In short
- Providers are controllers of their customer data; Nola is the processor under the DPA.
- We collect account, booking, payment status, and support data needed to run the product.
- You can request access, export, or erasure via Contact or Provider → Privacy & GDPR.
1. Roles
When you run a business on Nola, you are the controller of your customers’ personal data. Nola is your processor under our Data Processing Agreement. For your own Nola account (sign-in, billing, support), Nola is the controller.
2. What we process
Account identity (name, email via Clerk), provider profile content you publish, booking and inquiry records, payment status (not full card numbers, which stay with Stripe/Montonio), messages, consent records, and technical logs needed to secure the service. For members who use training features: the workouts, body measurements and check-ins they choose to share with their trainer, and progress photos only after they allow them. Progress photos are stored privately, shown only to the member and their own trainer, and deleted when the member withdraws that consent.
3. Why
To provide the booking and quoting product, secure accounts, send transactional notifications you configure, improve reliability, and meet legal obligations (e.g. accounting retention).
4. Cookies & analytics
Essential cookies keep you signed in. Analytics and speed insights load only after you accept cookies on the banner. You can change that choice anytime via Cookie settings in the footer. In the business app we use PostHog (EU Cloud, Frankfurt) for product analytics. After you accept cookies, it records page views, feature use and session recordings, with typed text and client details hidden; it never runs on booking pages, for your customers or in the demo. Without cookies we still note a few account events on our servers (for example, a business was created or a plan changed), with no client data, based on our legitimate interest in improving Nola. You can object to these at any time under Account → Privacy or by emailing us, and we then stop sending them for your account.
5. Your rights
EEA residents can request access, rectification, erasure, restriction, portability, and objection. Providers manage customer requests in-product; account holders can email us. Supervisory authority: Estonian Data Protection Inspectorate.
Questions: Contact