Privacy Policy

1. Accountability and scope

The entity operating Zuria is accountable for personal information it holds or entrusts to service providers. Its legal name, address, and privacy officer name or title must be confirmed before publication.

During review, privacy questions and requests may be sent to bonjour@zuria.ca. This policy covers the Zuria website, accounts, profiles, bookings, communications, and related features.

2. Information collected

We may collect account and identity information such as display name, email address, language, account type and status, together with authentication and security data.

For professionals and salons, we may collect biographies, specialties, services, prices, availability, photos, city, business address, place identifier, and map coordinates. Depending on profile settings, the name, city, catalogue, media, prices, and a mapped position associated with the business location may be public.

We may also collect appointment requests, time proposals, statuses, favourites, messages, consents, complaints, audit logs, and, where payments are enabled, transaction references and status. The payment provider handles card details; Zuria does not retain the full card number.

Technical data may be collected automatically, including IP address, browser, device, language, viewed pages, timestamps, errors, and security events. Device geolocation is used only following the person’s action or permission.

3. Sources

Information comes mainly from you when you create an account, complete a profile, add media, search, request an appointment, or contact us.

It may also come from the other party to a booking, technical providers, Google Maps when an address or city is selected, Stripe when a payment is made, or be generated by Zuria, such as a booking status, approximate distance, or security log.

4. Purposes

We use information to create and secure accounts; display profiles and catalogues; provide location search; manage availability, requests, confirmations, and communications; process payments and refunds where enabled; provide support; prevent fraud and abuse; moderate content; comply with law; and improve service reliability and accessibility.

We do not use sensitive information or precise location for behavioural advertising. Any incompatible new purpose or commercial messaging must use the notices and consent required by law.

5. Consent and choices

Where consent is required, it must be clear, free, informed, specific, and requested in plain language. Separate consent is sought when required by the sensitivity of the information or purpose.

You may withdraw consent for future use, subject to legal or contractual restrictions. Withdrawal may prevent a feature that necessarily relies on the information, such as searching near your device. Privacy settings should default to the highest applicable protection.

6. Sharing and public profiles

We share only information needed for the relevant interaction. A client can view a professional’s public information, and parties to a request may receive details needed for the appointment. Private contact details should not be public without an appropriate basis and notice.

Content voluntarily published on a profile is accessible to visitors and may be indexed after legal approval of the site. Do not publish information you do not want public. Professionals must have consent from identifiable people shown in photos.

7. Providers and transfers outside Québec

Providers may include Supabase for database and authentication, Vercel for hosting, Google Maps for maps and autocomplete, Stripe for payments, and Resend for email. They process information according to their roles, contracts, and privacy terms.

Some processing may occur outside Québec or Canada. Before a transfer subject to Québec law, Zuria must complete the required privacy impact assessment, determine that adequate protection will apply, and enter into an appropriate written agreement. The final provider list, hosting regions, and assessments must be confirmed before publication.

8. Retention and disposal

We retain information only as long as needed for the stated purposes, then securely destroy or anonymize it. Different periods may apply to active accounts, bookings, transactions, communications, complaints, security logs, and tax obligations.

The final retention schedule, operational deletion periods, and backup duration must be approved and implemented before this policy is published. Closing an account does not immediately remove information that must be retained for law, payment, fraud, complaint, or dispute purposes.

9. Security and incidents

We use administrative, technical, and physical safeguards proportionate to sensitivity, including access controls, authentication, encrypted communications, role separation, logging, backups, and error monitoring.

No safeguard eliminates all risk. Following a privacy incident, Zuria must take reasonable steps to reduce harm, correct the issue, maintain the required register, and notify affected individuals and the Commission d’accès à l’information where there is a risk of serious injury.

10. Cookies and similar technologies

Zuria uses cookies and storage mechanisms needed for authentication, security, language, session continuity, and site operation. They must not be used for behavioural advertising without appropriate consent.

Google Maps may receive technical data, including IP address and browser information, when its features load or are used. Non-essential preferences and any future analytics tool must be presented through a compliant consent mechanism before activation.

11. Your rights

Subject to legal exceptions, you may request access, correction, withdrawal of consent, cessation of dissemination or de-indexing where provided by law, and disclosure in a structured, commonly used technological format where portability applies.

You may also request account closure and deletion of information no longer required. We may verify identity and explain a refusal. Complaints may be made to the privacy officer and then to the Commission d’accès à l’information du Québec or the competent authority.

12. Children and minors

Zuria does not knowingly seek to collect a child’s information without required authorization. Age, parental consent, and appointment participation rules must be confirmed by legal counsel and implemented in the product before public launch.

13. Changes and contact

Material changes will be announced by reasonable means before taking effect. Version and update dates will be retained so individuals can understand the changes.

To exercise a right or ask a question, contact bonjour@zuria.ca. Before publication, this section must include the privacy officer’s name or title, the company mailing address, and the internal request-handling procedure.