Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Information: Business name, email address, username, and password when you create an account
• Business Information: Your business type (salon or clinic), booking URL, and contact details
• Payment Information: Payment card details processed securely through Stripe
• Client Data: Information about your clients that you input into the system, including names, contact details, appointment history, and treatment records

1.2 Information Collected Automatically

• Usage Data: Information about how you use our services, including features accessed and time spent
• Device Information: Browser type, operating system, and device identifiers
• Cookies: See our Cookie Policy for details

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process your transactions and manage your subscription
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and customer service requests
• Monitor and analyse trends, usage, and activities
• Detect, investigate, and prevent fraudulent transactions and abuse
• Comply with legal obligations

3. Legal Basis for Processing (UK GDPR)

We process your personal data on the following legal bases:

• Contract: Processing necessary to perform our contract with you (providing the LightDay service)
• Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention and service improvement
• Legal Obligation: Processing necessary to comply with legal requirements
• Consent: Where you have given consent for specific processing activities

4. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Third-party vendors who perform services on our behalf (e.g., Stripe for payment processing, cloud hosting providers)
• Legal Requirements: When required by law, court order, or governmental authority
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal data to third parties.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you services. We will also retain and use your information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. When you close your account, we will delete or anonymise your data within 90 days, unless retention is required by law.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, secure servers, and regular security assessments. However, no method of transmission over the Internet is 100% secure.

7. Your Rights Under UK GDPR

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request restriction of processing
• Portability: Request transfer of your data to another service
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, please contact us at the details below.

8. International Transfers

Your data may be transferred to and processed in countries outside the UK. Where we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

9. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact Us