Privacy Policy

Version: 2026.07.19
Last updated: 19 July 2026

1. Who We Are

Aliya's Beauty is a beauty salon business trading in the United Kingdom. For privacy questions and data-rights requests contact info@aliyasbeauty.co.uk.

30 New Green Street, South Shields, Tyne and Wear, NE33 5DL, GB
Phone: 07802 271478

2. Scope

This policy applies to personal data we process through our website, booking system, account area, payment flows, issue-reporting tools, reviews/favorites features, and e-book purchase/delivery flows.

3. Data We Collect

We may collect and process:

• Identity and contact data: first name, last name, phone number, email address.
• Account and authentication data: password hash, account preferences, login/session metadata.
• Booking data: services selected, appointment date/time/location, booking notes, cancellation status, and related history.
• Payment-related data: checkout references, payment status, partial card metadata (for example masked card details where available), stored payment token references for scheduled payments, and refund records.
• E-book purchase data: purchaser email, order/check-out references, download token, download count, and product fulfilment status.
• Support and quality data: issue reports, review submissions, favorites, and communications metadata.
• Technical/security data: IP address, user agent, request metadata, security and fraud-prevention logs, and rate-limit markers.
• AI preview data: if you use the optional Lash Try-On feature, the photo you choose to provide (camera capture or upload), your selected style/intensity, and a hashed device and/or IP identifier used only to enforce fair-use limits on this free feature.
• Marketing preference data: whether you opted in to promotional email marketing.

4. How We Use Your Data

• To create and manage bookings, accounts, cancellations, and customer support interactions.
• To process payments, schedule/collect remaining balances where authorised, and handle refunds when eligible.
• To deliver digital products (including e-book access/download links) and purchase confirmations.
• To send essential service communications (booking confirmations, updates, operational notices).
• To improve service quality, detect abuse/fraud, and protect platform security.
• To send marketing emails only where you have opted in, and to honour opt-out preferences.
• To meet legal, accounting, tax, and compliance obligations.

5. Lawful Bases (UK GDPR)

• Contract: when processing is required to provide bookings, accounts, payments, cancellations, and digital fulfilment.
• Legitimate interests: service protection, abuse prevention, diagnostics, limited privacy-friendly analytics, and general business operations where rights are respected.
• Consent: optional marketing communications.
• Legal obligation: where records must be retained/disclosed for tax, accounting, legal claims, or regulatory compliance.

6. Data Sharing and Processors

We do not sell personal data. We may share data with trusted processors acting on our instructions, including:

• SumUp for checkout/payment processing and payment operations.
• Email delivery providers (Resend and/or Mandrill) for transactional, operational, and marketing email delivery (including automated email sequences you may receive if you opt in to marketing emails).
• Replicate for the optional Lash Try-On AI preview feature. If you choose to use it, your photo and the generated preview are processed by Replicate solely to render that one preview, and are automatically deleted from Replicate's systems (typically within about an hour). We do not store your photo on our own servers, and it is not used for anything else.
• Hosting/infrastructure providers that support site/app operation and security.

7. International Transfers

Some processors may process data outside the UK. Where this occurs, we rely on recognised transfer mechanisms (such as UK adequacy regulations or contractual safeguards) as required by applicable law.

8. Retention

We keep data only for as long as necessary for the purposes above. Key operational periods currently include:

• Application and security logs: typically up to 90 days.
• Security events: typically up to 90 days.
• Login attempt and rate-limit files: short-lived operational files (generally minutes to 24 hours).
• Abandoned pending booking holds: cleaned when stale (heartbeat-based cleanup).
• E-book pending checkouts: marked failed after timeout; download tokens are time-limited.
• Lash Try-On usage records: to enforce fair-use limits and prevent abuse, we keep a short usage log (style/intensity chosen and a one-way hashed device/IP identifier — never a raw IP address or your photo) for up to 90 days, after which it is automatically deleted. Your photo itself is never stored on our servers.
• Account deletion requests: account profile is anonymized while certain business records may be retained for legal/accounting obligations.

Where longer retention is required by law, tax/accounting obligations, fraud prevention, or legal claims, we retain only what is necessary.

9. Cookies and Tracking

We use strictly necessary cookies for core website and account functions, plus limited privacy-friendly analytics on non-staff website areas to understand pageviews and key conversion events. See our Cookie Policy for details.

10. Security

We implement technical and organisational safeguards appropriate to the nature of the data we process, including access controls, session protections, rate limiting, input validation, and security/event monitoring. No system can be guaranteed 100% secure.

11. Your Rights

Subject to law, you may request access, correction, deletion, restriction, objection, and data portability. You may also withdraw consent where processing is consent-based (for example marketing). Contact info@aliyasbeauty.co.uk.

12. Children and Age Restrictions

Our services are intended for users aged 16 and over. Clients aged 16-17 require parent/guardian consent in accordance with our terms and treatment policies.

13. Complaints

If you are not satisfied with our response, you may raise a complaint with the UK Information Commissioner’s Office (ICO).

14. Updates to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the version and date shown above.