Who we are
Clea (clea.studio, app.clea.studio and the Clea apps) is run by Nedo Ereš, Threeca Agency, Metković, Croatia.
Contact for anything privacy related: hello@clea.studio
Two roles. For artists who use Clea and people who apply to join, we decide how their data is used (we are the controller). For the clients who send a booking request to an artist, the artist decides how that data is used and Clea processes it on her behalf (we are the processor).
What we collect
Artists using Clea
- Name, business name, e-mail address and password (stored as a secure hash, never in plain text).
- Settings for your site and diary: services, prices, how you address clients, colours, photos you send us.
- Bookings and notes you add to your diary, closed days, tasks and earnings figures.
People who apply to join
- Instagram handle, name, city, how many clients you see, an optional note, e-mail and phone number.
Clients who send a booking request to an artist
- Name and phone number; e-mail address if you give it.
- The details of the appointment: service, date and time, location, number of people, whether you want a trial, lashes, and anything you write in the notes.
- Allergies, only if you choose to mention them. This is used solely so the artist can choose suitable products, and is shared with no one else.
We do not use analytics, advertising trackers or tracking pixels, and we do not sell personal data.
Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Running an artist's account, site, booking form and diary | Contract with the artist |
| Passing a booking request to the artist and sending the client a confirmation | Steps taken at the client's request before an appointment; for the artist, her legitimate interest in running her business |
| Allergy information | The client's explicit consent, given by choosing to write it |
| Reviewing applications to join Clea | Steps taken at the applicant's request |
| Security, fixing errors and keeping records we are required to keep | Legitimate interest and legal obligation |
Who helps us run Clea
We use a small number of service providers. Each only gets the data it needs to do its job.
| Provider | What for |
|---|---|
| Supabase | Database and sign-in: accounts, bookings, applications |
| Netlify | Hosting of clea.studio, the app and artists' sites |
| Resend | Sending booking confirmations to clients by e-mail |
| EmailJS | Sending the artist an e-mail when a new booking request arrives |
| ImprovMX | Forwarding e-mail sent to @clea.studio addresses |
| Google Fonts, jsDelivr | Loading fonts and page components; these see your IP address when a page loads |
| Apple, Google | Delivering push notifications to the Clea app |
Some of these providers are based in or use servers in the United States. Where data leaves the European Economic Area, it is protected by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
When an artist replies to a client with the WhatsApp button, WhatsApp opens on the artist's own phone with a written message. The message is sent by the artist through WhatsApp, under WhatsApp's own terms.
On your device
Clea stores a few things in your browser or app: whether you are signed in, and small preferences such as light or dark mode. These are needed for Clea to work. We do not use advertising or tracking cookies, so there is no cookie banner.
How long we keep it
- Artist accounts and their diaries: while the account is active, then deleted within 30 days of closing it.
- Booking requests: until the artist deletes them, or until her account is closed.
- Applications to join: up to 12 months, then deleted.
- Invoices: as long as Croatian law requires.
Your rights
You can ask to see the data we hold about you, correct it, delete it, receive a copy, or object to or limit how it is used. If you gave consent, you can withdraw it at any time.
If you sent a booking request to an artist, it is simplest to contact her first, since she controls those bookings. You can also write to us at hello@clea.studio and we will help. We reply within 30 days.
You can also complain to the Croatian data protection authority, AZOP (azop.hr), or the authority in your own country.
Security
All connections to Clea are encrypted. Each artist can only see her own bookings, passwords are stored as secure hashes, and access to our systems is limited to the people who run Clea.
Children
Clea is not intended for anyone under 16.
Changes
If we change this policy, we will update the date below and tell artists using Clea by e-mail.