Privacy Policy

Overview

This policy explains what information is collected when you use the platform, why, who it is shared with and how long it is kept. Last updated 23.08.2026.

The platform connects clients with beauty service providers. Some information is collected by us, and some is passed directly to the business you book with — see "The business as a separate controller".

This policy covers both the beautyhub.org.il website and the BeautyHub mobile app. The app is a shell around that same website, so it collects exactly the same information — with the single exception of the notification device identifier described below, which applies to the app only.

What is collected

Information you provide when registering: name, email address, and phone number if you filled one in. Passwords are stored only as an encrypted hash — they cannot be reversed, and we have no access to them.

If you signed in with Google or Facebook, we receive your name, email address and profile picture from them. We never receive your password and have no access to your account there.

Usage information: bookings, cancellations, reviews you wrote, businesses you favourited, messages you sent through chat, and availability preferences you set.

Health declarations: a business may define a form covering allergies, medication, pregnancy and skin sensitivities. This is sensitive medical information. It is provided voluntarily, stored against the business that requested it, and visible only to that business.

Images: pictures you uploaded, and before/after photos a business saved to your client record.

Current location: only if you pressed "use my location" and approved it in the browser or the app. It is used to sort results by distance, held for that session only, and never written to the database.

Home-visit address: if you booked a treatment that comes to you, we store the address you gave — city, street, house number, apartment, floor, and, where you chose to fill them in, the building entry code, parking notes, whether there is a lift, whether there are pets, and a photo of the entrance. The address coordinates are stored too, to compute travel time and any travel fee. This is a precise address, unlike the current location above, and it is written to the database so you do not have to enter it again on every booking.

That address is visible to the business you booked the visit with and to the staff member due to arrive — they need it to reach you. It is not visible to any other business. You can delete a saved address from your profile at any time.

Notification device identifier (app only): if you installed the app and allowed notifications, the operating system issues a technical identifier for the device and we store it so we can send an appointment notification to it. The identifier contains no name, phone number or location, it rotates on its own, and it is deleted when you sign out of the account on that device.

Message log: for every email we send you — verification, password reset, booking confirmation or reminder — we keep a technical record: the address it went to, the subject line, and whether sending succeeded. The content of the message itself is not stored. We use this to check whether a message you never received was actually sent.

We do not collect payment card details. The platform has no payment processing — payments are handled directly with the business.

How the information is used

To let you book appointments, to compute real availability and to prevent double booking.

To send you messages about your appointment: confirmation, cancellation, rescheduling, and any reminders the business enabled. If you installed the app and allowed notifications, those same messages are also delivered as a notification to your device.

To make home visits possible: to compute travel time and any travel fee from the address you gave, to reserve the journey itself in the provider's schedule, and to let her reach you.

To let the business manage its calendar, client list and treatment history.

To verify your email address and allow password resets.

We do not sell personal information and do not pass it to advertisers. Ads are selected only by the category you filtered on, with no personal details shared with the advertiser.

The business as a separate controller

When you book, your details become visible to that business: name, phone, email, your booking history with them, and any declaration you completed for them.

Each business sees only its own clients. One business cannot see another's clients or their declarations.

The business is itself responsible for how it uses this information and for meeting its own legal obligations.

Third-party providers

The database is hosted on Supabase. Images are stored in Cloudflare R2. Email is sent through Resend. The site is hosted on Vercel.

Maps are based on OpenStreetMap. When you search for an address, the search string is sent to OpenStreetMap's Nominatim service.

If a business owner connected their Google Calendar, confirmed appointment details — client name, service and phone — are written to their private calendar. The sync is one-way and fully under their control.

Each of these providers has its own privacy policy.

Cookies

We use strictly necessary cookies only: a signed session cookie that identifies you between pages, one that remembers your interface language, and one that remembers which branch a business owner selected.

There are no advertising or tracking cookies, and no connections to external tracking networks.

How long information is kept

Account and booking information is kept while the account is active, so you can see your history and the business can maintain continuity of care.

Email verification links last 24 hours, password reset links one hour, and staff invitations seven days. All are single-use and expire automatically.

A health declaration is kept for the validity period the business configured, after which you will be asked to complete it again.

A saved home-visit address is kept until you delete it from your profile. The notification device identifier is deleted when you sign out of the account on that device, and automatically when the notification service reports that the device is no longer registered.

Your rights

You may review the information held about you, ask to correct anything inaccurate, and delete your account and its data.

Some of this is directly available in the interface: your bookings, favourites, messages and preferences.

Deleting your account does not require contacting us. It is done inside the product itself — on the website and in the app alike — from your profile page, under "Delete my account". Deletion is immediate and permanent, and the screen before it sets out exactly what is deleted and what is kept. A public explanation, with no need to sign in, is on the account-deletion page.

What is deleted: your name, email address, phone number, date of birth, password, the link to your Google or Facebook account, your profile picture and uploaded photos, the reviews you wrote, your messages, favourites, saved addresses and preferences.

What is kept, and why: the business that treated you keeps the appointment record itself — date, service and price — and any health declaration signed before a treatment that actually took place. These are records the business has to keep for its accounts and its professional liability, and they are no longer linked to your name or contact details. A declaration signed for an appointment that was cancelled and never happened is deleted.

For access or correction requests, and for any question about what is kept, contact us at [email protected]. We will respond within a reasonable time.

Security

Passwords are stored only as bcrypt hashes. Sessions use a signed cookie, and traffic is encrypted over HTTPS.

Image uploads are verified server-side, and one business owner cannot upload to or view another business's content.

No system is perfectly secure. If you become aware of a vulnerability, please report it to the address below.

Changes to this policy

This policy may be updated. The last-updated date appears at the top of this page, and a material change will also be shown in the interface.

Contact

For any privacy question: [email protected]