Privacy Policy — EstheticSense

This Privacy Policy explains how Zeurix, LLC, a Virginia limited liability company that operates EstheticSense ("EstheticSense", "we", "us"), collects, uses, discloses, and protects information when you use our websites, currently available software, and related services (collectively, the "Service").

1. Scope and roles

EstheticSense provides software to spas, salons, and medspas. In many cases, businesses using EstheticSense decide what client data is entered into the Service and how it is used. In those cases, the business is the data controller and EstheticSense acts as a service provider/processor.

2. Information we collect

Information you provide directly. For example: name, email, phone number, business details, and messages submitted through support or sales requests.
Account and tenant information. User profile details, role/permission metadata, and organizational account settings.
Operational service data. Scheduling, staff, client, and transaction records; treatment notes and health details; completed intake and consent forms, including signatures; client photos; and private messages and attachments. We collect this content when businesses, their staff, or clients enter, submit, or upload it through the Service.
Usage and device data. Log events, device/browser details, IP address, app version, and diagnostic signals used to maintain reliability and security.

Connected Facebook and Instagram accounts

When you authorize a Facebook or Instagram connection, we receive the account and Page identifiers, names, linked professional Instagram profile information, granted permissions, and access credentials needed for the connection. We use them to show the accounts you can manage and carry out the actions you approve. A publishing request sends your selected image, caption and image description to Meta; we store the draft and resulting publication status, post identifier and link.

Disconnecting in Settings → Integrations stops use of that connection in EstheticSense. It does not remove posts already published on Facebook or Instagram, or automatically delete drafts and business records stored here. These records follow the retention rules below. To request deletion of data received from Meta, follow our data deletion instructions.

Connected Google accounts

Your Google account. When you connect a Google service, you sign in with the Google account that manages it. Google tells us your Google account identifier and your email address, or your name if no email is provided, and we use them to label the connection in EstheticSense. We do not receive your Google password and we do not store your Google profile photo.

Google Business Profile. When you connect a Business Profile, you grant EstheticSense permission to manage it. We use that permission to read your listings and reviews and, only when you send one, to post your reply; nothing else. First we read the Business Profile accounts you can manage, your role and permissions in each, and the locations under them (name, store code, city, state and country, open status, and whether the location is verified or marked as a duplicate), so you can choose the right listing. We keep identifiers, display labels and connection status for those accounts and locations.

Then we read the reviews of the location you choose: the reviewer's display name and profile photo link, star rating, comment, dates and your reply, and we keep a copy of each review record Google returns. We store these so your team can see reviews in EstheticSense, and we also use them to show your business's review counts, ratings and reply statistics. While your connection is active, we refresh reviews daily and when you ask, and a review Google no longer returns is removed on the next refresh. We store a Google refresh token, encrypted, to run that refresh. The one thing we write to your Business Profile is a reply you send from EstheticSense: when you press Send on a review, your words are posted to Google exactly as you typed them. We never post, reply or edit anything on your profile on our own.

Who sees it. Within EstheticSense, your team can see Google reviews according to their permissions. If you choose a review for your website, the details described in section 4 become public. We do not combine Google data across businesses, we do not send it to artificial-intelligence services, and we do not use it for advertising. We share information received from Google APIs only as described in this policy and as Google's policy allows, and we will ask for your explicit consent before transferring it as part of a merger, acquisition or sale.

Disconnecting. Disconnecting in Settings → Integrations stops future access through that connection, deletes the reviews and locations we imported for it, and drops the stored token. We ask Google to remove our access unless another active connection uses the same Google account; you can also remove EstheticSense yourself under Third-party apps & services in your Google Account. Testimonials you chose for your website stay until you remove them. The connection record itself is kept under the retention rules below, and you can request its deletion under our data deletion instructions.

EstheticSense's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In the EstheticSense iPhone app

The iPhone app is the same product for the business's team. In addition to the information above, it uses these device features only when you use the matching part of the app, each behind the permission the phone asks for:

Camera and photo library to photograph receipts, add client photos and images for services and gift cards, and attach photos to messages.
Face ID (or the phone's passcode) to unlock client records and to confirm that a team member is taking the phone back after a client has filled in a form on it. The phone does the check; the app learns only whether it succeeded, and no face data reaches the app or us.
Notifications, if you turn them on, to send alerts such as appointment updates and new messages to that phone. A push token identifies the device, and signing out stops push to it.
Bluetooth, local network and location to find and connect a supported card reader for in-person payments. The card-reader software from our payment processor, Stripe, asks for location permission and uses the phone's approximate location when you connect or use a reader. The app itself does not read or store your location and does not collect your precise location.

Device model, operating system version, app version and crash and usage events are collected to keep the app working.

3. How we use information

Provide, secure, and improve the Service.
Authenticate users and enforce tenant-level access controls.
When the corresponding Service features are enabled, store and display submitted client records and completed forms, support appointment and treatment administration, and process messages between businesses and their clients.
Deliver customer support and service communications.
Monitor performance, investigate incidents, and prevent abuse.
Comply with legal, tax, and regulatory obligations.

We do not sell personal information. We may disclose information to:

Service providers that host infrastructure, process payments, deliver communications, and support analytics or security operations.
Authorized business users within a customer tenant, based on configured permissions.
Authorities or legal requestors when required by law, court order, or valid legal process.
Successors in connection with a merger, financing, acquisition, or asset sale.
Your own website, at your direction. If you choose to show a Google review on your EstheticSense website, we publish its text, its star rating, a "Google" label and the reviewer's first name and last initial, or the name you enter. The reviewer's photo, the link to the review and your reply are not published. We record who selected the review and when. To take a review off your live website, remove it from your selected testimonials and publish your changes.

We require third-party service providers that receive personal information, including notification and diagnostic SDK providers, to provide the same or an equal level of protection as described in this policy. Their applicable service agreements and data-processing terms require confidentiality and appropriate technical and organizational safeguards. Some providers also process certain information for their own security, fraud-prevention, service-improvement, and legal-compliance purposes under their privacy policies.

Purchases made through Apple's App Store or Google Play are processed by Apple or Google under their own terms and privacy policies; we receive the purchase and subscription status, not your card details. Card payments taken in the apps, including payments on a connected card reader, are processed by Stripe.

5. Data retention

We retain data for as long as needed to provide the Service, support legitimate business purposes, comply with law, resolve disputes, and enforce agreements. Retention periods vary by data type.

Reviews and locations received from Google are kept only while their Google connection is active: a review Google no longer returns is removed on the next daily refresh, and disconnecting deletes the rest. Testimonials you chose for your website stay until you remove them. Your Google connection record is deleted through the business closure process described on our account deletion page, which also ends our access at Google, or when you ask us to delete it.

6. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. No security control is perfect, and no system can guarantee absolute security.

7. Your rights and choices

Depending on your jurisdiction, you may have rights to request access, correction, deletion, or restriction of processing. If your data was collected by a business using EstheticSense, please contact that business first.

8. Account deletion

Account deletion instructions are available at account deletion instructions. If you are a client of a business using EstheticSense, deletion of your profile/appointment data should be requested from that business.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

10. Changes to this policy

We may update this Privacy Policy periodically. Material changes are effective when posted with a revised "Last updated" date.

11. Contact us

For privacy-related questions, contact support@estheticsense.io or visit our help center.