, and we do not use the contents of your workspace for third-party advertising.
6. Sharing and subprocessors
We share data only with vendors that help us run Aura, under agreements that require them to protect it. Google Cloud and Firebase hold the database, the sign-in system and the files you upload. Render runs the application itself, behind Cloudflare, so every request you make passes through them. Stripe processes payments. Google's Gemini models power the AI features. Twilio carries the phone number and the voice calls behind the AI Front Desk. An email delivery provider sends the mail Aura sends for you.
Aura runs on a shared platform operated by Zelus Labs, which makes Aura. That platform relays transactional email, owns the phone line and its transcripts, and runs image and video generation. This list changes when our vendors change, and we update it here.
We may disclose information if required by law or to protect the rights and safety of our users. If our business is transferred, data may move as part of that transaction; we'll notify you of any material change.
7. Security and retention
We protect data in transit with TLS. Data at rest is encrypted by our cloud provider, and the credentials you connect to Aura are encrypted again by us on top of that. Access to production systems is limited and logged.
We keep your account data for as long as your account exists. If you cancel we do not delete it automatically, so that you can come back to it later. If you want it gone, email us and we will delete or de-identify your workspace. Some records we cannot remove on request, such as audit logs and billing records the law requires us to keep.
8. Your rights and choices
Depending on where you live (for example under GDPR or CCPA), you may have the right to access, correct, export, or delete personal data, and to object to or restrict certain processing. You can edit most of your data directly in Settings, or contact us to exercise these rights. Because you control your clients' records, requests from your clients should be directed to you as the data controller; we'll support you as your processor.
9. Children
Aura is a business tool intended for use by adults. It is not directed to children, and we do not knowingly collect personal information from children under 13.
10. Changes and contact
We'll update this policy as the product evolves and note the effective date above. For privacy questions or requests, contact us at