Privacy Policy
This policy explains what information Yuna handles, why we need it, who helps us process it, and the choices available to account holders and their clients.
1. Scope and privacy roles
This Privacy Policy describes how SNA Labs Corp. (“SNA Labs,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information through Yuna and its related websites, applications, and services (collectively, the “Service”).
Beauty professionals and businesses use the Service to manage their practices. For account, billing, support, and website information, SNA Labs determines why and how information is handled. For information a professional enters about a client, the professional generally determines why it is collected and used, and SNA Labs processes it to provide the Service on the professional’s behalf.
2. Information we collect
The information we handle depends on the features you use and may include:
- Account and business information: name, email address, authentication identifiers, business details, preferences, and subscription status
- Client and appointment information: names, contact details, appointment details, intake answers, consent forms, health and treatment information, treatment history, notes, photos, alerts, and follow-up information entered by a professional or submitted through a public form or booking flow
- Content and communications: messages, uploaded files, audio submitted for transcription, support requests, and notification preferences
- Billing information: subscription and purchase history and transaction details. Payment-card data is handled by Stripe, and App Store or Google Play purchases and subscription entitlements are handled by Apple or Google and RevenueCat. We do not store full payment-card numbers on our servers
- Technical information: IP address, browser and device information, device identifiers, approximate or coarse location derived from IP address, timestamps, diagnostic logs, and activity needed to secure, operate, and troubleshoot the Service
- Analytics information: product interactions, screens and features used, session activity, app version, and related device information used to understand and improve the Service
3. Where information comes from
We receive information:
- Directly from account holders and authorized team members
- From clients who complete forms, request appointments, or respond to communications sent through the Service
- Automatically from browsers, devices, and Service activity
- From providers involved in authentication, payments, analytics, communications, and integrations
4. How we use information
We use personal information to:
- Provide, personalize, maintain, and support the Service
- Authenticate users and protect accounts and client information
- Manage subscriptions, payments, usage limits, and billing support
- Process notes, forms, appointments, reminders, follow-ups, and other actions requested by users
- Provide AI-assisted summaries, insights, and chat features
- Communicate about transactions, security, support, and material Service changes
- Monitor reliability, prevent misuse, investigate incidents, and comply with legal obligations
- Analyze product interactions, feature adoption, and performance to understand and improve the Service
- Enforce plan, free-allowance, trial, credit, and promotional eligibility, including detecting attempts to obtain additional benefits by creating, deleting, or recreating accounts
- Improve the Service using feedback and aggregated or de-identified information where appropriate
We collect, use, and disclose personal information only for purposes that are reasonable and appropriate in the circumstances, or as otherwise permitted or required by law.
5. Analytics and device storage
The Service uses cookies and similar browser storage that are necessary for authentication, security, theme preferences, saved drafts, and other requested functionality. Blocking essential storage may prevent parts of the Service from working.
On the web, Amplitude analytics is optional and starts only after you accept. It measures reviewed marketing page visits, primary CTA clicks, approved acquisition sources and campaigns, signups, onboarding, activation, and subscriptions. We use a pseudonymous browser identifier, not your name or email; when you sign in, consenting activity can be linked to your account ID. Analytics does not include client records, messages, session notes, or arbitrary page URLs. Autocapture, session replay, advertising pixels, and cross-site tracking are disabled.
Consented first-visit attribution and the browser identifier last up to 90 days. A necessary preference cookie remembers acceptance or rejection for 180 days; a changed consent version requires a new choice. Use Analytics preferences on any page to reject or withdraw consent. This stops optional browser delivery and clears applicable analytics storage. When signed in, the preference is saved to your account and also gates optional server analytics, including background conversion events. Necessary authentication and application storage are unaffected. Previously delivered events are not removed by withdrawing consent. Reports cover only consenting, observable activity; missing events do not prove that a page was not visited.
Amplitude can also receive device and app information and derive approximate location from network IP addresses. We use analytics to understand usage, diagnose performance issues, and improve features. We do not use this information for third-party advertising or cross-app tracking.
We do not currently use third-party advertising cookies or sell personal information for targeted advertising.
7. AI-assisted processing
If you allow AI data sharing and invoke an AI feature, Yuna may send information to OpenAI that is reasonably needed for the request, including messages, prompts, relevant conversation history, voice recordings submitted for transcription, photos, documents, other attached files, and relevant client, appointment, business, and form details.
OpenAI processes this information to provide assistant responses, transcription, form editing, business guidance, and business intelligence. You may decline or revoke permission; AI features will remain unavailable unless you accept the current disclosure, while non-AI features remain available.
Our production OpenAI organization and project use Zero Data Retention for supported requests, subject to OpenAI's documented safety, legal, and endpoint-specific exceptions.
We do not use Customer Content to train general-purpose AI models for third parties. AI providers process information under their applicable business or API terms and our arrangements with them.
8. Processing outside Canada
We and our service providers may process or store personal information in Canada and the United States for hosting, authentication, payments, analytics, communications, support, security, and AI-assisted features. Information processed in another country may be accessible to courts, law enforcement, or national-security authorities under that country’s laws.
Contact our Privacy Officer using the details below if you have questions about our policies and practices for service providers outside Canada.
9. Retention and deletion
We retain personal information only for as long as reasonably needed to provide the Service, complete transactions, maintain security and business records, resolve disputes, and meet legal obligations. Retention periods vary based on the information, its sensitivity, and why it is needed.
When account deletion is processed successfully, we remove the login, associated active account records, and stored files. We do not add a post-deletion holding period for that active account data. You can request deletion of your Yuna account and associated data without reinstalling the app or signing in.
Limited copies may remain in infrastructure-provider backups or operational logs until they expire under the provider’s retention settings. Billing providers and app stores may retain billing and purchase records under their own policies and legal obligations. These periods depend on the provider and record and are separate from Yuna’s active account deletion. Contact our Privacy Officer for help with a provider-held record.
10. Safeguards
We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, authentication protections, encryption in transit, logging, and security monitoring where appropriate to the sensitivity of the information.
No system is completely secure. Account holders should use strong, unique credentials, restrict account access to authorized people, and notify us promptly about suspected misuse.
11. Your rights and choices
Depending on applicable law and our role in handling the information, you may ask to:
- Access personal information about you and understand how it has been used or disclosed
- Correct inaccurate or incomplete personal information
- Withdraw consent where processing depends on consent, subject to legal or contractual limits and reasonable notice
- Delete information, subject to lawful retention requirements and other permitted exceptions
- Unsubscribe from optional marketing communications while continuing to receive necessary account and service messages
We may need to verify your identity before completing a request. If SNA Labs is processing information on behalf of a beauty professional, we may direct the request to that professional or assist them in responding.
If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta or another privacy regulator with jurisdiction over the matter.
12. Children and minor clients
Yuna accounts are not intended for anyone under 18. A beauty professional may enter information about a minor client when legally permitted and is responsible for obtaining any required parent or guardian authorization and providing appropriate privacy notices.
13. Changes to this policy
We may update this policy as the Service or legal requirements change. We will post the revised policy, update the effective date, and provide additional notice or obtain consent when required for a material change.
14. Contact our Privacy Officer
Send privacy questions, requests, or complaints to:
Privacy Officer, SNA Labs Corp.
privacy@getyuna.app
Please do not include sensitive client information in an unencrypted email. We may request additional details through a more appropriate channel.