Privacy Policy

1. Information We Collect

The information we collect depends on your account type and how you use the Platform.

All account types:

• Full name, email address, and phone number
• Account credentials (password, stored as a one-way hash) or sign-in via Google
• Communications with us, including support tickets and any attachments you upload (stored privately with access controls)
• Notification preferences (SMS and email)

Customers:

• Service address for mobile appointments and saved addresses (see Section 2, Precise Location)
• ZIP code used for location-based search and travel-fee calculation
• Payment information — processed via Stripe; we do not store full card numbers (see Section 10)
• Booking history, appointment details, and in-app messages with Providers
• Intake-form answers and signed waivers or consent agreements for specific services (see Section 3, Sensitive Information)
• Reviews you write and photos you upload (review photos, booking photos, profile photo)
• Stored-value balances: loyalty points, store/wallet credit, gift cards, membership subscriptions, and prepaid package balances (see Section 7)
• Affiliate referral attribution if you arrived via a referral link (see our Cookie Policy)

Providers:

• Business and profile information: display name, bio, business address or base city, specialties, service menu and pricing, portfolio photos, working hours, and travel/service area
• Professional license information you attest to (self-attested; see Section 8)
• Liability-insurance documents you choose to upload
• Background-check status and completion date, if you order a background check (see Section 8)
• Financial data connected to payouts via Stripe Connect: earnings, payout history, and subscription billing. Your bank account and tax details are collected and held by Stripe, not by us (see Section 7)
• Google Calendar connection data, if you connect your calendar (see Section 6)
• Client contact lists you import into your client book (see Section 5, Provider-Imported Client Data)
• Messages with clients, quick-reply templates, and notes you keep about your clients

Affiliates:

• Referral code and vanity link slug
• Stripe Connect payout account (bank details held by Stripe, not by us)
• Commission earnings, payout history, and referral/attribution records
• Marketing activity on the Platform, such as share-link and media-kit usage

Automatically Collected Information (all users):

• Usage data: pages viewed, features used, booking activity
• Device information: browser type, operating system, device identifiers
• IP address and general location derived from IP, used for security, rate-limiting, and fraud prevention
• Session data via our authentication cookie (bm_session) and, where applicable, referral-attribution cookies (bm_ref, bm_cid) — see our Cookie Policy

2. Precise Location Information

Because Beauty Meet supports mobile (at-home) beauty services, we collect the exact service address you provide when you book a mobile appointment. This is distinct from the general, city-level location we may infer from your IP address. Your service address is shared only with the Provider you book, solely so they can travel to and perform your appointment.

Providers may choose to display only a general area (base city or neighborhood) publicly and reveal their exact studio address only after a booking is confirmed. ZIP codes you enter for search are used to show nearby Providers and calculate travel fees.

3. Sensitive & Intake Information

Some services (for example waxing, lash, or skin treatments) use intake forms or waivers that may ask about health conditions, skin sensitivities, allergies, or medications. You control what you share. Any answers you provide are used only to communicate your needs to the Provider you book and to fulfill your appointment safely. We do not use intake or waiver responses for marketing, and we do not sell them. We share them with the booked Provider to fulfill your appointment, with the service providers who help us operate the platform under confidentiality obligations, and otherwise only as required by law or as reasonably necessary to establish, exercise, or defend legal claims.

Signed waiver and consent records are retained with your booking history so both you and your Provider have a record of what was agreed.

Consumer health data. Some intake information may qualify as "consumer health data" under state laws such as the Washington My Health My Data Act and Nevada SB 370. We collect it only when you complete an intake form, use it only to communicate your needs to the booked Provider and deliver your appointment safely, and never sell it or share it for advertising. Beauty Meet is not a healthcare provider or a HIPAA covered entity, and intake information is not medical care. If your state has a consumer-health-data law, you may exercise the rights described in Section 11 with respect to this information.

4. SMS / TCPA Consent

By providing your phone number, you consent to receive both transactional and promotional SMS messages from Beauty Meet using automated technology. Transactional messages — booking confirmations, appointment reminders, changes, and important account or payout notices — are part of delivering the service you requested. Promotional messages include offers from providers you have booked with and occasional platform promotions. You can stop every message at any time by replying STOP (see below), and you can turn off promotional messages on their own at any time from the "Promotions & offers" setting in your account. Providers and Affiliates also receive account-related transactional SMS (for example, new-booking alerts, payout notices, and referral updates).

To opt out: Reply STOP to any SMS message at any time. After opting out, you will receive a single confirmation message, and no further messages will be sent to that number. The STOP opt-out is global: it applies across all Beauty Meet SMS to that number, both transactional and promotional, and is honored on our suppression list even if you later create a new account. Note that opting out of SMS may affect your ability to receive time-sensitive booking updates.

We never share your mobile number for marketing. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third party for any purpose, and we never sell mobile numbers.

Your mobile number is disclosed only to deliver the service you asked for: to Twilio, our messaging provider, to transmit the messages we send you; and to the Provider you book with, so they can reach you about that specific appointment (see Section 9). Beauty Meet does not give Providers a bulk download of customer mobile numbers — the client and booking exports available to Providers show only the last two digits. When a Provider sends a promotional message, it is sent through Beauty Meet's own systems and is subject to your platform-wide STOP opt-out; the Provider is not given your number for use in any outside marketing tool. Affiliates never receive your phone number.

Message frequency varies based on your activity. Message and data rates may apply. We do not send marketing messages outside the hours permitted by applicable law. For help, reply HELP or contact hello@beautymeetapp.com.

5. How We Use Your Information

• To create and manage your account and authenticate your identity
• To process bookings, payments, refunds, payouts, and affiliate commissions
• To send appointment confirmations, reminders, and service updates via SMS and email
• To connect Customers with beauty professionals and facilitate service delivery
• To operate stored-value features (loyalty points, credit, gift cards, memberships, packages)
• To sync bookings with a Provider's connected Google Calendar (see Section 6)
• To provide customer support, including reviewing support tickets and attachments you submit
• To detect and prevent fraud, abuse, or violations of our Terms of Service
• To improve and personalize the Platform
• To comply with legal obligations and respond to lawful requests
• To send occasional marketing communications (where you have consented and may opt out at any time)

Provider-Imported Client Data: Providers may import their existing client contact list (names and phone numbers) into their Beauty Meet client book. We use imported contacts only to power that Provider's own client management and to link records if the same person later books through the Platform. We do not send platform marketing to imported contacts — any outreach to an imported contact is sent by the Provider from the Provider's own phone. Providers are responsible for having the right to upload their client contacts.

6. Google Calendar Integration (Providers)

Providers may optionally connect a Google Calendar to Beauty Meet. If you connect your calendar, we request two narrowly scoped Google permissions:

• Free/busy access — we read only the busy/available times on your calendar (not event contents from your other events) so that times you are busy are blocked from being booked on Beauty Meet.
• Calendar events — we create, update, and delete the Beauty Meet booking events we place on your calendar so your appointments stay in sync. These events include the client's name, phone number, and the booked service.

We store the OAuth token needed to maintain this connection. We use Google Calendar data only to provide availability blocking and booking sync — never for advertising, and we do not sell it or share it with third parties except as needed to provide this feature. You can disconnect your Google Calendar at any time from your dashboard settings, which stops the sync and invalidates our access; you can also revoke access from your Google account settings.

Beauty Meet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6a. Camera & Virtual Try-On

Our virtual try-on feature lets you preview looks (for example, hair color) using your device camera or a photo you choose. This processing happens on your device. The image is analyzed locally in your browser to place the preview; we do not upload, receive, or store your camera feed or photos on our servers, and we do not create, collect, or store a faceprint, facial-geometry template, or any other biometric identifier from try-on. Try-on is not used to identify you.

To run on your device, the feature downloads a machine-learning model from Google-hosted and public content-delivery networks; those providers may receive your device's IP address as part of delivering the model file, but not your image. If we ever add a feature that captures facial geometry or another biometric identifier, we will first obtain your separate, informed written consent and publish a biometric-data retention and destruction schedule, as required by laws such as the Illinois Biometric Information Privacy Act (BIPA) and the Texas CUBI Act.

7. Financial & Stored-Value Data

Customers: We maintain records of your stored-value balances — loyalty points, store/wallet credit, gift-card balances, membership subscriptions, and prepaid package sessions — together with the transaction ledgers behind them, so we can apply them correctly at checkout and resolve disputes.

Providers and Affiliates: Payouts are made through Stripe Connect. Your bank/payout account details, identity-verification documents, and tax information are collected and stored by Stripe under its own privacy policy — Beauty Meet does not store your bank account numbers. We maintain records of your earnings, payout history, subscription billing (Providers), commission ledger (Affiliates), and any amounts owed to the Platform, as needed to run payouts and meet accounting and tax obligations.

8. Background Checks & Professional Credentials (Providers)

Providers may supply a professional license number (self-attested) and may upload proof of liability insurance. If background-check ordering is available and a Provider chooses to order one, the check is performed by a third-party screening vendor with the Provider's consent, and we store only the resulting status (for example "clear" and the completion date) — we do not receive or store the underlying report contents beyond that status.

Consistent with our Terms of Service, Beauty Meet does not independently verify professional licenses, certifications, permits, or insurance. License information is self-attested by the Provider. Beauty Meet does not itself verify any user's identity and does not display identity-verification badges.

9. Third-Party Sharing

We do not sell your personal information. We share your information only as follows:

• Between Customers and Providers: When a Customer books, we share the Customer's name, phone number, service address, and any intake/waiver responses with the booked Provider, solely to fulfill the appointment. A Provider's business information (display name, bio, portfolio, services, pricing, general location, and badges) is shown publicly on the Platform.
• Stripe: Payment, payout (Stripe Connect), and related identity/tax information is processed by Stripe, Inc. Stripe's processing is governed by their Privacy Policy.
• Twilio: SMS messages are delivered via Twilio, Inc. Twilio receives your phone number to deliver messages on our behalf.
• Google: If a Provider connects Google Calendar, booking details (client name, phone, service, time) are written to that Provider's Google Calendar (see Section 6). The Provider dashboard's travel-zone tool also loads Google Maps; see our Cookie Policy.
• Background-check vendor: If and when a Provider orders a background check, the information needed to run the check is shared with the screening vendor with the Provider's consent.
• Try-on model delivery: Our virtual try-on feature downloads its on-device machine-learning model from Google-hosted and public content-delivery networks, which may receive your device's IP address (but not your image) when the model loads — see Section 6a.
• Providers (marketing communications): If you have booked with a Provider and are enrolled in their marketing list, that Provider may send you promotional SMS messages through the platform. Replying STOP to any Beauty Meet SMS message will globally opt you out of all platform SMS — both transactional and provider marketing messages. To manage individual notification preferences, visit your account settings.
• Affiliate partners: If you signed up through an affiliate referral link, we share limited booking attribution data (whether a booking was completed) with the referring affiliate. We do not share your name, contact information, or payment details with affiliates.
• Legal requirements: We may disclose information when required by law, subpoena, or to protect the rights and safety of users or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

10. Payment Data

Credit card and payment details are processed and stored by Stripe, Inc. Beauty Meet stores only a Stripe customer ID and payment method token — never full card numbers, CVVs, or sensitive card data. Stripe maintains PCI-DSS Level 1 compliance. Where buy-now-pay-later options (such as Afterpay, Klarna, or Affirm) are offered at checkout, those payments are also processed through Stripe and are subject to the BNPL provider's own terms.

11. Your Privacy Rights (California & Other U.S. States)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), grants you the following rights regarding your personal information:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months, as well as the categories of sources, business/commercial purposes for collection, and categories of third parties with whom we share information.
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions (e.g., completing a transaction, legal obligations).
• Right to Correct: You may request that we correct inaccurate personal information we hold about you.
• Right to Limit Sensitive Personal Information: You may request that we limit our use of any sensitive personal information to what is necessary to provide the service. We do not use sensitive personal information for advertising.
• Right to Opt Out of Sale or Sharing: We do not sell your personal information and do not share it for cross-context behavioral advertising. If this ever changes, we will provide a "Do Not Sell or Share My Personal Information" mechanism.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA rights. You will not receive different prices, reduced quality of service, or be denied services for exercising these rights.

You may submit a request in two ways: (1) email hello@beautymeetapp.com with the subject "Privacy Request," or (2) send a request from within your account or by replying to any account email. We will verify and respond within the time the law allows (generally 45 days). You may use an authorized agent, and we will not discriminate against you for exercising these rights.

Other U.S. states. Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others as they take effect — have similar rights to access, correct, delete, obtain a copy of, and opt out of the sale or targeted-advertising use of their personal data. We do not sell personal data or use it for targeted advertising. To exercise these rights, contact us using either method above; where a law provides an appeal, you may appeal our decision by replying to our response.

12. GDPR — European Users

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including the right to access, correct, port, and erase your personal data, and to object to or restrict processing. Our lawful basis for processing is primarily contract performance and, for marketing communications, consent. To exercise GDPR rights, contact hello@beautymeetapp.com.

13. Data Retention, Export & Deletion

We retain your account information for as long as your account is active, or as needed to provide services. Records of payments, payouts, refunds, commissions, and stored-value transactions are retained for up to 7 years to meet tax, accounting, and dispute-resolution obligations, even after account deletion.

Export: You may request a machine-readable export of the personal data we hold about you — we maintain dedicated export tooling for Customers, Providers, and Affiliates and will fulfill requests sent to hello@beautymeetapp.com.

Deletion: You can delete your account directly from your account settings (or by emailing us). Deletion anonymizes your personal identifiers (name, email, phone, photos) while preserving the anonymized transaction records we are required to keep. Accounts with upcoming bookings must cancel or complete them first. Note that unused stored-value balances (loyalty points, credit, and similar) are forfeited when your account is closed, except where applicable law requires otherwise — see our Terms of Service. Certain records may be retained longer where required by law or for legitimate business interests (e.g., dispute resolution, fraud prevention, honoring SMS opt-outs).

14. Cookies & Tracking

We use a small number of first-party cookies: a session cookie ("bm_session") strictly for authentication, and short-lived referral-attribution cookies ("bm_ref", "bm_cid") set only when you arrive via an affiliate referral link. We do not use tracking cookies, advertising pixels, analytics SDKs, or any third-party tracking technology. We do not share browsing data with advertising networks. See our Cookie Policy for full details.

By continuing to use the Platform, you consent to our use of these cookies as described. You may disable cookies in your browser, but this will prevent you from logging in or using core functionality.

15. Security

We implement industry-standard security measures including TLS/HTTPS encryption for all data in transit, bcrypt password hashing, and role-based access controls. We limit access to personal and financial data to personnel who need it, revoke access promptly when it is no longer needed (including at the end of an engagement), and log access to sensitive records. Support-ticket attachments are stored privately and served only to authorized participants. If we become aware of a data breach affecting your personal information, we will notify you and the appropriate authorities as required by, and within the timeframes set by, applicable law. No method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

16. Age Requirement & Children's Privacy

The Platform is intended for adults. You must be at least 18 years old to create an account of any type (Customer, Provider, or Affiliate), consistent with our Terms of Service. The Platform is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18 — including children under 13, from whom we never knowingly collect information. If we learn we have collected personal information from a minor, we will delete it promptly.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or an in-app notice. Your continued use of the Platform after the effective date of a revised policy constitutes your acceptance of the changes.

18. Contact & Privacy Requests

For all privacy-related requests, questions, or concerns — including data access, export, deletion, CCPA, or GDPR requests — contact us at: