Privacy policy

Who is responsible for your data

The data controller is Patrycja Giermazińska, who runs the Hair Majesty salon at 25 North Bridge Street, Bathgate EH48 4PJ. For anything about your data, message us on WhatsApp, e-mail hairmajesty.scotland@gmail.com or call 07851 839640.

Booking an appointment

When you book — in the calendar on this site, in the chat with LUCY or by phone — we record your name, phone number, e-mail address (if you give one), the chosen service, the date and time, and your notes. We need them to provide the service: to confirm the slot, remind you the day before and reach you if anything changes (legal basis: contract, Article 6(1)(b) UK GDPR).

In the booking form you can also tick consent to hear about offers and free slots. We store it together with the date (legal basis: consent, Article 6(1)(a) UK GDPR); without it we send no such messages. You can withdraw consent at any time — e-mail hairmajesty.scotland@gmail.com or call; withdrawing does not affect your appointment.

The confirmation, the reminder and any notice of a changed or cancelled appointment go out by e-mail. We keep booking data for as long as it is needed to handle the appointment, and payment records for 6 years (HMRC requirement).

The confirmation and reminder e-mails include a “Change or cancel your appointment” button. The link carries only a signed appointment identifier and an expiry time — no name, phone number or e-mail address — and works until the appointment starts. It opens a page with the booking number, the service and the time, from which you can go to the chat with LUCY. Please don't forward it: whoever has the link can ask LUCY to change that appointment.

After your visit

About 90 minutes after your appointment ends (at the latest 24 hours later, and only between 9:00 and 20:00) we may send one e-mail thanking you, with a link to a page where you can leave a review — for example on Facebook or on our website — and find our social media profiles. We send it no more than once every 60 days to the same address. Legal basis: our legitimate interest — reviews help other clients choose a salon (Article 6(1)(f) UK GDPR). You can object at any time: reply “STOP” to that message or contact us, and we won't send another.

The page with the links records nothing about you. A review on Facebook or Google is added on that service, under its own terms.

Online deposit (Stripe, Klarna)

When the salon takes a deposit, the payment is handled by Stripe — by card or, for higher-value services, through Klarna. You enter your card details on Stripe's page; we only see the amount, the payment status and the transaction identifier, which we store with your booking (legal basis: contract, Article 6(1)(b)). Stripe and Klarna are independent controllers of payment data with their own privacy policies. We pass Stripe your e-mail address (for the receipt), the booking number, the name of the service and the amount — nothing else.

Result photos

We publish "before and after" photos on the website and on social media only with your separate, voluntary consent (Article 6(1)(a)). You can withdraw it at any time by message — the photo is removed from the site. Declining has no effect on your visit.

Chatting with LUCY

LUCY is an assistant powered by artificial intelligence. Replies are generated by a model from Anthropic (USA): the content of your messages — including any details you type into them — is sent to that company so a reply can be produced. Anthropic does not train its models on this data; how long it keeps it is set out in its terms for business customers.

LUCY can also move or cancel your appointment — the one your e-mail link points to, or one you booked with her in the same conversation within the last 24 hours — and always only after you confirm. A booking number, e-mail or phone number typed into the chat is not enough to change an appointment. For an appointment booked in the chat we store the conversation identifier, so it can be changed in that same conversation. When a change is made, the conversation record keeps a technical note (booking number, new time, a one-time confirmation code valid for 15 minutes), and the booking gets a note for the salon saying what was changed and when. After a change we send you a confirmation e-mail (if you gave an address) and the salon owner gets a notification.

We keep a record of the conversation (your messages, LUCY's replies, technical notes, the page you wrote from and the language) in our database for 90 days to improve the answers and track costs; after that it is deleted automatically. The salon owner can read the conversations. In your browser the conversation is remembered only until you close the tab.

Legal basis: our legitimate interest (handling enquiries and the quality of replies, Article 6(1)(f)), and when you book, move or cancel an appointment through the chat — the contract. Only tell LUCY what you want the salon to know. Talk to Patrycja in person about health, allergies or pregnancy — LUCY does not give medical advice.

Reviews

When you send a review you give a name or signature, a rating and the text. We publish it once the salon has approved it. To stop spam we also store a keyed hash of your IP address (pseudonymisation) — the address itself is not stored. The review stays on the site until you ask us to remove it.

Technical data and cookies

The site uses no analytics tools and no tracking cookies. Your IP address is briefly used for anti-spam limits (in the server's memory) and appears in the hosting provider's logs. Browser storage is used only to remember a closed promotion pop-up, the current conversation with LUCY and where you moved the LUCY icon (that stays on this device until you clear the site's data). If you open the chat from your appointment link, the link is kept in that tab until you close it or start a new conversation. The only login cookie belongs to the owner's admin panel.

The home page has a Google map with directions to the studio. It loads only after you click “Show map” — until then Google receives no request. Once you click, Google loads the map and may set its own cookies (see Google's privacy policy). During a deposit payment Stripe sets the cookies it needs to secure the transaction — on the payment page only.

Who processes data for us

• Lange Software Solutions (Edinburgh) — builds and maintains the website, the calendar and LUCY on the salon's behalf.
• Vercel (USA) — website hosting.
• Supabase — database, servers in London.
• Resend — sends e-mails: confirmations, reminders, notices of a changed or cancelled appointment and the after-visit e-mail.
• Anthropic (USA) — the AI model that generates LUCY's replies.
• GitHub (USA) — stores the website code together with some of its content (reviews, photos of work).
• Stripe (UK/USA) and Klarna (EU) — online deposit payments; independent controllers of payment data.

Transfers outside the United Kingdom (Vercel, Resend, Anthropic, Stripe) rely on the safeguards provided for in the UK GDPR, including standard contractual clauses with the UK addendum.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, and to data portability. A WhatsApp message, an e-mail to hairmajesty.scotland@gmail.com or a phone call is enough — we reply within a month at the latest. You can also complain to the Information Commissioner's Office.

Changes

Last updated: 1 October 2026. If the way we process data changes, we will update this page.