Privacy Policy

1. Data Controller

The controller for data collected through the Service is the operator of Lashly, reachable through the support channels indicated in the Service.

2. Data We Collect

We collect the following categories of data:

• Account data: business name, email, password (securely managed by Firebase Authentication) and billing data needed for any subscription.
• Data entered into the Service by the user: client records, appointments, cards (Lash Map, Lam Map), inventory products, financial transactions.
• Technical data: IP address, device and browser type, access logs, collected automatically for security and service operation purposes, plus aggregate browsing statistics on the public website collected via Google Analytics.

3. Purposes of Processing

Data is processed to:

• Provide and deliver the Service's features (scheduling, bookings, inventory, analytics, etc.);
• Manage the account, subscription and billing;
• Send service communications (confirmations, reminders, technical notices);
• Ensure the security of the Service and prevent misuse;
• Fulfill legal obligations, where applicable.

4. Legal Basis

Processing is based on the performance of the contract with the user, on the legitimate interest in ensuring the security and operation of the Service, and on consent when specifically requested (for example for optional promotional communications).

5. Data Retention

Data is retained for the duration of the account and for the subsequent period necessary to fulfill contractual, tax or legal obligations. On request, account data and data entered into the Service can be exported or deleted, subject to legal retention obligations.

6. Data Sharing

Data is never sold to third parties. To provide the Service we rely on a small number of third-party providers who process data on our behalf, to the extent necessary and in compliance with applicable regulations:

• Google Firebase / Google Cloud, for hosting, database and account authentication;
• Stripe, for processing subscription payments;
• Twilio, for sending automated WhatsApp messages (reminders and confirmations), when this feature is enabled by the account holder;
• Google Analytics, for aggregate usage statistics on the public website.

7. Security

We adopt reasonable technical and organizational measures to protect data from unauthorized access, loss or alteration, including data separation between different accounts (each business only accesses its own data).

8. Your Rights

You have the right to access, correct, delete or restrict the processing of your data, to object to processing and to request portability, within the limits provided by applicable regulations. You can exercise these rights by contacting us through the Service's support channels.

9. End Customer Data

End customer data (for example entered via online booking or client cards) is processed by the Lashly account holder as an independent data controller towards their own customers; Lashly acts in this context as the provider of the technical tool that enables its secure management.

10. Cookies

Lashly's public website uses technical cookies necessary for its operation and, only if you accept them via the banner shown on your first visit, Google Analytics cookies to collect aggregate usage statistics. We do not use advertising profiling cookies. You can change your choice at any time from the "Cookie preferences" link in the site footer.

11. Changes to this Policy

We may periodically update this Privacy Policy. Substantial changes will be communicated through the Service or by email.