Privacy Policy

The controller of the personal data collected on the Teaser platform (accessible via teaser-schedule.app and the *.t-s.app subdomains) is:

Depending on your capacity (a professional using the platform or an end client booking a service), we collect different categories of data:

Professionals (platform users)

• Identification data: business name, manager's name, email address, phone number, postal address, town, sector of activity (niche).
• Account data: login identifier (email), password (stored exclusively as a bcrypt hash with 12 rounds, never in clear text), Google identifier (if you sign in with Google OAuth).
• Billing data: handled directly by Stripe. We store only your Stripe customer identifier and your subscription status. We never have access to your card numbers.
• Instagram data: if you activate the Instagram Bot module, we access your professional direct messages via the official Meta API (to run the automated reply bot) and your account statistics (reach, impressions, followers). Instagram access tokens are encrypted with AES-256-GCM.
• Editorial content: text, images and settings of your professional website, service settings, opening hours and booking configuration.

End clients (people booking a service)

• Contact data: surname, first name, phone number, email address.
• Booking data: date, time, service booked, add-ons, appointment status, visit history.
• Loyalty data: number of stamps or points accrued, rewards obtained (where the loyalty programme is enabled by the professional).

Data collected automatically

• Browsing data: pages visited, traffic source (UTM parameters), device type, browser, session duration. This data is collected via an anonymous identifier (visitor hash) with no third-party cookie.
• Event data: interactions with the site (clicks on action buttons, progress through the booking funnel, scrolling). This data is anonymised and used solely for statistical analysis.

We never sell your personal data. It may be shared with the following sub-processors, solely in order to provide the service:

Some of our sub-processors (Stripe, Vercel, Meta, OpenRouter) are located in the United States. These transfers are governed by:

• The EU-US Data Privacy Framework (the European Commission's adequacy decision of 10 July 2023) for certified sub-processors.
• Standard contractual clauses (SCCs) approved by the European Commission for other cases.

The databases containing your business data are hosted exclusively within the European Union (Turso, eu-west-1 region, Ireland).

In accordance with the GDPR (Articles 15 to 22) and the French Data Protection Act, you have the following rights:

• Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request the deletion of your data (subject to statutory retention obligations).
• Right to portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to the processing of your data on grounds relating to your particular situation.
• Right to restriction: to request the suspension of processing in certain cases provided for by law.
• Withdrawal of consent: to withdraw your consent at any time for processing based on it (without affecting the lawfulness of prior processing).

To exercise your rights, contact us at privacy@teaser-schedule.app. We respond within 30 days.

You also have the right to lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr.

Teaser uses two strictly necessary first-party cookies:

A session cookie (__ts_utm) is also used to track the traffic source during the browsing session. It expires when the browser is closed.

No third-party cookie, no Google Analytics, no advertising tracker and no retargeting tool is used on the platform.

We implement the following security measures to protect your data:

• Encryption in transit: all communications are protected by HTTPS/TLS.
• Passwords hashed with bcrypt (12 rounds). No password is stored in clear text.
• Instagram access tokens and API keys encrypted with AES-256-GCM at rest.
• Per-tenant data isolation: each professional has their own database, physically separated from the others.
• Rate limiting on authentication endpoints and public APIs.
• CSRF protection on login forms.
• HTTP security headers: Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy.
• Logging of access and sensitive operations (audit logs).
• Invisible anti-bot protection (Cloudflare Turnstile) on the login, signup and password-recovery forms — no interaction required, no tracking cookie.

To learn more about how this component processes data, see the Cloudflare Turnstile Privacy Addendum.

We reserve the right to amend this privacy policy at any time. In the event of a substantial change, we will inform you by email or by a notification in your workspace at least 15 days before the changes take effect.

The date of the last update is shown at the top of this page.

For any question regarding the protection of your personal data or to exercise your rights, contact our data protection officer: