Privacy notice

Who is responsible

Ingas Beauty is responsible for the salon booking information described in this notice. No public contact email is currently provided.

Information we use

• Name and mobile number, which are required to arrange and manage an appointment.
• Email, preferred message language and an optional appointment note when you choose to provide them.
• Service, date and time, booking reference, status, changes, cancellations and attendance outcome.
• Deposit amount, currency, test/live indicator, payment/refund status and limited provider references. The salon application does not collect card numbers or security codes.
• Limited security, audit, rate-limit and technical records needed to protect the service and investigate faults.

Do not put health, medical, card or other sensitive information in the appointment note. It is not needed for this booking service.

Why we use it

• To take steps at your request, arrange the appointment and provide the booked service.
• To create and reconcile the deposit, prevent duplicate payment and handle an approved refund or dispute.
• To send transactional booking, change, cancellation and reminder messages when enabled. We do not use this booking consent for marketing.
• To secure owner access, stop abuse, preserve an audit trail, diagnose faults and protect customers and the salon.
• To keep records or respond to requests where legal, tax, accounting or dispute obligations apply.

Service providers and recipients

Only the salon owner and service providers needed for the relevant operation receive the minimum information required for their role.

• Supabase provides database, authentication and related platform services; Vercel provides application hosting.
• Stripe provides hosted card checkout, payment status, reconciliation and refunds when online payments are enabled.
• Twilio provides one-way transactional SMS delivery when SMS is enabled.
• Cloudflare Turnstile helps detect automated booking abuse. If it is unavailable, you can call the salon.
• Sentry may process redacted technical error information if monitoring is enabled; request bodies and customer contact fields are excluded.

These providers may use locations or sub-processors outside Cyprus. Their regions, data-processing terms, sub-processors and any required transfer safeguards are reviewed before production use.

How long information is kept

Booking and contact information is kept only as long as needed to manage appointments, answer requests, resolve disputes and meet applicable record-keeping duties, then it is removed or anonymised under the approved retention process.

Payment, refund, accounting and audit evidence may be kept longer where legal, tax, fraud-prevention or dispute requirements justify it. Transactional message content and detailed technical logs use shorter retention where practical.

Deleted or anonymised information may remain inaccessible in restricted backups until the normal backup rotation expires.

Your data-protection rights

Depending on the circumstances and applicable law, you may ask us to:

• give you access to personal information we hold about you;
• correct inaccurate or incomplete information;
• erase information where there is no overriding reason to keep it;
• restrict particular processing;
• consider an objection to processing based on legitimate interests;
• provide eligible information in a portable format.

Call or write to the salon to make a request. We verify identity proportionately using known contact and appointment facts and do not ask for excessive identification.

You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus.

Automated decisions

We do not make automated decisions with legal or similarly significant effects. Security and bot controls may stop a request; if that happens, call the salon to arrange the appointment another way.

Cookies, browser storage and tracking

The site uses a language-preference cookie and temporary browser storage needed to carry booking selections and private status between steps. Owner authentication uses necessary secure cookies. Stripe and Turnstile may use their own necessary technology when their services load.

We do not use advertising pixels, marketing cookies, session replay or non-essential analytics in this booking service.

Security and incidents

Access is restricted, sensitive records are not public, payment cards stay with Stripe and operational logs are designed to omit contact details and tokens. If an incident affects personal information, the salon investigates, contains it and follows applicable notification duties.

Changes to this notice

The version and effective date above identify this notice. Material changes are published as a new version; each online appointment records the privacy-notice version acknowledged for that booking.