Privacy Policy

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR) is:

Sviatoslav Karapka
Bahnstraße 36
16727 Velten
Germany
E-Mail: info@lushly.world
Phone: +49 152 0677 7974

2. General information on data processing

Lushly is an online marketplace that connects end customers with independent beauty and wellness salons. We process our users' personal data exclusively to the extent necessary to provide a functional website, our content, and our services.

The processing of our users' personal data regularly occurs only with the user's consent or for the fulfillment of a contract. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the data processing is permitted by legal regulations.

The legal bases are Art. 6 para. 1 lit. a (consent), lit. b (contract fulfillment), lit. c (legal obligation) and lit. f GDPR (legitimate interest).

3. What data we collect

3.1 Upon customer registration

• First and Last Name
• Email address
• Phone number (optional)
• Password (stored encrypted with bcrypt)
• Profile picture (optional, uploaded by user or via Google/Facebook during OAuth login)
• Language preference

3.2 Upon salon / master registration

• Business name, address, phone, email address
• Description, Photos, Prices, Services, Opening Hours
• Upon Stripe activation: Bank details and tax-relevant data — stored exclusively with Stripe, not with us
• Master Profile (Name, Photo, Languages, Experience, Portfolio) — set by the salon operator

3.3 When booking

• Name, email address, phone number of the booking customer
• Selected service, date, time, price, duration
• For consultation inquiries (e.g., tattoo): Description of the idea, dimensions/body placement, reference photos if applicable
• For online payments: no card data with us — processing is handled exclusively by Stripe (PCI-DSS Level 1 certified)
• For paid salon subscriptions: Name, email address, and billing address for invoicing, as well as a customer and subscription ID from Stripe. Payment methods (card, SEPA mandate) are stored exclusively with Stripe
• Reviews (1–5 stars) and comments after completed booking
• Chat messages between customer and salon (via the platform's internal messaging function)

3.4 Automatically collected data (server logs)

• IP address (anonymized after 7 days)
• Browser type and version, operating system
• Date and time of access
• Referrer URL (previously visited page)
• Geographical region (approximate, at city level based on IP)
• Session ID for platform-specific analytics (without personal reference)

This data is used for security and platform-specific analysis (bounce rate, traffic sources, performance). Data is only transmitted to external services like Google Analytics or Meta if the user has explicitly agreed in the cookie banner (analysis cookies for Google Analytics or marketing cookies for the Meta pixel).

3.5 Location data (Geolocation)

With the user's explicit consent (browser permission "Find Nearby"), the approximate location is used to display salons in the area. The location is processed exclusively client-side and is not stored in our database.

4. Purpose and legal basis of processing

5. Sharing with third parties (data processors)

We only share data in the following cases and on the basis of corresponding data processing agreements (DPAs) in accordance with Art. 28 GDPR.:

• IONOS SE (Montabaur, Deutschland) — Platform hosting. Servers are located in Germany. GDPR compliant.
• Stripe Payments Europe, Ltd. (Dublin, Irland) — Payment processing. PCI-DSS Level 1 certified, GDPR compliant. Stripe Privacy Policy
• Booking Salon — receives name, contact, and booking details for contract fulfillment. Salons are independent controllers under the GDPR.
• Google Ireland Limited (Gemini API) — automatic translations of UI texts and salon descriptions. Only public content (e.g., salon descriptions) is transmitted, no personal data of end customers. Google Privacy
• Groq, Inc. (USA) — AI-Insights for salon owners. Only aggregated and anonymized statistics are transmitted. Standard contractual clauses according to Art. 46 GDPR ensure data protection.
• Meta Platforms Ireland Limited (Meta Pixel) — only after explicit consent in the cookie banner. Used exclusively for marketing campaigns. Meta Privacy
• Google Ireland Limited (Google Analytics 4) — only after explicit consent in the cookie banner (analytics cookies). Used for anonymized reach and usage analysis; IP addresses are shortened/anonymized. Data transfer to the USA based on the EU-US Data Privacy Framework and/or EU standard contractual clauses. Google Privacy
• SMTP Provider (WP Mail SMTP Provider) — Sending transactional emails (booking confirmations, reminders, password resets).
• n8n (self-hosted, EU) — Automation workflows. Servers in the EU.

No further disclosure to third parties will occur. In particular, we do not sell any data.

5a. AI Usage (Artificial Intelligence)

We use artificial intelligence (AI) in two areas:

1. Translations: For the multilingual provision of our content, we use the AI system Google Gemini (Google Ireland Limited). Translations of non-German content may be machine-generated; the German original version is always authoritative.

2. AI Support Chat: Our support chat (in the messenger and on the help page) is answered by an AI assistant (chatbot). At the beginning of the chat, you will be clearly informed that you are communicating with an AI system (Art. 50 AI Regulation). For personal assistance, you can always contact info@lushly.world.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract) and lit. f GDPR (legitimate interest in efficient support and multilingual provision).

6. Cookies and similar technologies

We only use technically necessary cookies (login sessions, security, cookie consent status, language selection). These cookies are essential for the platform's operation and are set without consent in accordance with § 25 (2) TDDDG.

Marketing cookies (Meta Pixel) are only set after your explicit consent via our cookie banner. You can withdraw your consent at any time.

For our platform's own analysis, we additionally store anonymized data in our own database (first-party).

Google Analytics 4. With your express consent (analytics cookies in the cookie banner), we use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies to evaluate website usage — such as page views, time spent, devices used, and approximate geographic origin. IP addresses are processed anonymously or truncated. Data may be transferred to Google servers – including in the USA; the transfer is based on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses in accordance with Art. 46 GDPR. The legal basis is your consent in accordance with Art. 6 Para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future via the cookie settings. Google Privacy Policy

7. Storage duration

• Customer account: until deleted by the user
• Booking data: 10 years (tax law retention obligation according to § 147 AO)
• Reviews: permanent, until user deletes (pseudonymisation possible)
• Analytics sessions: 12 months
• Server logs: 30 days
• IP addresses: 7 days, then anonymization
• Chat messages: until account deletion
• Email marketing consent: until revoked

8. Your rights as a data subject

As a data subject, you have the right at any time to:

• Information (Art. 15 DSGVO) — what data we process about you
• Correction (Art. 16 DSGVO) — Correction of incorrect data
• Deletion (Art. 17 DSGVO) — "Right to be forgotten"
• Restriction of processing (Art. 18 DSGVO)
• Data portability (Art. 20 DSGVO) — Data in machine-readable format
• Objection (Art. 21 DSGVO) — against processing based on legitimate interest
• Withdrawal of consent (Art. 7 Abs. 3 DSGVO) — effective for the future

Account deletion is possible at any time under: Mein Konto → Settings
Please send inquiries regarding data protection rights via email to: info@lushly.world

9. Right to lodge a complaint with a supervisory authority

In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority — particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement.

Our contact is:
The State Commissioner for Data Protection and the Right to Inspect Files Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
Phone: +49 33203 356-0
https://www.lda.brandenburg.de/

10. Data security

We use SSL/TLS encryption (HTTPS) for all data transfers. Passwords are hashed with bcrypt and never stored in plain text. Payment data is processed exclusively by Stripe (PCI-DSS Level 1). Backups are stored encrypted.

11. Third-country transfer

Insofar as data is transferred to third countries (especially to the USA) — for example, via Groq, the Meta Pixel, or Google Analytics — this occurs on the basis of EU Standard Contractual Clauses in accordance with Art. 46 GDPR and/or an adequacy decision in accordance with Art. 45 GDPR (e.g., EU-US Data Privacy Framework). We carefully check the recipients.

12. Automated decisions, profiling

We do not use fully automated decision-making processes with legal effect. Automatically generated weekly insights for salon owners are for informational purposes only and do not constitute a legally binding decision.

13. Push Notifications (PWA)

Lushly is a Progressive Web App (PWA). Push notifications are only sent after explicit user consent (browser permission). Consent can be revoked at any time in the browser settings.

14. Social Logins (Google / Facebook OAuth)

When signing up via Google or Facebook, the following data is transmitted to us: name, email address, and profile picture. Other data from your Google/Facebook profile is not retrieved. Google's and Meta's privacy policies also apply.

15. Changes to this Privacy Policy

We reserve the right to occasionally update this privacy policy to adapt it to current legal requirements or to implement changes to our services. The current version is always available on this page. In the event of significant changes, registered users will be informed by email.