Privacy policy

Last updated: [TO COMPLETE: date].

1. Data controller

Zahir Wellness, 60 rue François 1er, 75008 Paris — hello@zahirwellness.com.

2. Data collected

Identity and contact details, order and payment data (card data is handled directly by Stripe, never stored by us), account credentials, and any health data you choose to share via our forms or appointment booking.

3. Purposes and legal bases

Order fulfilment (contract); account and customer service (legitimate interest / contract); booking and support involving any health data, processed on the basis of your explicit consent (Art. 9 GDPR); communications, only with your consent.

4. Retention

Data is kept only as long as necessary for the stated purposes. [TO COMPLETE: precise durations.]

5. Recipients and processors

Stripe (payment), Vercel (site hosting), Supabase (database), our email provider and carriers. [TO COMPLETE.]

6. Transfers outside the EU

Some providers are located outside the EU (notably in the USA); transfers are covered by appropriate safeguards (EU standard contractual clauses).

7. Your rights

Access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent at any time — hello@zahirwellness.com. You may also lodge a complaint with the CNIL (cnil.fr).

8. Cookies

This site uses only strictly necessary cookies (cart, session, country/currency preference). It sets no advertising or third-party analytics cookies. Should any be added later, a consent banner allowing you to refuse as easily as to accept would be implemented, with no non-essential tracker set before your choice.