1. Who We Are
Aliya's Beauty is a beauty salon business trading in the United Kingdom. For privacy questions and data-rights requests contact info@aliyasbeauty.co.uk.
30 New Green Street, South Shields, Tyne and Wear, NE33 5DL, GB
Phone: 07802 271478
2. Scope
This policy applies to personal data we process through our website, booking system, account area, payment flows, issue-reporting tools, reviews/favorites features, e-book purchase/delivery flows, and lash training sign-ups and applications.
3. Data We Collect
We may collect and process:
- Identity and contact data: first name, last name, phone number, email address.
- Account and authentication data: password hash, account preferences, login/session metadata.
- Booking data: services selected, appointment date/time/location, booking notes, cancellation status, and related history.
- Payment-related data: checkout references, payment status, partial card metadata (for example masked card details where available), stored payment token references for scheduled payments, and refund records.
- E-book purchase data: purchaser email, the business name if you give one for your receipt, order/check-out references, download token, download count, and product fulfilment status.
- Companion library sign-in data: if you sign in to an ebook’s companion library, the email you sign in with, which library you asked for, and when; we keep only scrambled (hashed) copies of the sign-in link and of the code that keeps your device signed in. Anything you type into the library’s forms stays on your own device and is never sent to us.
- Support and quality data: issue reports, review submissions, favorites, and communications metadata.
- Technical/security data: IP address, user agent, request metadata, security and fraud-prevention logs, and rate-limit markers.
- AI preview data: if you use the optional Lash Try-On feature, the photo you choose to provide (camera capture or upload), your selected style/intensity, and a hashed device and/or IP identifier used only to enforce fair-use limits on this free feature.
- Marketing preference data: whether you opted in to promotional email marketing.
- Training waitlist data: the email address you give us to hear when lash training opens, and when you gave it.
- Lash training application data: if you apply for a place on a lash training course, your name, email address, mobile number (if you give it), the town you live in, your lash experience, what you want from training, when you could start, which days and course format suit you, the budget band you choose, how you heard about us, any note you add, and any friend’s code you apply with. We also record when you applied, the privacy policy version you agreed to, whether you asked for training tips and news by email, the code we give you to share, how many people have applied with it, and (if you apply with the email address of your client account) a link to that account. Our staff add the stage your application has reached and their own notes about it.
- Road to Lash Tech data: if you sign up for Alina’s weekly lash training emails, your email address, your first name (if you give it), whether you are new to lashes or already a lash tech, where you signed up, the words you agreed to, the privacy policy version, when you confirmed, which of the emails we have sent you, and whether you opened each one and clicked its links.
- Photos and video: if you agree on a consent form, photos and video of your lashes and eyes, for the uses you ticked (your treatment record, training materials, social media or our website). You can withdraw that consent at any time.
- Course seat data: if we offer you a seat on a course, your name and email, the course price, deposit and start date offered, and whether and when you paid the deposit, with its payment reference. Your card details go to SumUp, never to us.
4. How We Use Your Data
- To create and manage bookings, accounts, cancellations, and customer support interactions.
- To process payments, schedule/collect remaining balances where authorised, and handle refunds when eligible.
- To deliver digital products (including e-book access/download links) and purchase confirmations, and to email you a link to sign in to your book’s companion library and check, each time you open it, that your email bought that book.
- To send essential service communications (booking confirmations, updates, operational notices).
- To improve service quality, detect abuse/fraud, and protect platform security.
- To send marketing emails only where you have opted in, and to honour opt-out preferences.
- To email you when lash training opens, where you joined the training waitlist.
- To consider your lash training application, contact you about the course by email or phone, and keep your place in the queue for a seat. Each friend who applies with your code moves you up the queue; we tell you how many friends have applied with it, but not who they are.
- To help our staff decide who to contact first, we give each application a simple points score from your answers (for example, when you could start and where you live). The score is only a guide: a member of staff reviews every application and makes every decision, and no decision about you is made by automated means alone.
- To send you Road to Lash Tech, Alina’s weekly lash training emails, only where you asked for them and then confirmed from the email we sent you. Each email has a tiny image and links that tell us whether it was opened and which links were clicked, so we can see which emails help; we tell you this when you sign up. Every email has a one-click unsubscribe link.
- To meet legal, accounting, tax, and compliance obligations.
5. Lawful Bases (UK GDPR)
- Contract: when processing is required to provide bookings, accounts, payments, cancellations, and digital fulfilment, and to take the steps you ask for before a contract, such as considering your lash training application.
- Legitimate interests: service protection, abuse prevention, diagnostics, limited privacy-friendly analytics, scoring and queueing training applications, and general business operations where rights are respected.
- Consent: optional marketing communications, including Road to Lash Tech, and seeing whether those emails are opened and clicked.
- Legal obligation: where records must be retained/disclosed for tax, accounting, legal claims, or regulatory compliance.
6. Data Sharing and Processors
We do not sell personal data. We may share data with trusted processors acting on our instructions, including:
- SumUp for checkout/payment processing and payment operations.
- Email delivery providers (Resend and/or Mandrill) for transactional, operational, and marketing email delivery (including automated email sequences you may receive if you opt in to marketing emails).
- Replicate for the optional Lash Try-On AI preview feature. If you choose to use it, your photo and the generated preview are processed by Replicate solely to render that one preview, and are automatically deleted from Replicate's systems (typically within about an hour). We do not store your photo on our own servers, and it is not used for anything else.
- Hosting/infrastructure providers that support site/app operation and security.
7. International Transfers
Some processors may process data outside the UK. Where this occurs, we rely on recognised transfer mechanisms (such as UK adequacy regulations or contractual safeguards) as required by applicable law.
8. Retention
We keep data only for as long as necessary for the purposes above. Key operational periods currently include:
- Application and security logs: typically up to 90 days.
- Security events: typically up to 90 days.
- Login attempt and rate-limit files: short-lived operational files (generally minutes to 24 hours).
- Abandoned pending booking holds: cleaned when stale (heartbeat-based cleanup).
- E-book pending checkouts: marked failed after timeout; download tokens are time-limited.
- Companion library sign-ins: a sign-in link works once and expires after 60 minutes, and is deleted a day later; a device stays signed in for 90 days, or until you sign out, and its record is then deleted.
- Lash Try-On usage records: to enforce fair-use limits and prevent abuse, we keep a short usage log (style/intensity chosen and a one-way hashed device/IP identifier — never a raw IP address or your photo) for up to 90 days, after which it is automatically deleted. Your photo itself is never stored on our servers.
- Training waitlist: kept until lash training has been announced or you ask to be removed, whichever comes first.
- Lash training applications: kept until 12 months after the course you applied for starts, then deleted, unless you take up a place, in which case they become part of your student record. You can ask us to delete your application at any time, and deleting your client account also deletes any application made with its email address.
- Course seat deposits: a paid deposit is a payment record, kept for as long as tax and accounting rules require even if your application is deleted. Seats offered but not paid for are deleted with the application.
- Road to Lash Tech: kept while you are getting the emails. A sign-up nobody confirms is deleted after 30 days. If you unsubscribe, we keep only your email address and the date, so that we never email you again by mistake; whether you opened or clicked each email is kept only as anonymous totals. You can ask us to delete even that.
- Account deletion requests: account profile is anonymized while certain business records may be retained for legal/accounting obligations.
Where longer retention is required by law, tax/accounting obligations, fraud prevention, or legal claims, we retain only what is necessary.
9. Cookies and Tracking
We use strictly necessary cookies for core website and account functions, plus limited privacy-friendly analytics on non-staff website areas to understand pageviews and key conversion events. See our Cookie Policy for details.
10. Security
We implement technical and organisational safeguards appropriate to the nature of the data we process, including access controls, session protections, rate limiting, input validation, and security/event monitoring. No system can be guaranteed 100% secure.
11. Your Rights
Subject to law, you may request access, correction, deletion, restriction, objection, and data portability. You may also withdraw consent where processing is consent-based (for example marketing). Contact info@aliyasbeauty.co.uk.
12. Children and Age Restrictions
Our services are intended for users aged 16 and over. Clients aged 16-17 require parent/guardian consent in accordance with our terms and treatment policies.
13. Complaints
If you are not satisfied with our response, you may raise a complaint with the UK Information Commissioner’s Office (ICO).
14. Updates to This Policy
We may update this policy from time to time. Material changes will be reflected by updating the version and date shown above.