Privacy notice

Booking information

We collect your name, UK phone number, email, chosen services, appointment date and time. Email is required for public online bookings so we can send confirmation and a secure cancellation link. Notes are optional. We also store booking status, price and duration to manage your appointment. Please do not include sensitive personal or medical information in the notes.

Why we use it

We use booking details to arrange and provide your requested appointment and contact you about changes. We use technical security records to prevent spam, repeated bookings and misuse of the service. These purposes support providing the service you request and our legitimate interest in protecting the booking system.

IP addresses and security

Our booking application converts your IP address into a keyed hash before recording booking attempts and security events. This lets us recognise repeated activity without keeping the raw address in those application records. A hash is not the same as anonymous data. Our hosting providers may separately process IP addresses and technical logs to operate and protect their services.

Who receives information

Authorised shop administrators can access bookings. Vercel hosts the website, Neon stores booking data and queued email details, and Resend sends public booking confirmations to customers and the shop, and notifies the shop when a customer cancels online. Customers do not receive cancellation confirmation emails, and admin booking actions do not send emails. Customer confirmation emails contain a private cancellation link. These are service emails, not marketing subscriptions. Service providers process information as needed to deliver these services; their storage locations and backup arrangements depend on the shop's account settings.

Normal bookings made through Booksy are handled on Booksy's website. External services such as Booksy, Instagram and Google Maps have their own privacy notices.

Optional VIP email subscription

You can separately choose to receive VIP offers, news and updates by email. This is not required to book. If you opt in, we collect your birthday day and month, without a year, to personalise offers. Your booking confirmation includes a subscription confirmation link. We only activate your subscription after you confirm it. We record the wording you agreed to, its version and confirmation time.

Neon stores subscriptions, birthdays and email delivery records. Resend receives confirmed subscribers' email, name, birthday day and month, and consent version to send marketing emails. One email address has one confirmed birthday. Customers cannot change it online; please call the shop so an authorised administrator can correct a mistake. Every marketing email has an unsubscribe link; unsubscribing does not affect booking emails. Opening a preference link alone does not subscribe or unsubscribe you.

Subscription and opt-out records are retained separately from bookings until manually reviewed or removed. We retain opt-outs to avoid contacting people who have unsubscribed. Contact removal stops marketing, then queues removal from Resend and the contact database. Minimal email fingerprints, removal timestamps and offer-year records remain to prevent old links or repeated registration from restoring removed preferences or duplicating an offer. These fingerprints are not anonymous. Contact removal does not erase booking records, and deleting a booking does not automatically delete a subscription. Privacy requests must also cover Resend contacts, queued marketing messages and provider backups.

Retention and deletion

Booking and security records are currently retained until manually removed; general automatic expiry is not yet enabled. Cancellation-page rate-limit counters older than one day are removed by the scheduled maintenance job. Queued booking emails are removed when their booking is deleted. Copies of booking notifications may also exist in customers' and the shop's mailboxes and provider backups. To ask how long your information is kept or request its deletion, please call the shop.

Your choices and requests

Please call the shop to request access to your information, correct it, request deletion or restriction, or raise an objection to its use. The shop may need to verify your identity before acting. Some information may need to be retained where there is a valid legal reason. You can also raise a concern with the Information Commissioner's Office.

Optional website analytics

With your permission, we use Google Analytics to understand which public website buttons are clicked. We send fixed button names and page paths, not booking details, typed information or private link tokens. Google processes technical information, including your IP address when receiving requests, and uses analytics cookies to measure usage. We do not enable advertising personalisation or Google signals. Analytics is excluded from admin, appointment-management and email-preference pages.

You can accept or reject analytics without affecting booking, and change your choice using Cookie settings in the footer. Your choice is stored in this browser for up to six months. Rejecting stops our analytics and removes accessible Google Analytics cookies from this site; it does not erase information already received by Google. See Google's privacy policy for its processing practices.

Cookies and browser storage

The admin sign-in uses authentication and security cookies. The public booking form does not require a customer account. It stores a random request identifier and a digest in this browser tab to recognise retries; customer details are not stored there. The appointment management and email preference pages also store your private access token in this tab so you can refresh or check a cancellation result. These identifiers normally disappear when the tab is closed. Keep your confirmation link private. External websites you choose to visit may use their own cookies.