Last updated: 30 October 2026 · Version française. This is a translation; if the two differ, the French version prevails.
1. Who is responsible for your data
The data controller is SEINSIGHTS SARL, 14 chemin du Planschewasen, 68470 Fellering, France (SIREN 814 695 326, RCS Mulhouse). For any question about personal data: contact@zenpage.app.
Two situations apply:
- Your practitioner data (your account, your website, your subscription): SEINSIGHTS is the data controller.
- Your clients' data (bookings, contact details) entered or collected through your Zenpage website: you are the data controller and SEINSIGHTS acts as your processor, on your behalf and according to your instructions.
2. Data collected
Practitioners: name, e-mail address, phone number, country, password, business name and address, practice chosen at sign-up, website content (texts, photos, services, opening hours), subscription and billing data (payment is handled by Stripe; SEINSIGHTS never receives or stores your card number), technical logs (IP address, date and type of connection).
Practitioners' clients: name, e-mail, phone number, booked service and time slot, any message or note entered when booking.
Visitors: technical browsing data (IP address, browser, pages visited) and the cookies described below.
3. No health data
Zenpage is reserved for unregulated wellbeing practices and is not designed to host health data. The services offered are wellbeing support and do not replace a medical act or diagnosis. Practitioners undertake never to record health or sensitive data in the service, including in follow-up notes (each save requires a certification to that effect); clients are asked not to enter medical information in free-text fields (booking notes, messages). SEINSIGHTS may remove content that breaks this rule.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, provide the service | Performance of the contract |
| Invoice, collect payments, keep accounts | Performance of the contract, legal obligation |
| Send service e-mails (confirmation, verification, alerts, appointment reminders) | Performance of the contract |
| Ensure security, prevent fraud and abuse, check that the practice is eligible | Legitimate interest |
| Answer your contact and support requests | Legitimate interest |
| Audience measurement and non-essential cookies, where applicable | Consent |
| Providing the professional address and forwarding replies to the practitioner’s verified receiving address | Performance of the contract for the service provided to the practitioner; processing client messages on the instructions of the practitioner, who acts as controller. |
5. Recipients and processors
Your data is never sold or shared for advertising. Only authorised SEINSIGHTS staff and processors strictly necessary for the service can access it:
- PlanetHoster: hosting of the website and database;
- Stripe: payment of subscriptions and, if you enable them, of your clients' bookings;
- E-mail delivery provider: delivery of service e-mails;
- hCaptcha (Intuition Machines): protects the zenpage.app contact form against bots; it receives the IP address and technical browser data of the person submitting the form;
- Google (STUN connection server), OVH (Zenpage's TURN relay server, in France) and, as a fallback, Metered (TURN relay server): used only by Zenpage video calls, see below;
- Services that you choose to enable: Google (sign-in, calendar, video conferencing), OpenAI (document generation), UltraMsg (WhatsApp messages). They only receive data if you enable them.
Zenpage video calls. When a practitioner offers sessions in the Zenpage video room, video and sound travel directly from one browser to the other. They are encrypted by the browser (DTLS-SRTP) and never recorded. To set up the call, Google's connection server (STUN) sees the participants' IP addresses. If the network blocks a direct connection (mobile network, corporate firewall), the stream goes through Zenpage's relay server (TURN), hosted by OVH in France, or as a fallback through Metered's. The relay also sees the IP addresses but only forwards an encrypted stream it can neither read nor record. Neither Google, OVH nor Metered has access to the video or sound.
Some of these providers are located outside the European Union, in particular in the United States. Such transfers are covered by the safeguards provided by the GDPR (adequacy decision or standard contractual clauses).
Professional email relay. PlanetHoster/N0C operates the technical receiving mailbox; UniOne delivers outgoing and relayed messages. The final recipient is the verified receiving address selected by the practitioner. Messages, attachments and the contact details required for delivery pass through these providers.
6. Retention periods
- Account data and website content: for the lifetime of the account, then deleted within 12 months after it is closed, unless the law requires longer retention.
- Accounting records and invoices: 10 years.
- Technical logs: 12 months at most.
- Technical messages used to set up a Zenpage video call: deleted within 2 hours. Video and sound are never kept.
- Your clients' booking data: kept on your behalf as long as your account exists, and you can delete it from your dashboard. It is up to you to set and respect a retention period suited to your activity.
Professional email relay retention. The application does not archive message content. Messages remain temporarily in the technical mailbox until accepted for onward delivery. Failed deliveries may be retried for up to 24 hours after receipt; messages awaiting verification of a receiving address may be held for up to 48 hours after receipt. These periods depend on the relay running. Technical logs are retained for 30 days and contain the date, alias identifier, outcome, technical reason, size and a hash of the sender, without the subject, body, attachments or plain-text addresses. So the practitioner can check delivery, Zenpage also keeps for 30 days, for each message received on their alias, the date, the sender's name and email address and the delivery status, visible to that practitioner only, without the subject, body or attachments. Contact form on practitioners' sites: the message is e-mailed to the practitioner and Zenpage does not keep its content; only the date, name, e-mail address and phone number provided are kept for the practitioner's history while their account is active. Messages delivered to the practitioner's mailbox follow that practitioner's retention rules.
7. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, to withdraw your consent at any time and to set instructions for what happens to your data after your death. To exercise these rights, write to contact@zenpage.app describing your request; proof of identity may be requested if there is any doubt. We reply within one month.
If you are a practitioner's client, contact the practitioner first, as they are the data controller: we will help them answer your request. You may also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
8. Security
SEINSIGHTS applies reasonable technical and organisational measures to protect data: encrypted connection (HTTPS), restricted access, backups. No measure guarantees absolute security. In the event of a data breach that poses a risk, SEINSIGHTS informs the CNIL and the people concerned as required by law.
9. Cookies
Zenpage uses cookies that are strictly necessary for the service to work (login session, security, preferences). They do not require consent. Any audience measurement or third-party content cookies (for example an embedded video) are only set after you agree, through the cookie banner, which you can reopen at any time. You can also refuse or delete cookies in your browser settings; some features may then no longer be available.
10. Changes
This policy may change. The version in force is the one published on this page, with its update date. Significant changes are notified to registered users.