Privacy Policy

• Account — your email, display name, phone number (if you sign in by phone, or as a provider’s contact), and (for providers) salon details.
• Bookings — the services, dates and amounts you book.
• Content — photos, videos, captions, reviews and messages you post.
• Payments — card details are entered with our payment processor (Stripe); we never see or store your full card number, only the result (amount, status).
• Approximate location — estimated from your IP address to show salons near you. To do this your IP is sent to a third-party geolocation provider; we don’t store the IP used for this lookup (the separate sign-up record below is the one case where we do keep one).
• Campaign links — when you arrive through one of our campaign links or from a search engine, we remember which one it was and, if you sign in, link it to your account, only to see which campaigns bring sign-ups and bookings. We keep the campaign that brought you and the one behind each booking with your account; each individual visit is unlinked from your account after 90 days. It is never sold.
• Sign-up origin — when you create an account we record the IP address you signed up from and the country it resolves to. We use this only to detect fraud and abuse (fake accounts, booking spam) and keep the platform safe. It is deleted with your account.
• Precise location — only if you grant location permission (the map’s “use my location”); used to find salons near you and never stored.
• Usage & device data — basic logs to keep the service secure and working.
• Session recordings — we use Microsoft Clarity to record how pages are used (mouse movement, clicks, scrolling and the screens you see) so we can find what’s broken or confusing. See Cookies & local storage below.
• Instagram messages — only for salons that connect their Instagram account to our AI receptionist, and only to draft the replies the salon approves and to show the salon its conversations. See Instagram direct messages below.

To provide the service — show salons, take and manage bookings, process payments and payouts, send booking notifications, detect fraud and abuse, keep the platform safe, and improve the product.

The salon/provider you book with sees your booking details. We use service providers to run Glowzi: our own self-hosted infrastructure on servers rented from Hetzner Online GmbH (database, auth and storage), Stripe (payments), Twilio and Infobip (SMS verification codes and appointment reminders), Anthropic (the AI model behind Ask Glowzi, the Instagram receptionist below, and the short descriptions of salons’ work photos in our photo galleries), OpenFreeMap and Photon/OpenStreetMap (maps & address search), Cloudflare (media delivery and our nightly database backups), Meta (advertising measurement — see Cookies & local storage below), Microsoft Clarity (session replay and click heatmaps), PostHog (product analytics, EU-hosted), and an IP-geolocation provider (to estimate your approximate location and to resolve the country your sign-up IP belongs to). These providers process data only to provide their service to us, except Meta, which also uses what the Pixel sends for its own purposes. We do not sell your personal data.

A salon can connect its Instagram professional account to Glowzi so that our AI receptionist drafts replies to its clients’ direct messages. Each draft waits in the salon’s Glowzi inbox, where the salon can edit, send or discard it; a reply is sent only when the salon approves it, and a draft not approved before Meta’s 24-hour reply window closes is never sent. For those messages Glowzi acts for that salon, and we receive the data from Meta through the Instagram API, under Meta’s Platform Terms.

• What we read and keep — the text of direct messages sent to the connected account and the replies in those conversations (typed by the salon, or drafted by the AI and approved by the salon), the AI’s draft replies (including ones the salon edited or discarded, or that were never sent), each sender’s Instagram ID and username, and when each message was sent. If the salon lists Instagram accounts under “Never draft replies to these accounts”, we keep those usernames until the salon removes them, disconnects Instagram or asks us to delete its data. We don’t keep copies of photos, voice messages or other attachments. For the connection itself we keep the account’s ID and username and an access token, stored encrypted.
• Why — only to draft replies the salon approves, using the salon’s own Glowzi profile (services, prices, opening hours and free times), and to show the salon its conversations. We never use these messages for Glowzi’s own marketing or advertising, never to build profiles of anyone, never share them with other salons, never send them to our analytics or advertising tools, and never sell them.
• AI — an AI model from Anthropic, processed in the United States, receives the conversation text and the salon’s Glowzi details (never Instagram IDs or usernames) and writes a draft reply; it processes them only on our behalf. Nothing is sent until the salon approves the draft, and the salon can take over a chat, switch the AI off or disconnect at any time.
• How long — messages, the AI’s drafts and conversations are deleted automatically after 90 days, and the technical record of each delivery from Instagram after 30 days. If a client asked us to stop, we then keep only a note of it — the client’s Instagram-scoped ID and the dates and status of that conversation, with no message text and no username — so the AI never drafts for that client again while the salon stays connected. Our nightly backups are kept for 14 days, so deleted data can remain in a backup for up to 14 days.
• Deleting it — a salon can disconnect Instagram in Glowzi (Visibility → AI Receptionist), which destroys the access token at once and deletes its stored conversations. Removing Glowzi in Instagram (Settings and activity → Website permissions → Apps and websites) ends our access; to have the stored messages deleted as well, disconnect in Glowzi first or email support@glowzi.com. How a deletion request works: glowzi.com/instagram-data-deletion. If you wrote to a salon on Instagram and want your messages deleted, email support@glowzi.com.

You can access, correct, or delete your data. You can delete your account at any time from your account screen — this removes your profile, bookings, likes, reviews and messages. If you run a salon, deleting your account also disconnects Instagram and deletes the Instagram messages we hold for your salon. Under GDPR you may also object to or restrict processing; contact us to exercise these rights.

If a public authority asks us for someone’s personal data, we check that the request is lawful before acting on it, challenge it if it is not, disclose only the minimum the law requires, and keep a record of each request, our response and the reasons for it.

We keep your data while your account is active and as needed to provide the service or meet legal obligations. When you delete your account, your personal data is removed. The IP address recorded when you sign up is kept for 12 months and then deleted; we keep the country it resolved to, which no longer identifies you. Instagram messages are kept for at most 90 days (see Instagram direct messages above).

We use a session cookie to keep you signed in and local storage to remember your language preference. We also run the Meta (Facebook) Pixel on every page: it sets its own cookies (_fbp, _fbc) and reports page views and key actions — viewing a salon, starting a booking, confirming a booking, creating an account, and submitting the salon sign-up form — to Meta so we can measure our advertising. Some of those actions (not page views) are also sent a second time from our server to Meta’s Conversions API — including, for providers, a signal when a salon profile is created — and where you are signed in they include a hashed (irreversible) form of your email or phone number, along with your IP address and browser details, so Meta can match the event to you. We also run Microsoft Clarity, which records session replays and click heatmaps of how the site is used, and PostHog, which counts which pages and features are used so we can see where people get stuck. PostHog stores its data in the EU; we don’t send it your email, phone number or name, and links that contain a one-time code have that code removed before the event leaves your browser. Both load automatically; you can stop them with your browser’s tracking protection or an ad blocker.

Glowzi is not intended for anyone under 16. We don’t knowingly collect data from children.

We may update this policy; we’ll change the date above and, for material changes, notify you in the app.