Privacy and data
Effective from 2026-10-21. Version 2026-10-21. This policy accompanies the terms of use and explains personal data processing. Terms of use 2026-10-21.
Data Controller
Aestelix · 68.713.364 CRISTIAN EDUARDO GARCIA HURTADO
CNPJ: 68.713.364/0001-52 · Belém – PA, Brasil
hello@aestelix.com
Aestelix may process account data, users, workspace, settings, clients, appointments, services, resources, packages, accounting movements, system activity, technical notes, consent records and data needed to operate the schedule.
Some features may include allergies, contraindications, aesthetic notes, progress, before/after images or consent records. These should be recorded only when needed for the service and with clear information to the client.
Data is used to authenticate users, separate each workspace, manage appointments, clients, services, team members, packages, traceability, operational accounting, security, support and experience improvements.
Aestelix acts as controller for account data, security and preferences of its own service. For client data entered by a center to provide its services, the center determines the purposes and Aestelix acts on its instructions as processor or operator under the applicable contract and law. Centers must inform clients and establish the necessary legal grounds; Aestelix retains its own security and assistance obligations.
The app uses authentication, roles, permissions, access rules and workspaceId to separate each center's information. Each administrator must carefully manage invited users, assigned permissions and devices used.
Before requesting center deletion, administrators can export data in Settings. Deletion has a 30-day grace period; requests during that period go to hello@aestelix.com. Deleting a client profile includes its records, consents and files; historical transactions are handled separately. Retention obligations and provider copies must be assessed for each request.
Depending on enabled features, we use Google/Firebase, Vercel, Resend, Meta or Twilio for WhatsApp, LabsMobile for SMS, Stripe, Mercado Pago for Pix in Brazil and PostHog for diagnostics (section 15). Entities, processing locations and safeguards depend on each service. Request information at hello@aestelix.com.
Individuals may exercise rights available under applicable law, including information, access, correction, deletion, objection, restriction, portability or withdrawal of authorizations where applicable, and complain to the competent authority. Centers handle requests about their clients with Aestelix's assistance. For data processed directly by Aestelix, contact hello@aestelix.com. Withdrawing optional permissions does not prevent use of the service.
Optional Google Contacts import requests read permission through OAuth to add names and phone numbers to the center directory in Firestore. These are not used for advertising, commercial profiling or AI training. Infrastructure providers necessary for the service participate in processing. Diagnostic masking and filters aim to prevent capturing this content. You can revoke access in your Google account and request access to or deletion of imported data.
The use of raw or derived user data received from Google APIs by Aestelix will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Aestelix uses Google Contacts data solely to import clients into the center's workspace and for no other purpose. Data received from Google APIs is not shared, sold, or transferred to any third-party artificial intelligence service.
AI features advertised as forthcoming do not mean that client data is sent to an AI provider. Before introducing such processing, we will describe its purpose, provider, data and applicable controls. General acceptance of terms does not by itself authorize sending sensitive data or imported contacts to external models.
Channels depend on center configuration: WhatsApp through Meta or Twilio, SMS through LabsMobile and email through Resend. Transactional notices and marketing have separate permissions. Birthday and return messages are sent only when enabled and the corresponding permission exists. Necessary message data is transmitted. You can change preferences using available mechanisms or contact the center; opt-outs apply to the relevant channel and purpose.
Technical providers may process data outside the user's country, including the United States. Applicable transfer mechanisms and safeguards must be established for each case, such as adequacy decisions or contractual clauses valid in the originating jurisdiction, alongside provider obligations. A European contract does not automatically replace Brazilian or other countries' requirements. Request information about providers, destinations and safeguards at hello@aestelix.com.
The legal basis is assessed by purpose and jurisdiction: service delivery, applicable obligations, security, diagnostics and advertising. Advertising measurement requires an affirmative choice. Diagnostics described in section 15 do not depend on that advertising choice; their basis and objection requests are assessed separately. Accepting terms does not authorize capturing sensitive data for analytics.
We use PostHog to measure navigation and detect errors on the website, app and booking pages. It remains active independently of advertising choices. We mask fields and business content, block media and remove private URL parameters; reviewed fixed labels may remain visible. Browser and, after sign-in, account/center identifiers are used without names or email addresses. The SDK may store browser identifiers. Request information, access, objection or erasure at hello@aestelix.com.
This policy applies to people using Aestelix in markets where the service is offered. Mandatory rules applicable to each processing activity and individual apply, including, where relevant, the GDPR and European national privacy rules, Brazil's LGPD, and data protection laws in Colombia and other Latin American countries or regions. These references do not certify universal compliance or limit local rights. Contact hello@aestelix.com about your circumstances.