Privacy Policy
Last updated: October 8, 2026
1. Introduction
Qleven is a SaaS (Software as a Service) platform designed for the comprehensive management of beauty, aesthetic, and health centers. Our platform provides tools for appointment scheduling, client management, billing, marketing, analytics, and Smart Control for equipment.
How QLEVEN LLC (Qleven) collects, uses, stores and protects personal data across the platform and its WhatsApp Business API integration.
This policy applies to all users of the Qleven platform, including center managers, professionals, administrative staff, and end recipients of communications sent through our platform.
2. Data controller
QLEVEN LLC is the controller of visitor, contact, business account and billing data processed for its own purposes. For patient and client data managed by each centre in Qleven, the centre is the controller and Qleven acts as a processor under the applicable data processing agreement.
QLEVEN LLC
407 Lincoln Road, Suite 708, Miami Beach, FL 33139, USA
Email: contact@qleven.com
Privacy contact: contact@qleven.com
3. Data we collect
3.1 Account data
Full name, email address, phone number, role within the center (administrator, professional, receptionist), information related to the center or clinic (name, address, tax identification number).
3.2 Usage data
Features used, configuration preferences, session logs (login/logout dates, duration), interactions within the platform.
3.3 Technical data
Browser type and version, IP address, operating system, device identifiers, approximate geolocation data (country/region derived from IP address).
3.4 WhatsApp message data
Content of messages sent and received through the WhatsApp Business API, message delivery and read status, phone numbers of recipients, message template identifiers used.
3.5 WhatsApp metadata
Send and receive timestamps, template identifiers, conversation types (user-initiated, business-initiated), conversation session identifiers.
3.6 Billing and payments
Contact and billing details, tax identification where applicable, subscription, amount, currency, payment status and transaction references. Payment method data is collected through Stripe services when this option is used.
4. How we collect data
4.1 Direct collection
Information provided during registration, account setup, form completion, or direct communication with our support team.
4.2 Automatic collection
Data collected automatically through cookies, server logs, and similar tracking technologies during your use of the platform.
4.3 Third-party sources
Data received from Meta Platforms, Inc. through the WhatsApp Cloud API, including message delivery statuses, read notifications, and conversation metadata.
5. Purpose of processing
- Provision and maintenance of the Qleven platform and its features
- Appointment management and scheduling for centers
- Sending WhatsApp Business messages on behalf of our professional clients (appointment confirmations, reminders, marketing campaigns)
- Billing, package management, and payment processing
- Analytics and report generation to help centers optimize their operations
- Platform security, fraud prevention, and detection of unauthorized access
- Continuous improvement of our services and development of new features
- Compliance with legal and regulatory obligations
6. Legal basis for processing (GDPR)
6.1 Contractual necessity
Data processing is necessary for the performance of the service agreement between Qleven and its professional clients, including account management, appointment scheduling, and the provision of all platform features.
6.2 Consent
We rely on explicit consent for marketing communications, sending WhatsApp messages to end users on behalf of our clients, and the placement of non-essential cookies. Consent may be withdrawn at any time.
6.3 Legitimate interests
We process certain data based on our legitimate interests, including platform security, fraud prevention, service improvement, and the generation of anonymized usage statistics. We systematically assess that these interests do not override your fundamental rights and freedoms.
6.4 Legal obligation
Certain processing activities are necessary to comply with our legal obligations, including the retention of accounting and tax records and compliance with applicable regulatory requirements.
7. WhatsApp Business API disclosures
Qleven operates as a Meta Tech Provider using the WhatsApp Cloud API to enable beauty, aesthetic, and health centers to communicate with their clients through WhatsApp Business.
7.1 Roles and responsibilities
Centers using Qleven are the data controllers for their WhatsApp conversations with end users. Qleven acts as a data processor on behalf of these centers. Meta Platforms, Inc. is a separate sub-processor for the messaging infrastructure.
7.2 Message processing
Message content and metadata are processed through Meta's infrastructure in accordance with the WhatsApp Business API terms of service. Qleven processes this data exclusively to provide the messaging service to its clients.
7.3 End-user consent
Sending WhatsApp messages to end users requires their prior explicit consent (opt-in). Qleven's client centers are responsible for obtaining and managing this consent in compliance with WhatsApp Business Policies and applicable regulations.
7.4 Message templates
Message templates used through Qleven must comply with Meta's WhatsApp Business Policy. All templates are subject to Meta's approval before use.
7.5 Encryption
End-to-end encryption is maintained for messages between users and businesses in accordance with the WhatsApp security protocol.
8. Data sharing and third parties
Depending on the features used, recipients include hosting, storage, communications, payment and analytics providers. The main services described here are:
8.1 Meta Platforms, Inc.
WhatsApp Cloud API infrastructure for professional messaging. Shared data is limited to message content, recipient phone numbers, and delivery metadata.
8.2 Vercel Inc.
Website and application hosting and delivery; processing of HTTP requests and technical logs.
8.3 Supabase Inc.
Platform database and file storage services.
8.4 Stripe
Payment, subscription, invoice and refund processing, and fraud prevention. Stripe receives the necessary contact, billing, transaction and payment method data. Depending on the activity, it acts as a processor or an independent controller, including for legal obligations and fraud prevention. See its privacy policy. Stripe Privacy Policy
8.5 PostHog
Website navigation analytics when authorised through the cookie controls. Details and consent withdrawal options are described in our cookie policy.
We never sell personal data to third parties. We do not share data for third-party advertising purposes.
9. International data transfers
Processing locations depend on the service, its configuration and authorised access. The storage region alone does not determine every processing country.
QLEVEN LLC is established in the United States. Providers such as Stripe or Meta may process data outside the European Economic Area. Where GDPR applies, transfers require a valid basis, such as an adequacy decision covering the recipient or standard contractual clauses and supplementary measures where necessary. European hosting alone does not exclude these transfers.
You may request information about recipients, countries and safeguards applicable to your processing at contact@qleven.com.
10. Data retention
We retain personal data for as long as necessary to fulfill the purposes described in this policy, according to the following retention periods:
| Data type | Retention period | Justification |
|---|---|---|
| Account data | As needed for the relationship and subsequently for applicable legal claim periods | Service delivery and legal claims; unnecessary data is deleted |
| WhatsApp messages | According to the centre’s instructions and applicable obligations | The centre sets the period as controller; return or deletion is governed by the processing agreement |
| Usage logs | As needed for security or measurement, depending on purpose and configuration; cookie choices expire after 180 days | Security logs are separate from optional analytics; withdrawing cookies stops new measurement |
| Financial records | Tax, accounting and limitation periods applicable to each document and jurisdiction | Legal obligation (tax and commercial legislation) |
Contact requests are kept while being handled and, if a relationship begins, for that purpose. Data must be deleted or anonymised when no retention basis remains. Backups and legal holds require separate handling; you may request details for your case.
11. User rights (GDPR Articles 15-22)
Under applicable law, including GDPR where relevant, you may exercise the following rights:
Right of access
You may obtain confirmation that your personal data is being processed and access a copy of that data.
Right to rectification
You may request the correction of inaccurate or incomplete personal data.
Right to erasure
You may request the deletion of your personal data (right to be forgotten), subject to legal retention obligations.
Right to restriction of processing
You may request the restriction of the processing of your data under certain circumstances provided by applicable regulations.
Right to data portability
You may receive your personal data in a structured, commonly used, and machine-readable format, and transmit it to another data controller.
Right to object
You may object to the processing of your personal data based on legitimate interest, including profiling.
Right to withdraw consent
Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint
You may complain to the competent data protection authority. Where GDPR applies, this includes the authority of your habitual residence, workplace or the place of the alleged infringement, including the AEPD in Spain.
Contact contact@qleven.com. Where GDPR applies, we respond without undue delay and within one month of receipt. Complexity or number of requests may require two further months; reasons will be provided within the first month. Additional identity information is requested only when necessary.
12. Data security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
- HTTPS connections for the website and forms
- Minimisation of form data and removal of URL parameters from analytics
- Strict role-based access controls (RBAC) and multi-tenant isolation by system identifier
- Dependency review and vulnerability remediation according to risk
- Channel for incident reports and requests: contact@qleven.com
- Access logging and monitoring for detection of anomalous behavior
13. Cookies
The website stores technical preferences and cookie choices. Optional analytics is pseudonymous, not anonymous, and requires prior permission. Session recording is disabled.
For detailed information about the types of cookies used, their purposes, and their retention periods, please consult our Cookie Policy.
14. Children's privacy
The Qleven platform is intended for professional use by beauty, aesthetic, and health centers. Our service is not directed at individuals under the age of 16.
Public forms must not be used to send children’s or patients’ data. Centres managing children’s data in the platform determine the legal basis and safeguards as controllers; Qleven processes it under their instructions.
15. Changes to this policy
We reserve the right to modify this Privacy Policy at any time. In the event of a material change, we will notify users by email and through an in-platform notification.
Continued use is not consent to new purposes. Where consent is required, it will be requested separately before new processing.
16. Contact
For any questions regarding this Privacy Policy or the protection of your personal data, you may contact us:
Email: contact@qleven.com
Address: 407 Lincoln Road, Suite 708, Miami Beach, FL 33139, USA
Privacy contact: contact@qleven.com