Privacy Policy

The controller of the personal data processed on this platform is Rafael Martins, trading as Beautly, an individual sole trader established in the Netherlands.

For privacy matters, and to exercise any of the rights in section 9, write to support@beautly.app.

Paddle.com Market Ltd is the Merchant of Record for every order placed on this website. For the payment data it collects at checkout, Paddle acts as an independent controller under its own privacy policy — we never receive or store your card details.

We collect the data needed to run the platform: name, e-mail, phone number, business details (legal name, tax identifier, address) and usage information (access logs, features used). If you enable the Google Calendar integration, we also store the OAuth token you grant and use appointment data (date, time, client name and service) to create events in your calendar.

Billing data — billing address, country, tax identifier and payment details — is collected by Paddle.com Market Ltd at checkout. We receive from Paddle only what we need to run your subscription: your name, e-mail, country, plan, and the status and amounts of your transactions.

We process personal data for the following purposes and on the following legal bases under Article 6 of the GDPR:

• Providing the service you signed up for — performance of a contract (Art. 6(1)(b));
• Operational notifications (welcome, password reset, reminders, service notices) — performance of a contract (Art. 6(1)(b));
• Billing, invoicing, tax and bookkeeping — legal obligation (Art. 6(1)(c));
• Security, abuse and fraud prevention, and improving the platform — legitimate interests (Art. 6(1)(f));
• Analytics and marketing cookies (Google Analytics, Meta Pixel) — consent (Art. 6(1)(a)), which you may withdraw at any time from the cookie banner.

We do not sell your data. We share it only with the suppliers listed below, all bound by contractual confidentiality obligations (a Data Processing Agreement) and barred from using your data for their own purposes. No separate signature is involved for Cloudflare: its Data Processing Addendum is incorporated into the subscription agreement we accepted when the account was opened.

The Google Calendar integration is optional and is enabled by you in your account settings. Our use of information obtained through Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

5.1 Data accessed. When you authorise it, you grant access to the https://www.googleapis.com/auth/calendar.events scope, which allows creating, updating and deleting events in the salon's Google Calendar. Beautly does not read existing events in your calendar and does not access any other Google data (profile, contacts, e-mail and so on).

5.2 Use of the data. Appointment data (date and time, client name, service and staff member) is sent to Google Calendar solely to create and maintain events mirroring the appointments recorded on the platform. That data is never used for advertising, market research, training AI/ML models or any purpose other than calendar sync.

5.3 Sharing. The OAuth token and the appointment data are transmitted only to the Google Calendar API to carry out the authorised operations. No data obtained through Google APIs is shared with any other third party, resold or used outside this integration.

5.4 Storage and protection. The OAuth token is stored securely in a PostgreSQL database, isolated per salon (tenant), reachable only from Beautly's servers. It is never exposed to the end user's browser. When it expires it is renewed automatically via the refresh token, without asking you again.

5.5 Retention and deletion. The OAuth token is deleted immediately when you disconnect the integration in your settings. It is also deleted automatically if you revoke access directly at myaccount.google.com/permissions. When an account is closed, all tokens are deleted within 90 days under the general retention rule in section 8. To have it deleted sooner, e-mail support@beautly.app.

The data of your own clients (appointments, history, contact details) belongs to your business. For that data you are the controller and Beautly is the processor under Article 28 of the GDPR: we process it only on your documented instructions and only as far as needed to provide the service. You are responsible for having a lawful basis to collect it and for informing your clients.

Beautly runs on a self-hosted server in the Netherlands, operated directly by us rather than by a cloud provider. Physical access to the machine is limited to the operator.

The measures in place are: encryption in transit (HTTPS/TLS 1.2+), passwords stored as bcrypt hashes, sessions that time out after 16 hours, role-based access control, and hourly backups. We describe what exists; we do not promise a level of physical security or availability beyond it, and section 17 of the Terms of Service states that no uptime is guaranteed.

We do not store card details — payments are processed by Paddle.com Market Ltd.

Data is kept while the account is active. After cancellation, data is deleted within 90 days, unless a longer legal retention obligation applies (for example invoicing and tax records, which must be kept for the period required by the applicable tax law). Authentication logs are kept for no more than 90 days.

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing carried out before withdrawal.

To exercise any of these rights, e-mail support@beautly.app with the subject “GDPR request” and the e-mail address on your account. We reply within one month, as required by Article 12(3).

You also have the right to lodge a complaint with the data protection supervisory authority of the EU Member State where you live, work or where you believe an infringement took place.

We use strictly necessary cookies for authentication and for the app to work. Analytics cookies (Google Analytics) and marketing cookies (Meta Pixel) are only loaded after you give explicit consent in the cookie banner. You can withdraw consent at any time by clearing this site's data in your browser settings.

Beautly is established in the Netherlands and the server that runs the platform is in the Netherlands. Your data is therefore processed inside the European Economic Area, and no transfer outside it is needed to provide the service.

Transfers outside the EEA happen only through the suppliers listed in section 4, in the countries stated in that table. Each one relies on the safeguards in Chapter V of the GDPR — Standard Contractual Clauses approved by the European Commission, or an adequacy decision where one exists, as for the United Kingdom. You may ask us for a copy of the relevant safeguards at support@beautly.app.

The hourly backups are stored on Cloudflare R2 in the Western Europe region, so the data at rest also stays inside the European Union.

Privacy contact: support@beautly.app. That address reaches the controller directly.

Article 27 of the GDPR requires a written representative inside the Union only from controllers not established in the Union. Beautly is established in the Netherlands, an EU Member State, so Article 27 does not apply and there is no representative to name: you are already dealing with an establishment in the Union.

We have not appointed a Data Protection Officer either. Article 37 makes one mandatory for public authorities, for controllers whose core activity is large-scale regular and systematic monitoring of data subjects, or large-scale processing of special categories of data. None of those describes Beautly. The contact above serves the same practical purpose for you.