Draft for legal review. Not yet checked by a solicitor. Text in [square brackets] needs filling in before launch.
FeelPretty connects people with independent beauty pros and takes bookings for them. This policy explains what personal information we collect, why, who sees it and what you can do about it.
Who we are
FeelPretty is run by [COMPANY NAME LTD], a company registered in England and Wales (number [NUMBER]), at [REGISTERED ADDRESS]. We are the controller of the personal information described here. We are registered with the Information Commissioner's Office under number [ICO NUMBER].
Questions about your data: [email protected].
What we collect
When you make an account: your name, email address and password (stored scrambled, never readable). If you sign in with Apple or Google, we receive your name and email from them. If you add a phone number, we keep it and when you verified it.
When you book: the beauty pro, service, date and time, any note you add, and what you paid. If you set up a repeat booking, we record the exact words you agreed to and when.
Payments: card payments are handled by our payment processor. We never see or store your full card number. It tells us whether a payment worked, and the last four digits and brand of the card.
Messages you send to a beauty pro about a booking, and any you report to us.
Reviews you leave.
Your location, only if you choose to share it to find beauty pros nearby. We use it for that search and do not store it. A postcode you type is used the same way.
Photos that beauty pros upload of their work. We remove hidden location data (EXIF) from every photo before storing it.
Your phone, if you use the app: a push notification token so we can send you booking updates, and the device name you see in "Signed-in devices".
Basic technical information when you use our website or app, such as your IP address, kept in our server logs for [30] days to keep the service secure.
Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Create your account, take and manage bookings and payments, send booking messages and reminders | Contract: we need it to provide the service you asked for |
| Take a repeat booking's deposit from your saved card | Contract, with the agreement you gave when you set it up |
| Keep booking and payment records | Legal obligation: tax law requires us to keep financial records for six years |
| Prevent fraud and abuse, keep accounts secure, deal with reported messages | Legitimate interests: keeping FeelPretty safe for everyone |
| Remind you when it is time to rebook, and suggest similar beauty pros | Legitimate interests, and for emails the "soft opt-in" for existing customers. You can switch these off at any time, and every email has a one-click unsubscribe link |
Who sees it
The beauty pro you book sees your name, your booking, any note you add and messages you send. They do not see your email address, phone number or card details. They may keep their own notes about appointments with you; they are responsible for those notes.
Customers booked with a beauty pro see that beauty pro's business name, rough area, services, photos and reviews. A beauty pro's exact address is shown only to a booked customer, from 24 hours before the appointment until 24 hours after.
Service providers who process data for us under contract:
- Our payment processor (payments and payouts to beauty pros; who they are and how they use your data)
- Twilio (text messages)
- Expo, Apple and Google (push notifications)
- [EMAIL PROVIDER] (sending email)
- [HOSTING PROVIDER] (where our servers run, in [UK/EU REGION])
- postcodes.io (turning a postcode into a rough location; no personal data is sent)
- Mapbox (the map of beauty pros; your device sends it your IP address and the part of the map you are looking at, and the app turns off Mapbox's own usage reporting)
Some of these are in the United States. Where your data leaves the UK, it is protected by the UK's adequacy regulations or the International Data Transfer Agreement.
HMRC, for beauty pros only: the law requires platforms to report the details of businesses that sell through them (such as name, address, date of birth, tax reference and what they earned through FeelPretty) once a year.
Others, when we must: the police, courts or regulators, where the law requires it or to protect someone's safety; and a buyer of FeelPretty, if the business is sold, under the same protections.
We do not sell your data, and we do not use it for advertising.
How long we keep it
- Your account: until you delete it.
- Bookings and payments: six years after the booking, as tax law requires. If you delete your account, these records are kept without your name or contact details.
- Messages: 12 months after the appointment, then deleted automatically.
- Notifications in your account: 12 months.
- Server logs: [30] days.
Your rights
You can:
- Get a copy of your data: in the app (Profile, then "Download my data") or on the website (Account). We email it to you as a file.
- Correct anything that is wrong.
- Delete your account and personal data: in the app or on the website. Bookings you have not had yet must be cancelled first, so you can see what is refunded.
- Object to us using your data for our legitimate interests, or restrict how we use it.
- Switch off reminders and suggestions in your notification settings.
To use any of these, or if something is not covered by the buttons, email [email protected]. We reply within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.
Children
FeelPretty is for people aged [18] and over. We do not knowingly collect data from children.
Changes
If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect.