Privacy policy
Last updated: September 9, 2026
This is a skeleton, not a policy. It has not been reviewed by a lawyer and should not be published in this state. Everything marked below needs your real details before this page goes live.
Who we are
The legal entity name, the trading name, the registered address and the email address people should use for privacy questions. If you have a data protection officer or an EU or UK representative, they go here too.
What we collect
List it honestly and specifically: name and email from the newsletter form, account details for members, anything the app collects, payment information and who actually handles it, support messages, and whatever your analytics records. Say what is required and what is optional.
Why we collect it, and on what basis
For each thing above, the purpose. If you have anyone in the EU or UK, you also need the lawful basis for each: consent, contract, legitimate interests.
Who we share it with
Every processor by name. Your email provider, payment processor, hosting, analytics, scheduling and any AI services in the product. Say whether data leaves its country of origin and how that transfer is covered.
Cookies and tracking
What is set, by whom, what it does and how long it lasts. If you use anything beyond strictly necessary cookies for EU or UK visitors, you need consent before it loads, not a banner that only informs.
How long we keep it
A retention period for each category, or the rule you use to decide.
Your rights
These differ by where the person lives. GDPR gives access, correction, deletion, portability and objection. California adds its own, including the right to opt out of sale or sharing. Say how someone exercises them and how fast you respond.
Children
State the minimum age for an account and what you do if you learn a child has signed up. Beauty schools may mean some students are under eighteen, which is worth raising with your lawyer.
Changes and contact
How you announce changes, and the address for privacy questions.