Privacy Policy

1.What data we collect

We collect only what is necessary to operate the site and fulfil your orders.

• —Contact form: name, email address, message text.
• —Product orders: name, email, phone, delivery address, order contents.
• —Session bookings: name, email, phone, chosen service and time.
• —Waiting list: if you ask to be told when time frees up on a fully booked day — the chosen service, date, specialist (or "any"), the language for messages, and one contact of your choice: an email address, or the Telegram chat linked to your account.
• —Technical data: IP address, browser type, request time — stored in hosting logs.
• —Visit statistics: we use Vercel Web Analytics, which counts page views without cookies and without building a profile of you (details in the section on who receives data).
• —Abuse prevention: when you submit a form on the site, we compute SHA-256 hashes of your IP address and the email you provide — not the address or email itself — to detect an excessive number of attempts.
• —Notification log: which messages about your order or booking we sent you — the type of message, the channel (email or Telegram), the outcome and the time. The log holds neither the message text nor the addresses, and is kept together with the order or booking.

2.Legal bases for processing

• —Your consent — for contact form enquiries, the waiting list, and newsletters.
• —Performance of a contract — for processing orders and bookings.
• —Legitimate interest — for site security and abuse prevention.
• —Legal obligation — for retaining accounting records.

3.How long we keep data

• —Contact form enquiries — up to 12 months from the last correspondence.
• —Order data — for the period required by Ukrainian tax law.
• —Technical logs — up to 30 days.
• —Abuse-prevention hashes — up to 24 hours.
• —Waiting list — no longer than the end of the chosen day: the entry is deleted the next day, and sooner as soon as you book through our message, unsubscribe through the link in it, or delete your account.

4.Who we share data with

We do not sell your data. It is shared only with service providers necessary for the site to function:

• —Supabase — database hosting, user authentication (email/password or Google sign-in), and sending account confirmation and password-reset emails; servers located in Germany (Frankfurt, EU).
• —Vercel Inc. — website hosting, computation performed in Frankfurt (EU) under EU Standard Contractual Clauses.
• —Vercel Web Analytics (Vercel Inc.) — page-view statistics. It sets no cookies. For each page view it receives: the page address without its query string or fragment (#), the page you came from, browser type, operating system, device type and the country derived from your IP address. To tell visitors apart it uses a temporary anonymous identifier computed from the request itself and changing every day, so you cannot be followed from one day to the next; your IP address is only used for that and is not stored. Account, admin, sign-in, booking-management, review and waiting-list entry pages are not included in the statistics. Vercel keeps this data for a limited time (currently up to one month).
• —Telegram — when you place an order or book a session, your name, email, phone, delivery address (for orders), and comment text are sent to the shop's Telegram chat so staff can process the order or booking.
• —Resend — sending order, booking, and reschedule confirmation emails, and waiting-list messages about freed-up time, to your inbox.
• —Cloudflare (Turnstile) — verifies that a form on the site is being filled in by a human, not a bot; this processes technical data from your browser.
• —Sentry — technical error monitoring; we do not send form contents, passwords, or access tokens to it, only technical information about the failure. Data is processed on servers in the EU.
• —Google — if you choose to sign in with Google, Google verifies your identity and shares your name, email, and profile photo with us.
• —Delivery services — we share your address solely to ship your order.

5.International data transfers

Our servers are located within the European Economic Area. Some service providers are US companies — Standard Contractual Clauses approved by the European Commission are in place with them.

We are registered in Ukraine. This means your data may be processed by our staff outside the EEA. We apply appropriate safeguards and provide further information on request via hello@example.com.

6.Your rights

Under the GDPR you have the right to:

• —access your data and receive a copy of the processed information;
• —request correction of inaccurate data;
• —request erasure where there is no legal basis for retention;
• —restrict or object to processing;
• —receive your data in a machine-readable format;
• —withdraw consent at any time;
• —lodge a complaint with a data protection supervisory authority.

7.Account deletion

If you have an account, you can delete it yourself from the "Account" section on the site, or by contacting us at hello@example.com.

Deleting your account permanently removes your login and erases personal data — name, email, phone, address, and comments — from your orders and bookings, and fully deletes any specialist session notes about you. The order and booking records themselves remain in the system in anonymised form, as required for accounting and tax record-keeping. In the notification log, the providers' message identifiers and delivery-error texts are removed; the record that a message was sent remains with the anonymised order or booking.

Your waiting-list entries — including any made without signing in, under the same email address — are deleted entirely.

8.Cookies and browser storage

The website uses no advertising or analytics cookies. This is everything we store on your device:

• —Cookie NEXT_LOCALE — remembers the language you chose when it differs from your browser's language; it lasts until you close the browser.
• —Sign-in cookie (Supabase, name starting with sb-) — appears only if you sign in to an account; it keeps your session.
• —Cookie pw_reset_locale — appears only if you request a password reset; it contains only a language code for the reset page and lasts one hour.
• —Browser local storage, key cart:v1 — the contents of your cart (product identifiers and quantities). It stays on your device.
• —Browser local storage, key recentlyViewed:v1 — a list of products you recently viewed, for the matching block on the site. It stays on your device and is not sent to us.
• —Browser session storage, key templum:intro-seen — a mark that the introductory animation on the home page has already been shown; it disappears when the tab is closed.

9.Changes to this policy

We may update this policy. The current version is always available on this page, with the last update date shown at the top.