Privacy policy

BeautyZilla ("BeautyZilla", "we", "us") is a UK-registered booking, point-of-sale and marketplace platform for independent salons, barbershops, spas and clinics. This policy explains how we handle personal data in two distinct capacities, which is worth reading carefully because the two are genuinely different:

• As controller — for the account data of salon owners and staff who sign up to run their business on BeautyZilla, and for the data of consumers who create an account to search and book through our marketplace. This policy is the primary privacy notice for that data.
• As processor — for the personal data a salon collects about ITS OWN clients (names, contact details, booking history, notes) and stores in BeautyZilla on the salon's behalf. The salon is the controller of that data and is responsible for its own privacy notice to its clients; we process it only on the salon's documented instructions, under the data processing terms in our terms of service. If you are a salon's client and have a question about your own data, please contact that salon directly in the first instance.

Depending on how you use BeautyZilla, we collect:

• Account data — name, email, phone number, business name and address, login credentials.
• Billing data — subscription plan, invoicing details and payment status (card details themselves are handled and stored by our payment processor, never by us directly).
• Usage data — pages visited, features used, device and browser information, and approximate location derived from IP address.
• Marketplace booking data — for consumers booking through the marketplace: name, contact details, and the booking itself.
• Communications — messages you send us via the contact form, email, or in-product support, and our replies.
• Cookies and similar technologies — see our cookies policy for the full, current list of what we set and why.

Where UK GDPR or EU GDPR applies, we rely on one of the following lawful bases for each purpose:

• Contract — to create and administer your account, provide the booking/POS/marketplace service, and process payments for your subscription.
• Legitimate interests — to keep the platform secure, prevent fraud and abuse, improve the product, and (for salon owners) contact you about relevant features — always balanced against your rights, and you can object at any time.
• Consent — for analytics and marketing cookies (see cookies policy), and for any marketing email you have separately opted into. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligation — to keep records required by tax, accounting and other applicable law.

We do not sell personal data. We share it only with the processors who help us run the platform, each bound by a data processing agreement, including: cloud hosting and infrastructure providers, payment processors, email and SMS/WhatsApp delivery providers, and error-monitoring/analytics tools. We may also disclose data where required by law, to enforce our terms, or to protect the rights, property or safety of BeautyZilla, our users, or others.

BeautyZilla and its processors may process data outside the UK/EEA, including in the United States. Where this happens, we rely on an adequacy decision, or on appropriate safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses (SCCs), to ensure your data receives a level of protection equivalent to that under UK/EU GDPR.

We keep account and billing data for as long as your account is active, and for a limited period afterward to meet legal, accounting and dispute-resolution obligations (typically up to 6 years for financial records under UK requirements). A salon's own client data is retained under that salon's instructions and deleted or exported on request, subject to the salon's own retention obligations. Usage and log data is retained for a shorter period, typically 12–24 months, before being deleted or anonymised.

UK and EU residents

Under UK GDPR and/or EU GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten"), subject to legal exceptions.
• Restrict or object to certain processing, including direct marketing.
• Receive your data in a portable format, or have it transferred directly to another provider.
• Complain to your supervisory authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in the EU, your local data protection authority.

We have no statutory obligation to appoint a Data Protection Officer; for any of the above, or any other privacy question, contact us using the details at the end of this policy — we are the controller contact point.

US residents (CCPA / CPRA)

If you are a California resident, the CCPA/CPRA gives you additional rights over the categories of personal information we collect (identifiers, commercial information, internet/network activity, and geolocation, as listed above under "The data we collect"):

• The right to know what personal information we have collected, used, and disclosed about you.
• The right to request deletion of your personal information, subject to certain exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information — see below, we do neither.
• The right to non-discrimination for exercising any of these rights.

We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under the CPRA. We honour the Global Privacy Control (GPC) signal as a valid opt-out preference signal where legally required to.

Canadian residents (PIPEDA / Quebec Law 25)

For Canadian residents, we process personal information consistently with the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Quebec residents have additional rights under Quebec's Law 25, including the right to be informed of automated decision-making and the right to data portability in a structured, commonly used format — contact us to exercise either.

BeautyZilla is a business-to-business platform intended for salon owners, staff and adult marketplace consumers. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time as the product or applicable law changes. We'll update the "last updated" date at the top of this page, and where a change is material we'll take reasonable steps to notify salon owners directly.

For any question about this policy or your data, email info.beautyzilla@gmail.com. We are the controller for the account and marketplace data described above, and act as processor for a salon's own client data under our terms of service.