Privacy Policy

1.What data we collect

We collect only what is necessary to operate the site and fulfil your orders.

• —Contact form: name, email address, message text.
• —Product orders: name, email, phone, delivery address, order contents.
• —Session bookings: name, email, phone, chosen service and time.
• —Technical data: IP address, browser type, request time — stored in hosting logs.
• —Abuse prevention: when you submit a form on the site, we compute SHA-256 hashes of your IP address and the email you provide — not the address or email itself — to detect an excessive number of attempts.

2.Legal bases for processing

• —Your consent — for contact form enquiries and newsletters.
• —Performance of a contract — for processing orders and bookings.
• —Legitimate interest — for site security and abuse prevention.
• —Legal obligation — for retaining accounting records.

3.How long we keep data

• —Contact form enquiries — up to 12 months from the last correspondence.
• —Order data — for the period required by Ukrainian tax law.
• —Technical logs — up to 30 days.
• —Abuse-prevention hashes — up to 24 hours.

4.Who we share data with

We do not sell your data. It is shared only with service providers necessary for the site to function:

• —Supabase — database hosting, user authentication (email/password or Google sign-in), and sending account confirmation and password-reset emails; servers located in Ireland (EU).
• —Vercel Inc. — website hosting, computation performed in Frankfurt (EU) under EU Standard Contractual Clauses.
• —Telegram — when you place an order or book a session, your name, email, phone, delivery address (for orders), and comment text are sent to the shop's Telegram chat so staff can process the order or booking.
• —Resend — sending order, booking, and reschedule confirmation emails to your inbox.
• —Cloudflare (Turnstile) — verifies that a form on the site is being filled in by a human, not a bot; this processes technical data from your browser.
• —Sentry — technical error monitoring; we do not send form contents, passwords, or access tokens to it, only technical information about the failure. Data is processed on servers in the EU.
• —Google — if you choose to sign in with Google, Google verifies your identity and shares your name, email, and profile photo with us.
• —Delivery services — we share your address solely to ship your order.

5.International data transfers

Our servers are located within the European Economic Area. Some service providers are US companies — Standard Contractual Clauses approved by the European Commission are in place with them.

We are registered in Ukraine. This means your data may be processed by our staff outside the EEA. We apply appropriate safeguards and provide further information on request via hello@example.com.

6.Your rights

Under the GDPR you have the right to:

• —access your data and receive a copy of the processed information;
• —request correction of inaccurate data;
• —request erasure where there is no legal basis for retention;
• —restrict or object to processing;
• —receive your data in a machine-readable format;
• —withdraw consent at any time;
• —lodge a complaint with a data protection supervisory authority.

7.Account deletion

If you have an account, you can delete it yourself from the "Account" section on the site, or by contacting us at hello@example.com.

Deleting your account permanently removes your login and erases personal data — name, email, phone, address, and comments — from your orders and bookings, and fully deletes any specialist session notes about you. The order and booking records themselves remain in the system in anonymised form, as required for accounting and tax record-keeping.

8.Cookies

The site uses only strictly necessary cookies — they keep your cart working and remember your chosen language. Analytics and advertising cookies are not set without your consent.

9.Changes to this policy

We may update this policy. The current version is always available on this page, with the last update date shown at the top.