Privacy notice

What this notice covers

This notice explains what personal information we collect when you use this website, book an appointment, order from our shop or create an account, why we need it, who we share it with, how long we keep it and what your rights are.

What we collect

• Bookings: your name, email address, phone number (optional), the service and time you book, anything you write in the notes and any reference photos you upload.
• Shop orders: your name, email address, phone number, what you order and, if you choose delivery, your delivery address.
• Payments: deposits and online payments are taken by Stripe. We see the amount, whether it was paid or refunded and Stripe's payment reference. We never see or store your card details.
• Accounts: if you create an account, your name, email address and phone number. If you sign in with Google, we receive the name and email address on your Google account. Your bookings and orders are linked to your account.
• Messages: what you send us by email, phone, WhatsApp or social media.
• Technical information: if something goes wrong on the website, an error report showing what failed, the page you were on and your type of browser and device. To stop spam and repeated attempts, we also keep a scrambled (hashed) form of your IP address when you book, order, look up a booking or order, or sign in.

Health information

Notes and photos about your hair and scalp can show health information, such as hair loss or a scalp condition. You don't have to share this. If you do, we use it only to plan and carry out your appointment safely, and by sharing it you give us your explicit consent to do so. You can withdraw that consent at any time by asking us to delete it.

Why we use it

• To take and manage your booking or order, take payment, send your confirmation and updates, and contact you about your appointment or order. We need this to carry out our agreement with you.
• To keep business, tax and accounting records, and to deal with questions, complaints or legal claims. This is a legal obligation and in our legitimate interests.
• To keep the website working and secure, for example fixing errors and stopping fake bookings. This is in our legitimate interests.

We don't send marketing messages and we never sell your information.

Who we share it with

We use trusted companies to run the website. They handle your information only on our instructions:

• Google Firebase: our database (stored in London) and account sign-in.
• Cloudinary: stores photos, including reference photos, which are kept private.
• Stripe: takes deposits and payments.
• Resend: sends our emails.
• Sentry: error reports (stored in the EU).
• TikTok: if you open one of our TikTok videos on this website, it plays in TikTok's own player, and TikTok's privacy policy applies to it.
• The company that hosts the website.

Some of these companies are based in, or can access information from, the United States. Where information leaves the UK, it is protected by UK adequacy regulations or the UK's approved data transfer agreements.

We may also share information when the law requires it, for example with HM Revenue & Customs.

How long we keep it

• Bookings, orders and payment records: 6 years after the end of the tax year they relate to, for tax records and in case of a dispute or legal claim.
• Reference photos: deleted automatically 30 days after your appointment, or straight away if the booking is cancelled.
• Your account: until you delete it. After that, your past bookings and orders are kept as records for the period above, but are no longer linked to an account.
• Error reports: up to 90 days.
• Scrambled IP addresses: deleted automatically, usually within a day.

Your rights

You can ask us to:

• give you a copy of the information we hold about you
• correct anything that's wrong
• delete your information, where we don't need to keep it
• restrict or stop using your information, or send it to you or another organisation in a usable format

You can delete your account yourself at any time from the account page. For anything else, email us using the address at the top of this page. We'll reply within one month.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at https://ico.org.uk or on 0303 123 1113.

Cookies and browser storage

We only store what the website needs to work, so we don't ask for cookie consent:

• A sign-in cookie keeps you signed in to your account for up to 14 days.
• Your basket is saved in your browser so it's still there when you come back.
• While you're on a payment page, your browser tab remembers your booking or order so you can return to it.
• Stripe's payment page and Google sign-in set their own cookies to prevent fraud and keep you signed in.

We don't use analytics or advertising cookies.

Changes to this notice

If we change this notice, we'll update it here and change the date at the top.