Privacy Policy

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR) is:

Sviatoslav Karapka
Bahnstraße 36
16727 Velten
Germany
E-Mail: info@lushly.world
Phone: +49 152 0677 7974

2. General information on data processing

Lushly is an online marketplace that connects end customers with independent beauty and wellness salons. We process our users' personal data exclusively to the extent necessary to provide a functional website, our content, and our services.

The processing of our users' personal data regularly occurs only with the user's consent or for the fulfillment of a contract. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the data processing is permitted by legal regulations.

The legal bases are Art. 6 para. 1 lit. a (consent), lit. b (contract fulfillment), lit. c (legal obligation) and lit. f GDPR (legitimate interest).

3. What data we collect

3.1 Upon customer registration

• First and Last Name
• Email address
• Phone number (optional)
• Password (stored encrypted with bcrypt)
• Profile picture (optional, uploaded by user or via Google/Facebook during OAuth login)
• Language preference

3.2 Upon salon / master registration

• Business name, address, phone, email address
• Description, Photos, Prices, Services, Opening Hours
• Upon Stripe activation: Bank details and tax-relevant data — stored exclusively with Stripe, not with us
• Master Profile (Name, Photo, Languages, Experience, Portfolio) — set by the salon operator

3.3 When booking

• Name, email address, phone number of the booking customer
• Selected service, date, time, price, duration
• For consultation inquiries (e.g., tattoo): Description of the idea, dimensions/body placement, reference photos if applicable
• For online payments: no card data with us — processing is handled exclusively by Stripe (PCI-DSS Level 1 certified)
• For paid salon subscriptions: Name, email address, and billing address for invoicing, as well as a customer and subscription ID from Stripe. Payment methods (card, SEPA mandate) are stored exclusively with Stripe
• Reviews (1–5 stars) and comments after completed booking
• Chat messages between customer and salon (via the platform's internal messaging function)

3.4 Automatically collected data (server logs)

• IP address (anonymized after 7 days)
• Browser type and version, operating system
• Date and time of access
• Referrer URL (previously visited page)
• Geographical region (approximate, at city level based on IP)
• Session ID for platform-specific analytics (without personal reference)

This data is used for security and platform-specific analysis (bounce rate, traffic sources, performance). Data is only transmitted to external services like Google Analytics or Meta if the user has explicitly agreed in the cookie banner (analysis cookies for Google Analytics or marketing cookies for the Meta pixel).

3.5 Location data (Geolocation)

With the user's explicit consent (browser permission "Find Nearby"), the approximate location is used to display salons in the area. The location is processed exclusively client-side and is not stored in our database.

4. Purpose and legal basis of processing

5. Sharing with third parties (data processors)

We only share data in the following cases and on the basis of corresponding data processing agreements (DPAs) in accordance with Art. 28 GDPR.:

• IONOS SE (Montabaur, Deutschland) — Platform hosting. Servers are located in Germany. GDPR compliant.
• Stripe Payments Europe, Ltd. (Dublin, Irland) — Payment processing. PCI-DSS Level 1 certified, GDPR compliant. Stripe Privacy Policy
• Booking Salon — receives name, contact, and booking details for contract fulfillment. Salons are independent controllers under the GDPR.
• Google Ireland Limited (Gemini API) — automatic translations of UI texts and salon descriptions. Only public content (e.g., salon descriptions) is transmitted, no personal data of end customers. Google Privacy
• Groq, Inc. (USA) — AI-Insights for salon owners. Only aggregated and anonymized statistics are transmitted. Standard contractual clauses according to Art. 46 GDPR ensure data protection.
• Meta Platforms Ireland Limited (Meta Pixel) — only after explicit consent in the cookie banner. Used exclusively for marketing campaigns. Meta Privacy
• Google Ireland Limited (Google Analytics 4) — only after explicit consent in the cookie banner (analytics cookies). Used for anonymized reach and usage analysis; IP addresses are shortened/anonymized. Data transfer to the USA based on the EU-US Data Privacy Framework and/or EU standard contractual clauses. Google Privacy
• SMTP Provider (WP Mail SMTP Provider) — Sending transactional emails (booking confirmations, reminders, password resets).
• n8n (self-hosted, EU) — Automation workflows. Servers in the EU.

No further disclosure to third parties will occur. In particular, we do not sell any data.

5a. AI Usage (Artificial Intelligence)

We use artificial intelligence (AI) in two areas:

1. Translations: For the multilingual provision of our content, we use the AI system Google Gemini (Google Ireland Limited). Translations of non-German content may be machine-generated; the German original version is always authoritative.

2. AI Support Chat: Our support chat (in the messenger and on the help page) is answered by an AI assistant (chatbot). At the beginning of the chat, you will be clearly informed that you are communicating with an AI system (Art. 50 AI Regulation). For personal assistance, you can always contact info@lushly.world.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract) and lit. f GDPR (legitimate interest in efficient support and multilingual provision).

5b. Marketplace (Jobs & Spaces)

In our listings section ('Jobs & Spaces'), logged-in users can publish their own listings (e.g., job offers, room and workstation rentals) and respond to other users' listings. The following data is processed:

Create listing: Title, description, category, location, price, as well as the contact details you provide (email and/or phone number) and optionally uploaded images. This information is publicly visible, with the exception of contact details. Your contact email will not be directly displayed to interested parties, but only used to forward inquiries.

Reply to a listing: When you reply to a listing via the contact form, your name, email address, and message will be forwarded via email to the advertiser so they can reply to you. The contact details of both parties remain hidden on the platform.

Favorites (Watchlist): When you save listings, we store the corresponding listing IDs in your user account so you can find them again later.

Saved searches and notifications: You can save search criteria (e.g., category, location, keyword). We save these criteria in your account and send you an email notification as soon as a new listing matches your saved search. You can stop these notifications at any time by deleting the saved search in your account.

View statistics: To display the view count of a listing, we temporarily store a pseudonymized (hashed) value of your IP address to prevent multiple counts. Individual persons are not identified in this process.

Reports: If you report a listing, we process the stated reason and an optional note to review the listing.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of functions requested by you) and lit. f GDPR (legitimate interest in a functional, abuse-free marketplace). Notifications for saved searches are based on lit. b and your revocable use of this function at any time.

Visibility of Your Information: The title, description, category, location, price, and images of a listing are publicly visible and can be indexed by search engines. Your email address and phone number will NOT be publicly displayed — they are used exclusively for sending notifications. You can get in touch through the internal messaging area.

After Expiration: Expired listings are removed from the overview and search, but remain in your account until you delete them. If you delete a listing, we remove its content and images. Conversations that have already taken place remain unaffected so that both parties retain the history.

Reports: If you report a listing, we store the report with the timestamp and — if logged in — your user ID. This is necessary to identify multiple reports and keep the process transparent. Legal basis: Art. 6 para. 1 lit. c GDPR in conjunction with Art. 16 of Regulation (EU) 2022/2065, as well as Art. 6 para. 1 lit. f GDPR. Storage duration: twelve months.

5c. Telegram Assistant

Salons and professionals can voluntarily connect their account with our Telegram Assistant to receive and directly respond to booking requests. The connection is optional and can be revoked at any time — in your account under "Telegram Assistant" or by using the /stop command in the chat.

The following are processed: the Telegram chat ID, the display name stored there, the chosen language, and the content of notifications (appointment, service, abbreviated client name, messages from the chat). Full names, phone numbers, and email addresses are intentionally not transmitted to Telegram.

Transfer to a Third Country: The provider is Telegram FZ-LLC, Dubai, United Arab Emirates. There is no adequacy decision by the European Commission for the UAE. The transfer takes place based on your explicit consent according to Art. 49 para. 1 lit. a GDPR, which you give by connecting your account. No transfer occurs without a connection.

Client History in the Assistant: When viewing a booking, the salon can see the client's past history at their own salon: number of visits, date of the last visit, services rendered, the salon's own notes, and no-shows. These are data that the salon already manages — they are merely presented differently.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent) for the transfer to Telegram, Art. 6 para. 1 lit. b GDPR for the display of the history. Storage duration: until the connection is disconnected.

5d. Protection against unauthorized access

To protect your accounts, we log failed login attempts, including IP address, time, and username. If multiple failed attempts originate from a single network, it will be temporarily blocked — starting from one hour up to seven days.

This block is an automated measure and does not have legal effect under Art. 22 GDPR: it only affects access to the login screen, not an existing contract. Blocks expire automatically and can be lifted immediately upon request.

Legal basis: Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to protect our users' accounts from unauthorized access. Storage duration: 90 days.

5e. Email Confirmation, Favorites List, and Waitlist

Email Confirmation: After registration, we'll send you a confirmation link. We store a one-time encrypted token and the time it was sent. Without confirmation, you can't post listings. Legal basis: Art. 6 para. 1 lit. b and lit. f GDPR.

Notifications for favorited listings: If you favorite a listing, we store its ID and the time. This generates two types of messages: a notification if the listing's price or status changes, and a one-time reminder after two days if you haven't contacted the provider yet. Both can be turned off under Account → Emails. Legal basis: Art. 6 para. 1 lit. f GDPR.

Waitlist: If an appointment is fully booked, you can add yourself to the waitlist. We store your desired appointment, contact details, and a one-time token for the confirmation link. Data is deleted after 30 days or upon cancellation. Legal basis: Art. 6 para. 1 lit. b GDPR.

5f. Review of uploaded images

Every uploaded image is automatically checked for: metadata indicating AI generation (C2PA, IPTC), embedded program components to protect against malware, and matches with already known AI images.

For this purpose, we calculate a short numerical value from the image that describes its general brightness structure. The image cannot be recreated from this value; it is used solely for comparison. Facial recognition or person identification does not occur.

Legal basis: Art. 6 para. 1 lit. c GDPR (labeling requirement according to Art. 50 AI Regulation) and Art. 6 para. 1 lit. f GDPR (security of our systems).

6. Cookies and similar technologies

We only use technically necessary cookies (login sessions, security, cookie consent status, language selection). These cookies are essential for the platform's operation and are set without consent in accordance with § 25 (2) TDDDG.

Marketing cookies (Meta Pixel) are only set after your explicit consent via our cookie banner. You can withdraw your consent at any time.

For our platform's own analysis, we additionally store anonymized data in our own database (first-party).

Google Analytics 4. With your express consent (analytics cookies in the cookie banner), we use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies to evaluate website usage — such as page views, time spent, devices used, and approximate geographic origin. IP addresses are processed anonymously or truncated. Data may be transferred to Google servers – including in the USA; the transfer is based on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses in accordance with Art. 46 GDPR. The legal basis is your consent in accordance with Art. 6 Para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future via the cookie settings. Google Privacy Policy

7. Storage duration

• Customer account: until deleted by the user
• Booking data: 10 years (tax law retention obligation according to § 147 AO)
• Reviews: permanent, until user deletes (pseudonymisation possible)
• Analytics sessions: 12 months
• Server logs: 30 days
• IP addresses: 7 days, then anonymization
• Chat messages: until account deletion
• Email marketing consent: until revoked

8. Your rights as a data subject

As a data subject, you have the right at any time to:

• Information (Art. 15 DSGVO) — what data we process about you
• Correction (Art. 16 DSGVO) — Correction of incorrect data
• Deletion (Art. 17 DSGVO) — "Right to be forgotten"
• Restriction of processing (Art. 18 DSGVO)
• Data portability (Art. 20 DSGVO) — Data in machine-readable format
• Objection (Art. 21 DSGVO) — against processing based on legitimate interest
• Withdrawal of consent (Art. 7 Abs. 3 DSGVO) — effective for the future

Account deletion is possible at any time under: Mein Konto → Settings
Please send inquiries regarding data protection rights via email to: info@lushly.world

9. Right to lodge a complaint with a supervisory authority

In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority — particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement.

Our contact is:
The State Commissioner for Data Protection and the Right to Inspect Files Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
Phone: +49 33203 356-0
https://www.lda.brandenburg.de/

10. Data security

We use SSL/TLS encryption (HTTPS) for all data transfers. Passwords are hashed with bcrypt and never stored in plain text. Payment data is processed exclusively by Stripe (PCI-DSS Level 1). Backups are stored encrypted.

11. Third-country transfer

If data is transferred to third countries, it is done on one of the following bases. To the USA — for example, via Groq, the Meta Pixel, or Google Analytics — based on the EU Standard Contractual Clauses according to Art. 46 GDPR and/or an adequacy decision according to Art. 45 GDPR (e.g., EU-US Data Privacy Framework). To the United Arab Emirates — exclusively via the optional Telegram assistant, see Section 5c — based on your explicit consent according to Art. 49 para. 1 lit. a GDPR; there is no adequacy decision for the UAE. This transfer does not occur without connecting the Telegram assistant. We carefully verify the recipients.

12. Automated decisions, profiling

We do not use fully automated decision-making processes with legal effect. Automatically generated weekly insights for salon owners are for informational purposes only and do not constitute a legally binding decision.

13. Push Notifications (PWA)

Lushly is a Progressive Web App (PWA). Push notifications are only sent after explicit user consent (browser permission). Consent can be revoked at any time in the browser settings.

14. Social Logins (Google / Facebook OAuth)

When signing up via Google or Facebook, the following data is transmitted to us: name, email address, and profile picture. Other data from your Google/Facebook profile is not retrieved. Google's and Meta's privacy policies also apply.

15. Changes to this Privacy Policy

We reserve the right to occasionally update this privacy policy to adapt it to current legal requirements or to implement changes to our services. The current version is always available on this page. In the event of significant changes, registered users will be informed by email.