Privacy Policy

1. Who is responsible for your data

The data controller responsible for your personal data is:
Alireza Talebibarmi (sole proprietorship Beautylib)
Fachnerstraße 53, 80686 München, Germany
Email: support@beautylib.de

2. What data we collect

When you create an account, we collect:

• Your full name
• Your email address
• Your phone number
• A password, stored only as a secure cryptographic hash — we never see or store your actual password

When you make a booking, we additionally collect and store:

• The salon, service, date, and time you booked
• Your name, email, and phone number as supplied for that booking (which may differ from your account details)

If you write to us via the contact form, we process your name, email address and message solely to reply to you (Art. 6(1)(b) or (f) GDPR).

We also automatically collect your IP address on requests to our servers, used only to enforce rate limits against abuse (e.g. repeated failed logins) and never stored longer than necessary for that purpose.

3. Why we process your data (legal basis)

• Performing your booking and managing your account — necessary to perform our contract with you (Art. 6(1)(b) GDPR).
• Sending you booking confirmation and cancellation emails — necessary to perform our contract with you (Art. 6(1)(b) GDPR).
• Security, fraud prevention, and rate limiting — our legitimate interest in keeping the service available and secure (Art. 6(1)(f) GDPR).
• Sharing your booking details with the salon you booked — necessary to perform our contract with you, since the salon is who actually provides the service (Art. 6(1)(b) GDPR).

We do not currently send marketing emails or use your data for advertising, and we do not sell your personal data to anyone.

4. Who we share your data with

We use a small number of processors to run the service, each bound by a data processing agreement:

• Supabase — hosts our database and handles account authentication.
• Resend — sends transactional emails (booking confirmations, cancellations) on our behalf.
• Vercel — hosts our website and server infrastructure.
• Sentry (Functional Software, Inc.; data stored in the EU) — receives technical error reports when the website or app crashes or hits an error (see below).
• The salon you book with — receives your name, contact details, and booking details so they can provide the service you booked. Salons are independent businesses, not part of Beautylib — see our Terms of Service for details.

We also use the Google Places API to display public business data (such as locations) of salons — this only involves salon business data, not your personal data.

Third-party maps and images. On a salon page we only embed a Google Maps map (Google Ireland Limited / Google LLC) after you click "Load map"; before that, no connection to Google is made. When loaded, Google receives, among other things, your IP address and technical browser data. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR); we remember it only until you close the browser tab (session storage). In the map view of the salon search we load map tiles from OpenStreetMap (OpenStreetMap Foundation tile servers); your IP address is also transmitted to them (Art. 6(1)(f) GDPR, legitimate interest in a working map view that you open yourself). Some photos (stock images from Unsplash) are delivered via our server or directly from images.unsplash.com; your IP address may also be transmitted to that provider (Art. 6(1)(f) GDPR).

Error reports. To fix technical problems, the website and app send an error report to Sentry (servers in the EU) when they crash or hit an error. It contains technical details such as the error message, the page visited, browser or device type and app version and, if you are signed in, your internal user ID so we can match a report you send us. We set no cookies for this, send no form input or request contents, and do not store IP addresses. The legal basis is our legitimate interest in a stable and secure service (Art. 6(1)(f) GDPR).

Location ("Salons near me"). If you use "Salons near me", your browser asks for your permission. Only then is your approximate location (rounded to about 1 km) used to sort salons by distance. The location is processed only in your browser (temporarily, in session storage) and is neither sent to us nor stored.

5. How long we keep your data

We keep your account data for as long as your account is active. Booking data that is relevant for accounting and tax (including bookings you later cancel, which are kept as a historical record but excluded from any amount owed) is kept for the statutory retention periods of up to ten years (§ 147 AO, § 257 HGB) and deleted or anonymised afterwards. Messages sent through the contact form are kept only as long as needed to handle your request. You can request deletion of your account at any time; data we are legally required to keep is then restricted and no longer used for other purposes — see your rights below.

6. Cookies

We use one essential cookie to keep you signed in (an encrypted session token). This cookie is required for the site to function and is not used for advertising, analytics, or tracking, so under GDPR/ePrivacy rules it does not require separate consent — but we tell you about it anyway, in the interest of transparency.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable format
• Lodge a complaint with a data protection supervisory authority — in Germany, the authority for your state (Landesdatenschutzbehörde)

To exercise any of these rights, email us at support@beautylib.de.

8. Children

Beautylib is not directed at children, and we do not knowingly collect data from anyone under 16.

9. Changes to this policy

If we materially change how we handle your data, we will update this page and, where required, notify you directly.