Privacy Policy

The data controller is the professional or business where you booked the service — below, «the provider». They decide which data is requested, what it is used for and how long it is kept, and they are who you should contact first; you will find their name and contact details on their booking page and in the confirmation e-mail you received.

Alayah is the processor(Art. 28 GDPR): it supplies the provider with the system where the data is stored, and processes it only on the provider's documented instructions.

The system has several parts. Each piece of data is used only in the part it belongs to:

So that not everyone gets the same message, the system sorts clients into simple groups based on their booking history — for example «regular client», «not seen for 90 days» or «has an active package». The provider uses these groups to choose who each campaign goes to.

This is profiling within the meaning of Art. 4(4) GDPR, but it has no legal effects and decides nothing about you: it does not change prices, does not refuse bookings and is used only for campaigns — which reach you only if you allowed them. You may object at any time, without giving reasons (Art. 21(2)), and you will no longer be included.

There is no legal obligation to provide it, but your name and a contact are necessary for the booking to exist — without them the provider cannot hold the slot for you or tell you about a change. Without that data, the booking cannot be made through the platform.

Everything else — e-mail, date of birth, preferences, reminders, campaigns and reviews — is free and optional. Declining has no consequence for the service you receive, and the booking confirmation is sent either way.

Your record may have been created by the provider — for example when you book by phone or in person. In that case the data comes from you, given to the provider during that contact, and is exactly what is described in A2, with the same purposes and retention periods.

You have the same rights, and you may ask the provider to show you what is on record (Art. 14 GDPR).

A professional’s public profile may show two different things, and the rules are not the same for both.

The profile photograph is of the professional, and only they may upload it. It depends on their consent, given separately for taking the photograph and for publishing it, and that consent may be withdrawn at any time — the photograph disappears immediately from everywhere it appeared.

The portfolio gallery shows work carried out, and the client may appear in those photographs. For each photograph they publish, the professional declares that whoever appears in it has authorised publication, or that nobody is identifiable. That declaration is recorded with a date. The platform neither collects nor keeps the consent of the person portrayed: it is the provider who obtains it and who answers for it.

The right to one’s image is separate from data protection (Art. 79 of the Portuguese Civil Code) and may be withdrawn at any time. If you recognise yourself in a published photograph and want it taken down, simply ask the provider — the photograph leaves the site as soon as the request is acted on. The time limits and how to go about it are those described in C5 and C7.

Mayara Rosa dos Santos
Sole trader, operating under the Alayah brand
Portuguese tax number (NIF): 246 342 439
Av. 25 de Abril de 1974 40A, 2795-227 Linda-a-Velha
Portugal
E-mail: mayara@alayahsystem.com

Alayah's sales pages may use the Meta pixel (Facebook and Instagram) and the Google Ads conversion tag, to learn which ads bring interested salons. They are only loaded after you click «Accept» in the cookie notice — declining is as easy as accepting and has no consequence. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 5(1) of Portuguese Law 41/2004).

If you accept, Meta and Google receive the page address, your IP address, technical browser data and, when you start a free trial, the plan chosen and its price. Alayah does not send them your name, e-mail or phone number. For the collection, Alayah and each of them are joint controllers; what they do with the data afterwards is their responsibility, under their own policies.

The pixels never load on salon pages, on service booking, in the client area, or in any signed-in area — someone booking a service is never measured for advertising.

When you contact us to learn more about Alayah — through the website, WhatsApp, Instagram or a referral — we keep your name, contact details, the name of your business and the notes of our conversations, to reply to you and follow up on your interest (legitimate interest and pre-contractual steps). Only the Alayah sales team sees this data, and it is deleted after 12 months without contact if you do not become a customer. You can ask us to delete it at any time.

Data is never sold or traded. It is shared only with the suppliers needed for the platform to work, all bound by a processing agreement under Art. 28 GDPR — they process the data only on Alayah's behalf and instructions:

The following also receive data but decide for themselves what to do with it (they are not processors):

Data may also be disclosed to other public authorities where the law requires it.

The database is hosted in the European Union. Some suppliers are US companies or may access data from the United States — Vercel (application hosting), Sentry (technical error logging), Cloudflare (security checks on forms), Upstash (counting attempts) and, only if you accept the advertising pixels, Meta and Google. These transfers rely on the European Commission adequacy decision for the EU-U.S. Data Privacy Framework of 10 July 2023 and, where a supplier is not certified, on standard contractual clauses (Art. 46).

You may request a copy of the applicable safeguards at the e-mail address given in C7.

Data always travels encrypted (HTTPS/TLS) and access to the platform requires authentication, with permissions limited to what each role needs. Consent records do not store the IP address in plain text: they store an irreversible code derived from it. Passwords are stored hashed and never in readable form.

The sign-in forms and the request for an access code to the client area run an automated security check by Cloudflare (Turnstile), which tells people apart from automated programs and stops attempts made in bulk. To do so, Cloudflare receives the IP address and technical signals from the browser — the browser type, for instance, and how the page is used. It does not receive what you type into the form: not the phone number, not the email, not the password. The check is almost always invisible and requires no action from you. The legal basis is legitimate interest in the security of the platform (Art. 6(1)(f)).

In the event of a personal data breach, the supervisory authority is notified within 72 hours (Art. 33) and data subjects are informed whenever the breach is likely to result in a high risk to their rights (Art. 34).

There are two kinds, and only one needs your permission:

• Strictly necessary — the authentication session for people signing in to the platform, and a local record in your browser that remembers your choices so you are not asked again. They are exempt from consent (Art. 5(3) of Portuguese Law 41/2004).
• Advertising — the Meta pixel and the Google Ads tag, only on Alayah's sales pages and only after you accept (see B3). There are no audience-analytics cookies.

If you accepted the pixels and changed your mind, withdraw here — they stop loading immediately:

You may also delete the site's data in your browser settings; deleting the session means you will have to sign in again.

Under the GDPR (Reg. EU 2016/679) you have the right to:

• Access — know what data exists about you and obtain a copy (Art. 15)
• Rectification — correct inaccurate or incomplete data (Art. 16)
• Erasure — the «right to be forgotten» (Art. 17), within the limits of what tax law requires to be kept
• Restriction — suspend processing while a question is resolved (Art. 18)
• Portability — receive your data in a structured, commonly used format (Art. 20)
• Objection — object to processing based on legitimate interests (Art. 21(1)). For direct marketing, including the client groups for campaigns (A3), the right to object is absolute: you only have to ask, with no need to give reasons (Art. 21(2))
• Withdraw consent at any time (Art. 7(3)) — withdrawing is as easy as giving it. Use the link at the foot of any e-mail, reply «STOP» to an SMS, or ask the provider. Withdrawal does not affect what was done beforehand, and does not cancel existing bookings.

You may also use the Right to Erasure page to submit a deletion request.

No automated decisions are taken that produce legal effects or similarly significantly affect you (Art. 22). The only profiling is the client groups for campaigns described in A3, used only to choose who a message is sent to, and which you may object to. Bookings and messages are triggered by simple rules and by human decisions of the provider.

If you booked a service, address your request to the provider. If you prefer, send it to the address below and we will forward it to the controller, telling you that we have done so.

If you use the platform to work, send the request directly to: mayara@alayahsystem.com

We answer without undue delay and in any event within one month of receiving the request. That period may be extended by up to two further months where the request is complex or where several requests are in hand — in which case you will be told of the extension and the reason for it within the first month (Art. 12(3)).

You always have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD).

No Data Protection Officer has been designated, as the conditions in Art. 37(1) GDPR are not met — the activity does not consist of regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data. All privacy matters are handled through the contact given in C7.

This policy may be updated. The version and the date it took effect are shown at the top of the page, and every consent is recorded with the version in force at the moment it was given. Material changes are announced prominently on the site and, where they affect processing based on consent, by e-mail.