Privacy policy
This page explains what information HummiLashes collects when you book an appointment through this website, why, and what your rights are over it.
What we collect
When you make a booking, we collect:
- Your name and phone number (or Instagram handle)
- Your email address, if you choose to give one, to send a booking confirmation
- The service, date and time you’ve booked
- Payment status (whether a deposit or full payment has been made) — card details themselves are handled entirely by Stripe and never reach or pass through this site
- Anything you choose to add in the notes field, which may include health-related information such as allergies
Why we collect it
This information is used solely to manage your appointment: to hold your slot, confirm the booking, contact you if anything changes, and take payment. Where you’ve shared health-related information (like allergies), this is used only to inform your treatment and is treated as sensitive data under UK GDPR — you’re only asked for this because you’ve chosen to share it, and it’s never used for any other purpose.
Who we share it with
A small number of trusted service providers process this data on our behalf, purely to run the booking system:
- Stripe — processes payments; we never see or store your card details
- Supabase — securely hosts the booking database
- Resend — sends booking confirmation emails, if you provide an email address
None of your information is sold, shared for marketing, or given to anyone else.
How long we keep it
Booking records are kept for as long as reasonably needed for business and accounting purposes. If you’d like your data removed sooner, just get in touch (see below) and we’ll delete it, unless we’re required to keep certain records for legal or tax reasons.
Your rights
Under UK GDPR, you can ask to see what data we hold about you, ask us to correct it, or ask us to delete it. To do any of these, contact HummiLashes via @HummiLashes.
Cookies
This site uses a single essential cookie to keep the studio owner logged in to the admin dashboard. It isn’t used for tracking or advertising, and nothing else is set for visitors browsing or booking on the public site.