Legal

Privacy Policy

Last updated: June 11, 2026

This Privacy Policy explains how GlowApp (“GlowApp”, “we”, “us” or “our”) collects, uses and protects your personal data when you use our beauty and wellness booking platform (the “Platform”), available through our website and related services.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws. For the purposes of the GDPR, GlowApp acts as the data controller for the personal data described in this policy.

1. Who we are & how to contact us

GlowApp operates an online platform that lets customers discover beauty salons and spas, browse their services, and book appointments.

If you have questions about this policy or how we handle your data, contact us at privacy@gloapp.com.

2. Personal data we collect

We collect the following categories of personal data:

Account data — your name, phone number (required and verified via a one-time code), email address (optional), and a securely hashed password.
Booking data — the salon, service and staff member you book, appointment date and time, and the status of each booking (confirmed, cancelled or completed).
Preferences & activity — your favourite salons, reviews and ratings you submit, and your notification preferences (email, messaging and in-app notifications).
Communications data — a record of booking confirmations, reminders and verification messages we send you.
Technical data — IP address, browser/device information (user agent) and session data collected automatically when you use the Platform.

We do not collect payment card details or process payments — see section 6 below.

3. Why we process your data & legal bases

We use your personal data for the following purposes, relying on the legal bases set out in Article 6 GDPR:

Purpose	Legal basis
Creating and managing your account, verifying your phone number	Performance of a contract (Art. 6(1)(b))
Processing and managing your bookings, sending confirmations, reminders and status updates	Performance of a contract (Art. 6(1)(b))
Sharing your contact details with the salon you book (see section 5)	Performance of a contract (Art. 6(1)(b))
Optional notifications you can switch on or off in your settings	Consent (Art. 6(1)(a)) — withdrawable at any time
Keeping the Platform secure, preventing fraud and abuse, rate limiting	Legitimate interests (Art. 6(1)(f))
Improving and maintaining the Platform	Legitimate interests (Art. 6(1)(f))
Complying with legal obligations	Legal obligation (Art. 6(1)(c))

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Where your data comes from

We collect personal data directly from you — when you register, complete your profile, make a booking, save a favourite, leave a review or adjust your settings — and automatically through your use of the Platform (technical data described above).

5. Sharing your data with salons

When you book an appointment, we share your name and contact information (phone number and, where provided, email address) together with the booking details with the selected salon so it can prepare for and deliver your appointment. This information is visible only to the staff and managers of that salon, to the extent necessary to manage your booking.

Salons act as independent businesses. When they use your data for their own purposes beyond facilitating the appointment, they do so as independent data controllers and are responsible for their own compliance with data protection law.

If you leave a review, your display name and review content are shown publicly on the relevant salon's page.

6. Payments

GlowApp does not process payments and does not collect or store payment card details. Any payment for services is handled directly between you and the salon, under the salon's own terms.

7. Other recipients of your data

We may share personal data with the following categories of recipients:

Service providers (processors) — hosting, database, email delivery and messaging providers that process data on our behalf under data processing agreements.
Content delivery services — when you use the Platform, your browser loads fonts from a font CDN and, on salon pages with a location map, map tiles from a map tile provider. These providers receive your IP address as part of serving the request.
Authorities — where required by law, court order or to protect our legal rights.

We never sell your personal data.

8. International transfers

Where personal data is transferred outside the European Economic Area, we ensure an adequate level of protection through appropriate safeguards, such as European Commission adequacy decisions or standard contractual clauses.

9. Cookies & similar technologies

We use only cookies that are strictly necessary for the Platform to function:

Session cookie — keeps you signed in while you browse.
Security (CSRF) cookie — protects forms against cross-site request forgery.
“Remember me” cookie — set only if you tick “remember me” at login, to keep you signed in across visits.
Language preference — remembers your selected interface language on your device.

We do not use advertising cookies, third-party analytics or tracking pixels.

10. How long we keep your data

Account data — kept for as long as your account exists.
Booking history — kept while your account exists, to provide your booking history and resolve disputes.
Notification logs — kept for a limited period for troubleshooting and audit purposes.
Session data — expires automatically after a short period of inactivity.

When your account is deleted, your favourites, reviews, preferences and notification records are removed. We may retain limited data where required by law (for example, for accounting or dispute-resolution purposes), after which it is deleted or anonymised.

11. Your rights under the GDPR

You have the following rights regarding your personal data:

Access — obtain a copy of the personal data we hold about you (Art. 15).
Rectification — correct inaccurate or incomplete data (Art. 16). You can update your name, phone and email in your profile at any time.
Erasure — request deletion of your data (“right to be forgotten”, Art. 17). See section 12 on account deletion.
Restriction — restrict processing in certain circumstances (Art. 18).
Portability — receive your data in a structured, commonly used, machine-readable format (Art. 20).
Objection — object to processing based on our legitimate interests (Art. 21).
Withdraw consent — where processing is based on consent (e.g. optional notifications), withdraw it at any time without affecting prior processing. You can manage notification preferences in your settings.

To exercise any of these rights, contact us at privacy@gloapp.com. We respond within one month, as required by the GDPR. You also have the right to lodge a complaint with your local data protection supervisory authority.

12. Account deletion

You can delete your account yourself at any time from your account settings. Deletion requires password confirmation. If your account has associated booking records, contact us at privacy@gloapp.com and we will process your deletion request, retaining only what we are legally required to keep.

13. How we protect your data

We apply appropriate technical and organisational measures, including: encrypted connections (HTTPS), password hashing using industry-standard algorithms, role-based access controls so salon staff only see data for their own salon's bookings, and rate limiting to prevent abuse.

14. Children

The Platform is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. For material changes we will notify you through the Platform or by other appropriate means.