Privacy Policy for Bevelure

Bevelure is operated by Bevelure LLC, based in Miami, Florida, USA. Our business address is 1723 SW 2nd Ave, Unit 902, Miami, FL 33129, USA.

You can reach us about this Privacy Policy or any privacy request at: support@bevelure.com.

• EU/UK representative (if applicable): If and when we are required under Article 27 of the EU or UK GDPR to designate a representative in the EU or the UK, that representative's contact details will be provided here.

Bevelure is a beauty and wellness treatment-history tracker and a lightweight booking marketplace that connects Customers with Care Providers. We are a cosmetic/wellness platform only. We are not a medical or healthcare provider, and the Service does not provide medical advice or care.

The Service supports three account roles, and the data we collect depends in part on your role:

• CUSTOMER — individuals who track their treatment history, book appointments, and choose whether and how to share their history.
• CARE_PROVIDER — aestheticians, nail technicians, stylists, salons, and similar professionals who list services, manage appointments, and record treatment details.
• SALON_ADMIN — salon administrators who manage a salon profile, team members, salon-scoped appointments, and related salon records.

In addition, some individuals interact with the Service without holding an account — for example, a guest a provider books by email, phone, or social-media handle; an external (out-of-system) provider who completes appointment details through a one-time link; and anonymous recipients who open a shared history link. We process limited personal information about these individuals as described in Sections 5, 7, and 8. Where the law gives them rights over that information, those rights apply to them too (see Section 11).

Bevelure is for adults only. You must be at least 18 years old to create an account or use the Service. See Section 12 (Children and Minors) below.

For purposes of the California Consumer Privacy Act, as amended by the CPRA ("CCPA"), the following is a description of the categories of personal information we have collected in the preceding twelve (12) months and that we continue to collect. The specific categories depend on your role and how you use the Service. (Retention for each category is described in Section 10; sources are described in Section 4.)

• Identifiers and account information (registered users): email address, password (stored only as a bcrypt hash — we never store your plain-text password), first and last name, date of birth, sex, city, country, profile photo, preferred language, phone number (in E.164 format), social-media link, and, where applicable, a public username. Date of birth is self-reported account/profile information; see Section 12 regarding the adults-only rule and the limits of age verification.
• Customer profile information: an allergies indicator (whether you have allergies) and free-text allergy notes; and your at-home "care routine" content, including care-routine photos and free-text routine notes.
• Care Provider profile information: service type, years in service, biography, business address (including the precise latitude and longitude captured when you select an address from autocomplete — see Section 9), IANA time zone, languages, currency, uploaded certificates (files, images, or PDFs), the services you offer (name, description, duration, price) and add-ons, and portfolio images.
• Salon information: salon name and public username, logo, description, address, city, country, time zone, phone, public email, website or social link, team membership and role, invitations, and salon-scoped appointment records.
• Guest and public-booking information: for a guest booked by a provider/admin or an anonymous visitor booking through a public provider profile, we may collect first and last name, email address, phone number or social-media handle (depending on the flow), city, appointment information, and a private cancellation token. Public provider and salon profiles can be viewed without an account.
• Appointment information: appointment date and time (stored in UTC, with a snapshot of the provider's time zone), status, and a snapshot of the service, add-ons, and price. Appointment details additionally include: procedure notes, products used, recommendations, provider-only internal notes, customer-only private notes, and three photo collections — result photos, procedure photos (visible to both parties), and customer private photos (visible only to the customer). The Service also supports two-way ratings (1–5) between a Customer and a Care Provider.
• Messaging: one-to-one chat between a Customer and a Care Provider, including text, quoted replies, heart reactions, and photo attachments (see Section 8).
• Sharing information: read-only "share tokens" (links/QR codes) that a Customer generates to share treatment history, including the procedure type(s) selected, the share scope, an optional recipient email address, expiration time, and basic view metadata (such as view count and last-viewed time). See Section 5.
• Favorites, blocks, reports, and notifications: the providers a Customer saves as favorites; users you block and any optional private block note; if you choose to report a blocked user, the selected structured report reason, moderation status, and timestamps; notification preferences; in-app notification records; device push tokens; and outbound email, SMS, and push delivery records.
• Precise geolocation (sensitive — permission-based): if you explicitly choose "Use my location" and grant permission, coordinates obtained from your browser or mobile device and used to identify your current city and sort providers by distance; and the latitude/longitude associated with a provider's business address. See Sections 6, 9, and 14.
• Sensitive personal information: as detailed in Section 6 (including allergies and allergy notes, care-routine information, body and face photos, treatment history, and precise geolocation).
• Internet/network and device information: JWT access and refresh tokens — stored in your browser's localStorage on the web (not in cookies) and in the device's secure storage (for example, the iOS Keychain) in the mobile app (see Section 9); a device push token (an Expo push token) if you enable push notifications on a mobile device, used solely to deliver those notifications; and standard server logs (which may include IP address, browser type, and timestamps).

We collect personal information from the following categories of sources. For CCPA purposes, these are the "sources" from which we collect personal information.

• Directly from you: information you provide when you sign up, build your profile, enter appointment or care-routine details, upload photos or certificates, chat, rate, book, and share.
• From the other party to an appointment: because Bevelure is a marketplace, the Customer and the Care Provider each generate information about the appointment. In particular, a Care Provider enters appointment details ABOUT a Customer — including procedure notes, products used, recommendations, provider-only internal notes, and result/procedure photos. This means personal information about you (including sensitive information such as treatment records and provider-only notes) may be entered by the other party, not only by you.
• From a provider or salon admin who books a guest: a Care Provider or salon administrator can create an appointment for a guest Customer using that guest's email, phone number, or social-media handle. In that case, the guest's contact information and the appointment details are entered by the provider/admin. If that guest later registers, the Service may link ("claim") matching prior guest appointments to the new account based on a matching email address.
• From an external (out-of-system) provider: where a Customer records an appointment with a provider who is not on Bevelure, that external provider may be invited to fill in appointment details through a one-time link. Information they enter (such as procedure notes, products, recommendations, and photos) is collected through that link.
• Automatically from your device/browser: server logs; device/platform and push-token information used for mobile notifications; and, only after you choose "Use my location" and grant permission, browser or mobile-device geolocation (see Section 9).
• From service providers: limited operational data from our subprocessors (for example, email delivery status). We do not buy personal information from data brokers.

Lawful bases (where GDPR applies). Where EU/UK data protection law applies, we map each processing purpose to a lawful basis as follows: (a) providing and operating the Service, maintaining your account, calculating available slots, and delivering the sharing feature you request — performance of a contract with you (or steps taken at your request); (b) sending transactional/service notifications, securing the Service, login rate limiting, preventing abuse, debugging, and improving reliability — our legitimate interests in operating a secure and functional service and, where relevant, the other party's legitimate interest in maintaining an accurate treatment record; (c) processing sensitive personal information where consent is required (including optional allergies, care-routine content, body/face photos, treatment history sharing, and precise device geolocation), and sending any non-transactional communication — your consent (Articles 6(1)(a) and, where applicable, 9(2)(a)); and (d) meeting legal obligations and establishing, exercising, or defending legal claims — compliance with a legal obligation and our legitimate interests. You may object to processing based on legitimate interests and withdraw consent at any time (see Sections 6 and 11).

We use the information described above to:

• Provide, protect, and operate the Service — including treatment-history tracking, appointment booking, available-slot calculation, user blocking, receiving and reviewing optional safety reports, preventing abuse, personal spending/provider or salon earnings summaries, and maintaining your account.
• Connect Customers with Care Providers through the marketplace, including search and nearest-provider distance sorting.
• Operate the history-sharing feature (see Section 7), including generating, delivering, displaying, and revoking share links.
• Send service notifications in-app, by email, by push notification to the mobile app (where you have enabled push on a device), and, where SMS is enabled and a phone number is on file, by text message; and maintain outbound delivery/audit records for those messages (see Section 8).
• Maintain security and prevent abuse — for example, login rate limiting and enforcing access controls.
• Comply with legal obligations and enforce our terms.

No automated decision-making or profiling with significant effects. We do NOT engage in automated decision-making that produces legal or similarly significant effects about you, and we do NOT conduct profiling for such purposes within the meaning of GDPR Article 22 or of U.S. state profiling-opt-out provisions (such as those in Colorado, Connecticut, and Virginia). Nearest-provider distance sorting and the display of aggregate ratings are simple, non-evaluative features that do not produce legal or similarly significant effects, and they are not used to make decisions about you.

Much of what makes Bevelure useful is sensitive. The following may be considered "sensitive personal information" (or special-category data under GDPR) under applicable privacy laws: allergies and allergy notes; at-home care-routine information; body and face photos (including profile, result, procedure, care-routine, and chat-attached photos); treatment history; and precise geolocation (see Section 9).

Opt-in consent — when and how we obtain it. Where applicable law requires consent before processing sensitive data, we rely on an affirmative action connected to the optional feature — for example, choosing to add allergy or care-routine information, selecting a photo to upload, choosing to share treatment history, or tapping "Use my location" and accepting the browser/device permission prompt. Accepting the general Terms is not treated as consent to optional device location. Where applicable law requires an additional or more specific form of explicit consent, we will request it before that processing. We do not condition unrelated parts of the Service on your providing optional sensitive information.

Withdrawing consent. You can withdraw consent at any time by removing the relevant content where the Service provides that control (for example, deleting allergy notes or photos), revoking browser/device permissions, adjusting your sharing choices (Section 7), turning off push delivery, or contacting us at support@bevelure.com. Withdrawal stops future processing based on that consent but does not affect processing that already occurred or information another authorized appointment participant is entitled to retain. Where a Customer chooses to share history (Section 7), the Customer controls that sharing.

Right to limit. Where a state law (such as the CCPA) provides a right to limit the use of sensitive personal information, you may exercise it as described in Section 11. Because we use sensitive information only to provide the Service you request and not for inferring characteristics or for advertising, our use is already limited to those purposes.

No facial recognition or biometric identifiers. Although face and body photos are central to the Service, we do NOT use them to perform facial recognition, and we do NOT generate, collect, or store biometric identifiers or biometric templates (such as faceprints, scans of face geometry, or other unique biological measurements) from them. We do not use photos for biometric identification of any kind. For clarity, we do not knowingly engage in conduct regulated by biometric-specific statutes such as the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), or Washington's biometric privacy law, because we do not create or use biometric identifiers.

Bevelure is a cosmetic/wellness product and does not provide medical advice or care. Provider-only notes are appointment records kept within the Service and are not a substitute for professional medical advice.

A core feature of Bevelure lets a Customer share their treatment history with a Care Provider. The Customer is always in control of what is shared, with whom, and for how long.

How sharing is initiated:

• At booking — when booking an appointment, a Customer can choose to share their relevant history with the booked provider.
• From "My Care Hub" — a Customer can generate a read-only link (and a QR code), and may optionally have it emailed to a recipient.

What the Customer chooses when sharing:

• Procedure type(s) — sharing is scoped to one or more selected procedure types.
• Scope — either the "last 5 visits" or the "full history" of those procedure types.

What the shared read-only page EXPOSES: for the in-scope visits, it shows the appointment name/service, dates, procedure notes, products used, recommendations, result photos, and procedure photos. The shared view also includes the Customer's first and last name and the Customer's allergies indicator and allergy notes (so the provider can treat safely).

What the shared link KEEPS PRIVATE: it does NOT expose the Customer's private notes or private photos. On a public link, it also does NOT reveal which OTHER providers performed past visits (the names of other providers are withheld; an in-system provider viewing shared history will see their own name on their own past records only).

Optional recipient email. If you choose to have a share link emailed, the recipient's email address is sent to and processed by our email/SMTP subprocessor (see Section 8) solely to deliver that email, and the address is retained with the share record as described in Section 10. Do not enter a recipient email you are not authorized to use.

Information collected from anonymous viewers. Anyone who opens a share link does so without logging in and without separately accepting this policy. When a link is viewed, the Service records basic view metadata associated with the link, such as view count and last-viewed time, and our servers generate standard logs that may include the viewer's IP address, browser type, and timestamps (see Section 9). We use this limited information to operate and secure the sharing feature. This Privacy Policy serves as notice to anonymous viewers of that collection; if you receive a share link and do not wish your view to be recorded, do not open the link.

Revocation does not retract what was already seen. Share links are time-limited (each has an expiration time) and a Customer can revoke a link at any time, after which it stops working. However, revoking or expiring a link CANNOT retract, delete, or recall information that a recipient already viewed, downloaded, screenshotted, or copied while the link was active. Until a link expires or is revoked, ANYONE who has the link can view the shared page without logging in. Share links only with people you trust, and revoke links you no longer need.

Messaging / chat. The Service includes one-to-one chat between a Customer and a Care Provider, which may include text, quoted replies, heart reactions, and photo attachments (and attachments can be sensitive, such as body/face photos). Chat content is visible to the two participants in that conversation. Blocking prevents new messages, uploads, and reactions but does not erase existing conversation history. We do not routinely monitor private chats, but authorized personnel may access chat content where necessary to operate, secure, troubleshoot, or provide the Service, to enforce our terms, to respond to a lawful request, or to investigate abuse or safety concerns. Chat content is retained as described in Section 10 and is handled as part of your account on deletion (see Sections 10 and 11).

Public vs. private profile information. Some information is, by design, visible to others. Public Care Provider and salon profiles may display fields such as names/usernames, profile photo or logo, service type, city/country, business address, languages, services and add-ons, certificates, portfolio images, salon team membership, and aggregate ratings. An individual 1–5 rating is associated with its appointment and may be available to the appointment participants through the Service; aggregate provider or customer ratings may be displayed on relevant profile/search views. Ratings involving an out-of-system party do not contribute to an in-system public aggregate. A shared history view displays the Customer's first/last name and allergy information to the recipient (see Section 7). Information made publicly available may be viewed, indexed, cached, or copied by third parties (including search engines) in ways we cannot control or fully reverse. Provider-only internal notes remain provider-only, and Customer private notes and private photos remain Customer-only.

Transactional email and SMS. The messages we currently send are transactional/service messages — for example, booking and appointment updates, share-link emails you initiate, appointment reminders, and account or security notices. We may send them in-app, by email, and, where SMS is enabled and a phone number is on file, by text message. Where you have installed the mobile app and enabled push notifications, we also deliver these as push notifications; you can turn push off at any time in your device's operating-system settings or in the app, which stops push delivery without affecting the in-app or email records. Because these are necessary to operate the Service, you generally cannot opt out of them while you maintain an account and use the relevant features; to stop receiving them you would deactivate the related feature, remove the relevant contact method where available, or close your account. We do not currently send marketing or promotional email or SMS. If we introduce any non-transactional/promotional messages in the future, we will obtain any required consent and provide a clear unsubscribe mechanism.

Outbound message logs. To operate and troubleshoot transactional messages, we keep an audit record of send attempts, including channel (email, SMS, or push), event type, recipient email address, phone number, or device push token, related appointment where applicable, provider message ID where available, delivery status such as sent or failed, failure reason, and timestamps. Push title/body text may contain service, appointment, sender, or party names relevant to the alert. Your operating system may display that content on a lock screen depending on your notification-preview settings.

Session tokens — localStorage (web) and secure storage (mobile), not cookies: To keep you signed in, the web app stores JWT access and refresh tokens in your browser's localStorage, and the mobile app stores them in the device's secure storage (for example, the iOS Keychain, via Expo SecureStore). These are not cookies, and we do not use cookies for cross-site tracking. They are used for authentication and session management and are removed when you log out.

Push notification tokens (mobile). After you grant the mobile operating system permission for notifications, the app obtains an Expo push token, stores a local copy in ordinary app storage, and registers it with us so we can deliver Service notifications through the Expo Push Service and the platform's transport (Apple Push Notification service on iOS or Firebase Cloud Messaging on Android). Turning push off in the Bevelure profile or operating-system settings stops or prevents delivery, but the registered token may remain in our records and the app's local storage until you log out, unregister the device, make a verified deletion request, or the token is rejected as no longer registered and pruned. Logout removal is best-effort and requires network access. See Sections 8, 10, and 14.

Precise geolocation (permission-based, sensitive). Provider search opens using the city saved in your profile and does not request device location. Only after you choose "Use my location" do we ask for browser/mobile foreground-location permission. If granted, the Service obtains coordinates to identify your current city and sort providers by distance. The coordinates are sent to our server as search parameters and to our server-side Photon geocoding proxy for reverse geocoding; Photon receives the latitude and longitude (Section 14). We do not continuously track location or save those current-location coordinates to your Customer profile, although they may be processed in transient requests and standard service-provider/server logs. Depending on your device and settings, the coordinates may identify you within approximately 1,850 feet and are treated as "precise geolocation" under the CCPA and similar laws. You can decline or revoke permission without losing the rest of the Service. Separately, when a Care Provider selects a business address from autocomplete, we store that business latitude/longitude for distance sorting and publicly display the associated business address. Your sensitive-information rights are described in Sections 6 and 11.

Photo and file access (mobile). The mobile app requests photo-library access only when you choose an upload flow, and it requests access to files/documents when you choose a document such as a certificate. We process only the items you select, plus basic file metadata supplied by the device (such as filename, media type, dimensions, and file size where available), to upload and display them in the feature you selected. You can deny or revoke these permissions in device settings; previously uploaded content remains in the Service until you remove it or request deletion, subject to Section 10.

Do Not Track. Some browsers offer a "Do Not Track" (DNT) signal. There is no common industry standard for how to interpret DNT, and because we do not track users across third-party websites or services over time and do not serve behavioral advertising, the Service does not currently respond differently to DNT signals.

Server logs. Like most web services, our servers generate standard logs that may include technical information such as IP address, browser type, and timestamps, used for security, debugging, and operating the Service (including logs generated when anonymous recipients view share links — see Section 7).

We keep personal information only for as long as needed for the purposes described in this policy, then delete or de-identify it.

• Active accounts: retained while your account is active and you are using the Service.
• Account deletion: You can permanently delete your account directly from your Profile settings in the Bevelure web application or mobile app. Deleting your account removes the account record and the personal data associated with it from our active systems, including profile and contact information, authentication data, preferences, private notes, messages, uploaded photos and files, ratings and reactions, favorites, blocks, notifications, device tokens, and active sharing links.
• Appointment and shared records: Account deletion removes your personal data and User Content from appointment, treatment, salon, and conversation records. If a limited transactional record must remain because applicable law requires us to keep it, we remove or de-identify the information that identifies you, restrict access to the record, and keep it only for the legally required purpose and period.
• Safety, security, and legal records: We keep only the limited information that applicable law requires us to retain or that is strictly necessary for security, fraud prevention, investigating a safety report, or establishing, exercising, or defending legal claims. Such information is separated from active account data, access is restricted, it is not used to continue providing the deleted account, and it is deleted or de-identified when the applicable purpose ends.
• Service providers: Where a service provider processes account data on our behalf, we delete the data from our systems and direct the provider to delete it where applicable.
• Backups: Account data is removed from active systems when deletion is completed. Encrypted residual copies may remain temporarily in disaster-recovery backups and are permanently removed through the normal backup-rotation process. They are not restored to active use except where necessary for disaster recovery, and any restored data remains subject to the deletion request.

How to delete your account. Registered users can delete their account from Profile settings on the web or in the mobile app. The deletion option is available to all account roles. If you cannot access your account, email support@bevelure.com to request deletion. We may take reasonable steps to verify your identity before acting on an email request so that another person cannot delete your account without authorization.

Depending on where you live and which laws apply, you may have rights regarding your personal information, and these rights extend to non-registered individuals (such as booked guests and external providers) where the law provides.

U.S. state privacy laws. Residents of states with comprehensive privacy laws — including California (CCPA/CPRA) and states such as Virginia, Colorado, Connecticut, Texas, and Oregon, among others — may have rights to access/know, correct, delete, and obtain a portable copy of personal information, and to opt out of certain processing, where applicable. Where sensitive personal information is processed, you may have the right to limit or to decline its processing (see Section 6).

No sale, no targeted advertising, no relevant profiling. We do NOT sell personal information and do NOT "share" it for cross-context behavioral advertising or process it for targeted advertising, so there is no such activity to opt out of; we will still honor applicable access, correction, deletion, portability, and limit rights. We do not conduct profiling that produces legal or similarly significant effects (see Section 5), so there is no profiling opt-out to exercise. We do not offer financial incentives or loyalty programs in exchange for personal information.

GDPR (EU/UK), where applicable. To the extent we serve users in the EU/UK, those users have rights including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, as well as the right to lodge a complaint with their supervisory authority. Where we rely on consent (including for sensitive data), you may withdraw it at any time without affecting prior processing (see Section 6). Our lawful bases are described in Section 4.

How to submit a request. Registered users can delete their account directly from Profile settings in the Bevelure web application or mobile app. You may submit any other privacy request, or request account deletion when you cannot access your account, by emailing support@bevelure.com. We will take reasonable steps to verify your identity before acting on an email request so that we do not disclose or delete data based on an unverified request. An authorized agent may submit a request on your behalf where the law permits; we may require proof of the agent's authorization (such as written permission or a power of attorney) and may verify your identity directly. We will not discriminate against you for exercising your rights.

Response timelines. CCPA (California): we will confirm receipt within 10 business days and respond within 45 calendar days, extendable by an additional 45 days (up to 90 days total) when reasonably necessary, with notice to you. Virginia, Colorado, Connecticut, Texas, Oregon, and similar state laws: we will respond within 45 days, extendable by an additional 45 days when reasonably necessary, with notice. GDPR (EU/UK): we will respond within one month, extendable by up to two further months for complex or numerous requests, with notice.

Right to appeal. If we decline to act on your request, we will tell you why. Where state law provides an appeal right (including Virginia, Colorado, Connecticut, Texas, and Oregon), you may appeal our decision within a reasonable time by replying to our decision email or by writing to support@bevelure.com with the subject line "Privacy Appeal." We will review the appeal and respond within the period required by the applicable law (for many states, within 60 days). If your appeal is denied, we will provide a method to contact the relevant state Attorney General or regulator to submit a complaint, and (for GDPR) you may also complain to your supervisory authority.

Request metrics. Where we are legally required to disclose annual metrics about consumer requests received, complied with, denied, and our average response time, we will publish those metrics in this Privacy Policy as required.

Bevelure is intended only for adults aged 18 and older. Customer and Care Provider registration checks the self-reported date of birth and rejects applicants under 18; Salon Administrators must affirm that they are at least 18. These controls do not independently verify identity or prevent a person from submitting inaccurate information. Users represent that they are at least 18 under the Terms, and we may request further verification, decline, or terminate an account that does not meet the requirement.

The Service is not directed to children or minors, and we do not knowingly collect personal information from anyone under 18 (including children under 13). If we learn that an account belongs to, or that we have otherwise collected information from, a person under 18, we will promptly delete that person's information (rather than merely deactivating it) and terminate the account. Consistent with Florida's online protections for minors (including HB 3) and other applicable laws, we do not knowingly allow minors to register or maintain accounts. If you believe a minor has provided us information, please contact us at support@bevelure.com.

Security measures. We use reasonable administrative and technical measures designed to protect personal information, including:

• HTTPS/TLS encryption in production.
• Password protection using bcrypt hashing (we never store plain-text passwords).
• JWT-based authentication and login rate limiting to deter abuse.
• Access controls that enforce the privacy boundaries described in this policy — for example, provider-only internal notes are visible only to the provider, and a Customer's private notes and private photos are visible only to that Customer.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Please use a strong, unique password and keep your login credentials confidential.

Data-breach notification. Given the sensitive nature of the data on Bevelure (such as allergies, treatment history, and body/face photos), we maintain procedures to detect, investigate, and respond to security incidents. If we determine that a breach of security has compromised, or is reasonably likely to have compromised, your personal information, we will notify affected individuals and, where required, the relevant authorities, as follows:

• Florida residents (Fla. Stat. § 501.171 / FIPA): we will notify affected individuals without unreasonable delay and no later than 30 days after determining a breach has occurred (subject to lawful delay for law-enforcement needs), and we will notify the Florida Department of Legal Affairs and consumer reporting agencies where the law's thresholds are met.
• Other U.S. states: we will notify affected individuals and any required regulators in accordance with the applicable state breach-notification statute.
• FTC Health Breach Notification Rule (where applicable): because the Service can hold identifiable allergy, treatment-history, photo, and other wellness information outside HIPAA, we will assess an incident under the FTC Health Breach Notification Rule and notify affected individuals, the FTC, and, where required, the media if the Rule applies.
• GDPR (EU/UK), where applicable: we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach that is required to be reported (Article 33), and we will notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34).

Our breach notices will describe, to the extent required by law, what happened, the categories of information involved, the steps we are taking, and what you can do to protect yourself.

We share personal information with service providers (subprocessors) only as needed to operate the Service. The categories of personal information disclosed to each recipient (for a business purpose, not for sale) are:

• Geocoding — Photon (OpenStreetMap-based), used for city/address autocomplete and reverse geocoding after you choose "Use my location." Categories disclosed: an autocomplete query string (such as partial address/city text) or, for reverse geocoding, the latitude and longitude obtained with permission. Requests are proxied through our server; we do not intentionally send your Bevelure account ID, email, or profile to Photon, but Photon receives ordinary request/network metadata from our server.
• Email delivery — Mailtrap (or another configured SMTP provider), used to send transactional and notification emails, including share-link emails. Categories disclosed: recipient email address and message contents (including a share link or cancellation link where applicable).
• Cloud hosting — Amazon Web Services (AWS), where Service data and uploaded files are stored and processed. Categories disclosed: all categories of personal information described in Section 3, as necessary to host the Service (including photos, certificates, portfolio images, appointment details, and chat content).
• SMS delivery — Twilio (Twilio Inc.), used to send transactional SMS notifications (such as booking requests, confirmations, cancellations, and appointment reminders) to users and to external recipients who have a phone number on file. SMS is being rolled out and may not be active for all users yet; where it is used, the categories disclosed are the recipient's phone number and the message content. We use SMS only to deliver Service notifications, never for marketing.
• Push notifications — Expo (the Expo Push Service, operated by 650 Industries, Inc.), used to deliver push notifications to the mobile app, together with the underlying platform transport (Apple Push Notification service on iOS and Google Firebase Cloud Messaging on Android). Categories disclosed: a device push token and the notification content (title, body, and minimal routing data, such as an appointment or chat-message alert). Push notifications are only sent to a registered device when you have enabled them; we use push only to deliver Service notifications, never for marketing.
• External maps — when a Customer taps a venue address in appointment details, the Service opens Apple Maps on iOS or Google Maps on web/Android to request directions. The selected provider/salon destination address and ordinary device/network information are then processed directly by the chosen map provider under its own privacy policy. We do not send the Customer's Bevelure profile or treatment history to the map provider.

Sharing inherent in the marketplace. We also share information between Customers and Care Providers as inherent in the Service — for example, an appointment's shared details, chat messages, ratings, public provider-profile fields, and any history a Customer chooses to share (Sections 7 and 8).

What we do NOT do: We do NOT sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We do not currently process payments, so we do not share data with payment processors at this time. We may also disclose information if required by law, in response to lawful requests, or to protect our rights, our users, or the public.

We are based in Miami, Florida, USA, and the Service is hosted in the United States (on AWS). If you access the Service from outside the United States, your personal information will be transferred to, processed, and stored in the United States, which may have data-protection laws that differ from those of your country.

Transfer mechanism (EU/UK). To the extent the GDPR applies to a transfer of personal data from the EEA, the UK, or Switzerland to the United States, we will rely on a valid transfer mechanism, namely the European Commission's Standard Contractual Clauses (and, for the UK, the UK International Data Transfer Addendum/IDTA), and/or another lawful basis or adequacy mechanism where available. You may request a copy of the relevant safeguards by contacting us at support@bevelure.com; we may redact commercial terms.

If you have questions about the legal basis for transferring your information, please contact us at support@bevelure.com.

We may update this Privacy Policy from time to time. When we do, we will post the updated version with a new Effective Date.

If changes are material, we may provide additional notice as required by applicable law. Your continued use of the Service after an update takes effect indicates your acceptance of the revised policy, to the extent permitted by law.

This Privacy Policy is governed by the laws of the State of Florida, USA, without regard to its conflict-of-laws principles, except where applicable mandatory privacy laws provide otherwise.

Questions, requests, or complaints about this policy or our privacy practices can be sent to:

• Bevelure LLC
• 1723 SW 2nd Ave, Unit 902, Miami, FL 33129, USA
• Email: support@bevelure.com