1. About Us

This Privacy Policy describes how FOP Filenko Vita Vitaliivna ("we", "us", "Beauty Persona") collects, uses, and protects your personal information when you use the Beauty Persona mobile application (Android/iOS) and the web platform at beauty-persona.vercel.app.

Beauty Persona is a beauty salon management platform that helps salon owners and service providers efficiently manage their business, and helps clients conveniently book appointments online.

2. Data We Collect

2.1. Data You Provide Directly

• Account registration: full name, phone number, email address, password (hashed)
• Profile information: profile photo, bio, service descriptions, salon name and address, working hours, service prices and durations
• Booking data: appointment date and time, selected services, notes, client preferences
• Financial data: payment records (processed by Stripe — we do not store full card numbers), invoice data
• Communications: in-app chat messages, reviews, ratings, comments
• Business data: inventory records, staff information, salon settings (for salon owners)

2.2. Automatically Collected Data

• Device information: device model, operating system version, app version, unique device identifier (Expo device ID)
• Usage analytics: features used, screens visited, session duration — collected in anonymized form
• Push notification tokens: Expo push token for sending appointment reminders and notifications
• Crash reports: error logs and stack traces collected via Sentry (anonymized)
• Location data: approximate location (city level) only when you explicitly use the map/search feature to find nearby salons — not tracked in background

2.3. Data from Third Parties

• Google Sign-In: if you authenticate via Google, we receive your name and email address from Google
• Apple Sign-In: if you authenticate via Apple ID, we receive your name and email address from Apple
• Stripe: payment status and transaction identifiers (Stripe processes payment card data; we receive only confirmation data)

3. App Permissions

The Beauty Persona app requests the following device permissions. All permissions are requested only when needed and can be revoked at any time in your device settings.

3.1. Camera

Why we need it: To allow you to take photos for your profile picture, salon cover image, or portfolio gallery.

When used: Only when you explicitly tap "Take Photo" — never in background.

3.2. Photo Library / Media Storage

Why we need it: To allow you to select existing photos from your gallery for profile pictures and service images.

When used: Only when you explicitly select "Choose from Gallery".

3.3. Bluetooth

Why we need it: To connect to Bluetooth scales for measuring hair color weight (professional feature for colorists).

When used: Only when you activate the Bluetooth scale feature in inventory settings.

3.4. Location (Approximate)

Why we need it: To show nearby beauty salons and masters on the map when you use the search/discovery feature.

When used: Only when the map/search screen is open and you tap "Find Nearby". Not tracked in background.

3.5. Notifications

Why we need it: To send appointment reminders, booking confirmations, and important updates.

When used: You can enable or disable notifications at any time in device settings or in the app under Profile → Notifications.

4. How We Use Your Data

• Service delivery: managing appointments, displaying schedules, processing online bookings, sending booking confirmations
• Notifications: appointment reminders (24h and 1h before), cancellation alerts, new booking notifications
• Payments: processing subscription payments, generating invoices, financial reporting for salon owners
• AI-powered features: business insights, revenue forecasting, client retention recommendations — based on your own data, not shared with third parties
• Quality & trust: reliability scoring system (see Section 6)
• App improvement: anonymized usage analytics, crash reporting, performance monitoring
• Security: fraud detection, abuse prevention, account protection
• Legal compliance: fulfilling obligations under Ukrainian and international law

5. Legal Basis for Processing (GDPR Art. 6)

• Performance of a contract (Art. 6(1)(b)): processing necessary to provide the booking and salon management service you signed up for — account management, appointment scheduling, payment processing
• Legitimate interests (Art. 6(1)(f)): anonymized analytics, crash reporting, fraud prevention, improving service quality
• Consent (Art. 6(1)(a)): push notifications, location access for map features, optional marketing communications — you can withdraw consent at any time
• Legal obligation (Art. 6(1)(c)): retaining financial records as required by Ukrainian tax law (up to 7 years)

6. Service Quality System

6.1. How It Works

The system analyzes interaction patterns — such as appointment attendance history and cancellation frequency — to calculate a reliability index. This helps:

• Service providers minimize losses from no-shows
• Reliable clients receive priority service
• The platform maintains a respectful community

6.2. Your Control

• Request your current reliability index at any time
• Contest a score you believe is inaccurate
• Opt out of the system (may limit some features)

6.3. Privacy Guarantees

• Reliability scores are not shared with third parties outside the platform
• After account deletion, all data is anonymized and cannot be linked to you
• The system does not affect your ability to use basic app features

7. Data Sharing with Third Parties

We do not sell your personal data. We share data only in the following cases:

7.1. Service Providers (Data Processors)

• Supabase Inc. (USA) — cloud database hosting, user authentication, file storage. Data stored on AWS infrastructure with encryption at rest.
• Stripe Inc. (USA) — payment processing for subscriptions. Stripe is PCI DSS Level 1 certified. We do not store card numbers.
• OpenAI Inc. (USA) — AI business insights feature. Only anonymized, aggregated business metrics are processed — no personal client data.
• Sentry Inc. (USA) — crash and error reporting. Personally identifiable information is scrubbed before transmission.
• Expo (Expo.dev) — mobile app platform and push notification delivery.
• Google LLC — Google Sign-In authentication, push notifications (Firebase Cloud Messaging).
• Telegram — optional: if you connect Telegram notifications for your clients.

7.2. Within the Platform

• Your public profile (name, photo, services, ratings) is visible to clients who view your booking page
• Salon owners can see staff members' schedules and performance data within their salon
• Client contact details are shared with the service provider for the specific appointment only

7.3. Legal Requirements

We may disclose data when required by law, court order, or lawful requests by Ukrainian public authorities.

8. Data Security

• Encryption in transit: all data transmitted via HTTPS/TLS 1.2+
• Encryption at rest: database encrypted at infrastructure level (Supabase/AWS)
• Row Level Security (RLS): database-level access control ensuring users can only access their own data
• Authentication: secure JWT tokens with expiration, optional two-factor authentication (2FA)
• Session management: automatic session expiration after inactivity
• Secrets management: API keys and credentials stored in environment variables, never in source code
• Audit logging: security-relevant actions are logged for 12 months
• Regular backups: automated daily database backups with encryption

No system is 100% secure. In the event of a data breach affecting your rights, we will notify you within 72 hours as required by GDPR.

9. Your Rights (GDPR)

Under GDPR and Ukrainian personal data protection law (Law of Ukraine No. 2297-VI), you have the following rights:

• Right of access (Art. 15): obtain a copy of all personal data we hold about you
• Right to rectification (Art. 16): correct inaccurate or incomplete data
• Right to erasure / "right to be forgotten" (Art. 17): request deletion of your account and all associated personal data
• Right to restriction (Art. 18): limit how we process your data in certain circumstances
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format (JSON/CSV)
• Right to object (Art. 21): object to processing based on legitimate interests
• Right to withdraw consent: withdraw consent for notifications, location, or marketing at any time without affecting prior processing
• Right to lodge a complaint: file a complaint with the Ukrainian Parliament Commissioner for Human Rights (Ombudsman) or the supervisory authority in your EU country of residence

10. Account & Data Deletion

You have the right to delete your account and all associated personal data at any time.

10.1. How to Delete Your Account

• In the app: Profile → Settings → Account → Delete Account
• By email: send a deletion request to privacy@beautypersona.com

10.2. What Gets Deleted

• Your profile, photos, and personal information — deleted immediately
• Chat messages, reviews — deleted within 30 days
• Appointment history — anonymized (dates/services retained for statistical purposes, not linked to you)

10.3. What We May Retain

• Financial records: retained for up to 7 years as required by Ukrainian tax and accounting law (stored without personal identifiers where possible)
• Security logs: retained for up to 12 months for fraud prevention

11. Cookies & Local Storage

Mobile App

The mobile app does not use browser cookies. We use:

• AsyncStorage / SecureStore: stores your session token, language preference, theme settings — locally on your device, never shared
• Expo SecureStore: stores authentication tokens using the device's secure enclave (Keychain on iOS, Keystore on Android)

Web Platform

The web application at beauty-persona.vercel.app uses:

• Strictly necessary cookies: session management (Supabase auth token) — cannot be disabled as they are essential for the service to function
• No tracking or advertising cookies

You can clear local data by clearing your browser storage or uninstalling the mobile app.

12. Data Retention

• Active account data: retained while you use the service
• Deleted account: personal data deleted within 30 days; anonymized statistical data may be retained
• Financial and payment records: up to 7 years (Ukrainian tax law requirement)
• Security and audit logs: up to 12 months
• Crash reports (Sentry): up to 90 days
• Push notification tokens: deleted when you uninstall the app or revoke notification permission

13. Children's Privacy

Beauty Persona is not directed to persons under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@beautypersona.com and we will promptly delete such data.

14. Policy Changes

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by:

• Push notification in the app
• Email to your registered address
• An in-app banner upon next login

The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the app after changes constitutes acceptance of the updated policy.

15. Contact Us