1.1 A.R.E., operating under the trading name HandSkill Beauty ("HandSkill Beauty", "we", "us" or "our"), operates a two-sided marketplace that connects clients with independent beauty professionals for the booking and payment of in-person beauty, grooming, wellness and tailoring services. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, whom we share it with, how long we keep it, how we protect it, and what rights you have.
1.2 This Policy applies to the website at www.handskillbeauty.com, to the HandSkill Beauty mobile applications for iOS and Android, and to all related features and communications (together, the "Platform"). It applies to clients, to professionals, to ambassadors and talent scouts, and to visitors who browse without registering.
1.3 This Policy does not apply to the practices of any independent professional in respect of information they collect from you directly and outside the Platform, for example during an in-person consultation, on their own premises, on their own booking system, or through their own social media. Where a professional collects your information for their own purposes, that professional is a separate and independent controller of it and is responsible for its handling.
1.4 This Policy also does not apply to the practices of third-party services whose own notices govern the information they collect, in particular Stripe, whose privacy notice applies to payment and identity information you supply to it directly.
1.5 This Policy forms part of, and should be read together with, our Terms and Conditions and our Cookie Policy.
1.6 Please read this Policy carefully. If you do not agree with it, you must not use the Platform.
2.1 The controller of personal information described in this Policy is A.R.E., trading as HandSkill Beauty, a company organised under the laws of the State of Michigan, United States of America. For the purposes of the United Kingdom and European Union General Data Protection Regulation, we are the controller in respect of the operation of the Platform, account administration, marketplace matching, payment facilitation, safety and fraud prevention, communications and marketing.
2.2 A professional who receives your personal information through the Platform in order to perform a service, and who then uses that information for their own purposes, including their own client records, consultation notes, aftercare follow-up or marketing, acts as an independent controller of that information. We are not responsible for how a professional uses information in that capacity, although professionals are required by our Terms and Conditions to comply with applicable data protection law.
2.3 You may contact us about any privacy matter at privacy@handskillbeauty.com. We have not appointed a data protection officer, as we are not required to do so, but privacy enquiries are handled by a designated member of our team who can be reached at that address.
3.1 The following summary is provided for convenience only. It does not replace the detailed sections that follow.
We collect the information you give us when you register, build a profile, list a service, make or accept a booking, communicate through the Platform, and pay or get paid.
We collect technical and usage information automatically, including device information, log data and approximate location derived from your internet protocol address.
We do not collect or store full payment card numbers. Payment card and bank information is collected directly by Stripe.
We share information with the professional or client you transact with, to the extent necessary for the booking to take place, and with service providers who host, process and support the Platform.
We do not sell personal information for money, and we do not use it for cross-context behavioural advertising.
We transfer information internationally, including to the United States, and use recognised safeguards where required.
You have rights over your information, including the right to access, correct, delete and, in some jurisdictions, object or port. You can delete your account directly within the mobile application and the website.
4.1 We collect the following categories of personal information. Not every category applies to every user.
Identifiers and contact information: full name, electronic mail address, telephone or messaging number including a WhatsApp number where you supply one, account identifier, and password in hashed form.
Profile information: profile photograph, biography, languages spoken, service categories, qualifications and experience as you describe them, service area, availability and pricing.
Location information: city and country, service address or meeting address supplied for a booking, service radius, and approximate location derived from your internet protocol address.
Transaction information: bookings made, requested and accepted, service descriptions, dates, times, amounts, gratuities, platform fees, refunds, cancellations, disputes and chargebacks.
Payment and payout information: payment card data and bank account details, in each case collected and held by Stripe rather than by us, together with the tokens, identifiers, last four digits, card brand, payout status and transaction records that Stripe returns to us.
Verification information: information supplied to satisfy identity, age, licensing, tax or anti-money laundering requirements, including any identification document you upload at our request or at the request of Stripe.
Content: portfolio photographs and videos, service descriptions, reviews and ratings, and any other material you upload.
Communications: messages exchanged through the in-app messaging function, correspondence with our support team, and records of notices we send you.
Technical and usage information: device model and operating system, application version, unique device and installation identifiers, push notification tokens, internet protocol address, browser type and language, referring pages, pages and screens viewed, features used, session times, crash reports and diagnostic logs.
Programme information: referral links and codes used, ambassador and talent scout activity, qualifying events, commissions and bonuses accrued and paid.
Inferences: preferences and interests inferred from your activity for the purpose of generating recommendations and personalising search results.
4.2 We ask you not to submit information about your health through the Platform. Health information relevant to a service, such as an allergy, sensitivity, skin condition, pregnancy or medication, should be disclosed directly to the professional at consultation and not entered into a listing, review or public field. Where you nevertheless choose to include such information in a message or a support enquiry, we process it on the basis of your explicit consent, or where necessary for the establishment, exercise or defence of legal claims, and we treat it as confidential.
4.3 We do not knowingly collect government identification numbers, precise geolocation from device sensors, biometric identifiers, or information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, or criminal convictions. We do not perform facial recognition, facial geometry mapping, or any other biometric analysis on photographs or videos uploaded to the Platform.
5.1 When you register an account, we collect your name, electronic mail address and password. Where you register using Google Sign-In, Google provides us with your name, electronic mail address and profile photograph, and we do not receive your Google password.
5.2 When you build a profile, we collect the profile photograph, biography, contact preferences and, for professionals, the service listing, pricing, availability, service area and portfolio media you choose to publish.
5.3 When you make or accept a booking, we collect the details of the booking, including the service selected, the date and time, the address or meeting location, and any notes you add.
5.4 When you communicate through the Platform, we collect the content of your messages and the associated metadata, including the identity of the participants and the time of sending.
5.5 When you leave a review or rating, we collect the text, the score, and the booking to which it relates, and we publish it together with your display name and profile photograph.
5.6 When you contact our support team, we collect the content of the correspondence and any attachment you send.
5.7 When you participate in the ambassador or talent scout programme, we collect the referral activity and the information required to pay and, where applicable, to report the commission.
5.8 Some information is required in order to operate the Platform. If you decline to provide it, we may be unable to create your account, publish your listing, process a booking, or pay you.
6.1 When you access the Platform, we and our service providers automatically collect technical information about your device and your use of the Platform. This includes your internet protocol address, device and browser characteristics, operating system, application version, unique device and installation identifiers, referring and exit pages, the pages and screens you view, the actions you take, the dates and times of your visits, and crash and performance diagnostics.
6.2 This information is collected using cookies, software development kits and similar technologies, including those provided by Firebase, which we use for authentication, database, storage, messaging and hosting. Our use of these technologies, the categories involved, and the choices available to you are described in the Cookie Policy.
6.3 We use this information to authenticate you, to keep you signed in, to remember your preferences, to deliver push notifications, to secure the Platform, to detect and prevent fraud and abuse, to diagnose faults, to measure performance, and to understand how the Platform is used so that we can improve it.
6.4 Where required by law, non-essential cookies and similar technologies are used only with your consent, which you may give or withhold through the consent banner presented on the website and through the settings available in the mobile application.
7.1 Location is central to a marketplace for in-person services. We collect and use location information in the following ways.
7.2 You supply location information directly when you enter a city, a service area, a service radius, or an address at which a service is to be performed. A service address you supply for a booking is shared with the professional you have booked, and, for safety and dispute purposes, is retained by us.
7.3 We derive an approximate location from your internet protocol address using the services ipapi.co and, as a fallback, ipwho.is. This produces an approximation at city or regional level. It is not precise device geolocation. We use it to show relevant listings, to set default language and currency, to apply regional legal requirements, and to detect anomalous account activity and fraud.
7.4 We use the geocoding services Photon, operated by Komoot, and Nominatim, operated by the OpenStreetMap Foundation, to convert an address you enter into coordinates and to display it on a map. The address text you enter is transmitted to those services for that purpose.
7.5 We do not access the precise satellite or sensor-based location of your device in the background. Where a mobile operating system permission is requested in order to populate an address field, it is used only at the moment of that request and only for that purpose, and you may decline it and enter the address manually.
7.6 Professionals should be aware that publishing a precise home address as a place of business makes that address publicly visible. We recommend that professionals working from home publish a service area rather than a street address, and disclose the exact address only to a client whose booking has been confirmed.
8.1 Payments are processed by Stripe. When you enter payment card details, those details are transmitted directly to Stripe. We do not receive, process or store the full card number, the expiry date in combination with the full number, or the card verification value.
8.2 We receive from Stripe a payment token, the transaction status, the amount, the currency, the card brand, the last four digits of the card, the country of issue, and information about failures, refunds, disputes and chargebacks. We use this information to operate bookings, to reconcile payments, to calculate platform fees, to administer refunds and disputes, and to detect fraud.
8.3 Professionals receive payment through a connected account created with Stripe using the Stripe Express product. In creating that account, a professional supplies to Stripe the identity, address, date of birth, tax and bank account information that Stripe requires in order to satisfy its own regulatory obligations, including customer due diligence, sanctions screening and tax reporting. That information is supplied to Stripe, not to us. We receive confirmation of the account status, the verification outcome, the payout status, and the balance and transaction records associated with the connected account.
8.4 Stripe processes personal information as an independent controller in respect of its own regulatory and risk obligations, and as our processor in respect of the payment processing we instruct. Stripe's own privacy notice governs its processing as controller.
8.5 We do not hold client funds, do not act as an escrow agent, and do not transmit money. Settlement is performed by Stripe.
9.1 Where we ask a professional for evidence of a licence, registration, certification or insurance, we collect the document supplied and record the fact, the date and the outcome of the check.
9.2 Where we ask any user for evidence of identity or age, for example because an account has been reported, because an anomaly has been detected, or because a payment provider requires it, we collect the identification document supplied. We retain such documents only for as long as necessary to complete the check and to evidence that it was performed, and then delete them in accordance with Section 17.
9.3 Verification of this kind is limited in scope. It confirms that a document was supplied and appeared regular on its face. It is not an investigation, and our Terms and Conditions make clear that it does not constitute an endorsement or a guarantee of any user.
9.4 We may share the outcome of a verification, but not the underlying document, with a client where doing so is necessary to protect safety, and with a regulator, licensing authority or law enforcement body where we are required or permitted to do so.
10.1 Portfolio photographs and videos uploaded by professionals are stored and delivered using Cloudinary, a media management and delivery service. Uploaded media may be resized, compressed, cropped and re-encoded for delivery, and is served from a content delivery network.
10.2 A photograph or video may depict an identifiable person. Our Terms and Conditions require every professional to obtain the informed written consent of any identifiable person before uploading their image, and to remove the image promptly if consent is withdrawn. If you believe an image of you has been published without your consent, contact privacy@handskillbeauty.com and we will remove it while the matter is investigated.
10.3 We do not apply facial recognition, facial geometry extraction, template creation, or any other biometric identifier technology to uploaded media, and we do not permit our service providers to do so on our behalf.
10.4 Messages exchanged through the in-app messaging function are stored on our systems and are not end-to-end encrypted. As explained in our Terms and Conditions, we may access, review and retain message content where it is necessary and proportionate for the operation and support of the service, for the investigation of suspected fraud, harassment, circumvention or unlawful conduct, for the resolution of disputes, for the protection of user safety, for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims. Automated techniques are used to detect spam, prohibited content and attempts to move transactions off the Platform.
10.5 Reviews, ratings, profile information, listings and portfolio media are published on the Platform and are visible to other users and, depending on your settings and on the design of the public pages, may be visible to the public and indexed by search engines. Do not publish anything you would not wish to be seen publicly.
11.1 We use personal information for the purposes set out below. For users protected by the General Data Protection Regulation or the United Kingdom General Data Protection Regulation, the applicable legal basis is stated alongside each purpose.
Account and platform operation. To create and administer your account, authenticate you, and provide the Platform. Legal basis: performance of a contract with you.
Marketplace matching and bookings. To publish listings, match clients with professionals, process booking requests and acceptances, and enable communication between the parties to a booking. Legal basis: performance of a contract.
Payments and payouts. To facilitate payment, calculate and collect the platform fee, arrange payouts, administer gratuities, and process refunds, cancellations and disputes. Legal basis: performance of a contract, and compliance with a legal obligation in respect of accounting and tax records.
Referral programmes. To operate the ambassador and talent scout programmes, calculate commissions and bonuses, and apply clawbacks. Legal basis: performance of a contract.
Transactional communications. To send confirmations, reminders, receipts, cancellation notices and security alerts. Legal basis: performance of a contract.
Customer support. To provide customer support and to resolve complaints. Legal basis: performance of a contract, and our legitimate interest in operating an effective support function.
Safety, fraud prevention and enforcement. To keep the Platform and its users safe, to verify identity and eligibility where necessary, to detect, investigate and prevent fraud, abuse, harassment, circumvention and other breaches of our Terms and Conditions, and to enforce those Terms. Legal basis: our legitimate interest in protecting users and the integrity of the Platform, and compliance with a legal obligation where applicable.
Personalisation and translation. To generate recommendations, order search results, personalise the experience, and translate content between languages. Legal basis: our legitimate interest in providing a useful and relevant service, and performance of a contract.
Analytics and improvement. To measure, analyse and improve the Platform, to diagnose and fix faults, and to develop new features. Legal basis: our legitimate interest in improving our service, and, where non-essential analytics technologies are used, your consent.
Marketing. To send marketing communications about the Platform. Legal basis: your consent, or our legitimate interest in marketing to existing customers where permitted by law and subject to an unconditional right to opt out.
Legal compliance. To comply with legal obligations, including tax, accounting, anti-money laundering, sanctions, consumer protection and application store requirements, and to respond to lawful requests from public authorities. Legal basis: compliance with a legal obligation.
Legal claims and vital interests. To establish, exercise or defend legal claims, and to protect the vital interests of any person where there is a risk of serious harm. Legal basis: our legitimate interest in the protection of our legal position, and protection of vital interests.
Corporate transactions. To evaluate, negotiate or complete a corporate transaction such as a merger, acquisition, financing or sale of assets. Legal basis: our legitimate interest in the conduct of our business.
11.2 Where we rely on legitimate interests, we have carried out a balancing assessment and have satisfied ourselves that our interests are not overridden by your interests, rights and freedoms. You may ask us for further information about that assessment, and you have the right to object as described in Section 19.
11.3 Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
11.4 We will not use your personal information for a materially different purpose without first informing you and, where required, obtaining your consent.
12.1 We use automated techniques, including machine learning models operated within the Firebase environment, to generate recommendations, to order and personalise search results, and to detect fraud, spam and prohibited content. These techniques process information about listings, availability, location, price, ratings and user activity.
12.2 Recommendations are informational. They do not produce legal effects concerning you and are not decisions about you. They do not constitute an assessment of the competence, qualification, licensing status or safety of any professional.
12.3 We use the DeepL machine translation service to translate listings, profiles, service descriptions, reviews and messages between languages. Text submitted for translation is transmitted to DeepL for that purpose. Machine translation may be inaccurate, and the original text prevails over any translation.
12.4 We do not use your personal information to train general purpose or foundation artificial intelligence models operated by third parties, and we do not permit our service providers to use personal information obtained through the Platform to train their own general purpose models.
12.5 We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing, except that automated systems may restrict or suspend an account where fraud or a serious safety risk is detected. Where such a measure is applied to you, you may obtain human intervention, express your point of view, and contest the decision by writing to privacy@handskillbeauty.com.
13.1 We send two kinds of message. Transactional messages relate to your account, your bookings, your payments and the security of the Platform. They are a necessary part of the service and cannot be switched off while you hold an account. Marketing messages promote features, offers and content, and are entirely optional.
13.2 Marketing electronic mail is sent using EmailJS and is sent only where you have consented, or where we are permitted to market to an existing customer under applicable law. Every marketing message contains a clear and functioning unsubscribe mechanism, identifies us as the sender, and includes a valid postal address, in accordance with the CAN-SPAM Act of 2003 and equivalent requirements elsewhere. Unsubscribe requests are actioned promptly and in any event within ten business days.
13.3 Where you are located in the European Union, the United Kingdom, or another jurisdiction requiring prior consent for electronic marketing, we will not send you marketing messages unless you have opted in, and consent to marketing is never bundled with acceptance of our Terms and Conditions or presented as a condition of registration.
13.4 Push notifications are delivered using Firebase Cloud Messaging and require a push notification token associated with your device. You may disable push notifications at any time in your device settings or in the application. Disabling them may mean you do not receive timely booking and safety notifications.
13.5 We do not send marketing messages by short message service or by WhatsApp unless you have given separate, specific, express written consent to receive them, which is not a condition of using the Platform, and which you may withdraw at any time. Where you supply a WhatsApp number, it is used for booking coordination only unless you have consented otherwise.
13.6 We do not disclose your personal information to third parties for those third parties' own direct marketing purposes.
14.1 We disclose personal information only as described in this Policy. We do not sell personal information.
14.2 To other users. When a booking is requested, we disclose to the professional the client's display name, profile photograph, contact details necessary for coordination, the service address or meeting location, the booking details, and any notes the client has added. We disclose to the client the professional's name or trading name, profile, portfolio, service area, pricing, ratings and reviews, and, once a booking is confirmed, the contact details necessary for coordination. Reviews, ratings, profiles, listings and portfolio media are published to other users and may be publicly visible.
14.3 To service providers. We disclose personal information to the providers who host, operate, secure and support the Platform. Each is engaged under a written contract that restricts their use of personal information to the purposes we specify. The principal providers are listed in Section 15.
14.4 To payment providers. We disclose transaction information to Stripe as necessary to process payments, arrange payouts, administer refunds and disputes, and satisfy Stripe's own regulatory obligations.
14.5 To professional advisers and insurers. We disclose personal information to our lawyers, accountants, auditors and insurers where necessary for the conduct of our business, the audit of our accounts, or the handling of a claim.
14.6 To authorities. We disclose personal information to law enforcement, regulators, licensing authorities, tax authorities and courts where we are required to do so by law, where we are responding to a valid legal process, or where disclosure is necessary to investigate or prevent a crime, to protect the safety of any person, or to establish, exercise or defend legal claims. Where we may lawfully do so, we will notify the affected user of a request before responding, and we assess each request for validity and proportionality before complying.
14.7 In corporate transactions. If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy, receivership, or sale of all or part of our assets, personal information may be disclosed to the counterparty and its advisers as part of due diligence, and may be transferred as part of the transaction, subject to appropriate confidentiality protections and to the continued application of this Policy or of a policy no less protective. We will notify affected users of any such transfer.
14.8 With your direction or consent. We disclose personal information to any other recipient where you direct or consent to it.
14.9 We do not disclose personal information to advertising networks, data brokers, or analytics partners for cross-context behavioural advertising.
15.1 We use the following categories of service provider. Each processes personal information on our behalf and under our instructions, save where identified as an independent controller.
Google LLC — providing Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging and Hosting, and Google Sign-In. Purpose: authentication, application database, media and file storage, backend processing, push notification delivery, and website and application hosting.
Stripe, Inc. — providing payment processing, Stripe Connect and Stripe Express. Purpose: collection of payments, holding and settlement of funds, professional onboarding and verification, payouts, refunds, dispute and chargeback handling. Stripe acts as an independent controller in respect of its own regulatory, risk and fraud obligations.
Cloudinary Ltd — providing media storage, transformation and delivery. Purpose: hosting and serving portfolio photographs and videos and profile images.
DeepL SE — providing machine translation. Purpose: translation of listings, profiles, messages and reviews between languages.
EmailJS — providing electronic mail delivery. Purpose: sending transactional and, where you have consented, marketing electronic mail.
ipapi.co and ipwho.is — providing internet protocol address geolocation. Purpose: deriving approximate city or regional location for relevance, localisation and fraud detection.
Komoot GmbH (Photon geocoding service) and the OpenStreetMap Foundation (Nominatim geocoding service) — Purpose: converting addresses into coordinates and displaying locations on maps.
15.2 We assess each provider before engagement, enter into a written data processing agreement where required, and impose obligations of confidentiality, security, sub-processing control and assistance with data subject rights.
15.3 We may add, replace or remove service providers from time to time. An up-to-date list is available on request from privacy@handskillbeauty.com.
16.1 We operate a global marketplace and are established in the United States. Personal information is therefore transferred to, stored in, and processed in the United States and in other countries where we or our service providers operate. Those countries may have data protection laws that differ from, and in some cases provide less protection than, the laws of your own country.
16.2 Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on one or more of the following safeguards: the Standard Contractual Clauses adopted by the European Commission, together with the United Kingdom International Data Transfer Addendum where the transfer is from the United Kingdom; a finding of adequacy in respect of the recipient country or framework, where one applies; your explicit consent, where appropriate; or the necessity of the transfer for the performance of a contract with you or for the establishment, exercise or defence of legal claims.
16.3 Where a transfer is made in reliance on the Standard Contractual Clauses, we carry out an assessment of the law and practice of the destination country and apply supplementary technical, contractual and organisational measures where the assessment indicates that they are needed, including encryption in transit and at rest, access controls, and contractual commitments to challenge unlawful requests for disclosure.
16.4 By its nature, a global marketplace requires the transfer of your booking and contact details to the professional or client you transact with, who may be located in another country. That transfer is necessary for the performance of the contract you enter into.
16.5 You may request a copy of the safeguards we rely on by writing to privacy@handskillbeauty.com.
17.1 We retain personal information only for as long as is necessary for the purposes for which it was collected, including to satisfy legal, tax, accounting, regulatory and dispute resolution requirements. The following periods apply unless a longer period is required by law or by the needs of an actual or anticipated legal claim.
Account and profile information: for the duration of the account, and for a period of ninety days after account deletion to allow for recovery from error and the completion of pending matters, after which it is deleted or irreversibly anonymised.
Listings and portfolio media: for the duration of the account, and removed from public display immediately on deletion of the listing or of the account.
Booking and transaction records (including amounts, fees, refunds and disputes): seven years from the end of the financial year to which they relate, in order to satisfy tax, accounting and audit obligations.
Payment records held by us (being tokens and transaction metadata rather than card data): seven years, aligned with the retention of transaction records.
In-app messages: three years from the date of the message, or for the duration of any related dispute or investigation if longer.
Reviews and ratings: retained after account closure in anonymised or pseudonymised form, so that the record of a professional's service history is not distorted by the closure of a client account.
Identity and verification documents: deleted within ninety days of the completion of the relevant check, save that a record that the check was performed, its date and its outcome is retained for seven years.
Support correspondence: three years from the closure of the enquiry.
Technical logs, security logs and diagnostics: twelve months, save where retained longer as part of an ongoing security investigation.
Marketing consent and suppression records: retained for as long as necessary to demonstrate compliance and to ensure that an unsubscribe request is honoured indefinitely.
Records relating to a suspension or termination for safety, fraud or abuse: retained for as long as necessary to prevent the person concerned from re-registering and to protect other users, and reviewed periodically.
17.2 Where information is no longer required, we delete it or irreversibly anonymise it. Anonymised information, which can no longer be associated with an identifiable person, may be retained and used indefinitely for statistical and analytical purposes.
17.3 Backups are retained on a rolling cycle and are overwritten in the ordinary course. Where information is deleted from live systems, residual copies may persist in backups for a short period until the cycle completes, during which they are not accessible for ordinary operational use.
18.1 We implement technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. These include encryption of data in transit using transport layer security, encryption at rest in our hosted environment, hashing of passwords, role-based access controls and the principle of least privilege, authentication and session controls, security rules governing database and storage access, logging and monitoring, segregation of production and development environments, and the vetting of service providers.
18.2 We do not store payment card data. Card data is handled by Stripe, which maintains certification under the Payment Card Industry Data Security Standard.
18.3 We do not describe our security as "bank-grade", "military-grade" or otherwise by reference to any standard we have not independently verified. We describe the measures we actually apply.
18.4 No system is completely secure. We cannot guarantee the security of information transmitted to or from the Platform, and any transmission is at your own risk. You are responsible for keeping your password confidential, for using a unique password, and for notifying us promptly of any suspected compromise of your account.
18.5 We maintain an incident response process. Where a personal data breach occurs that is likely to result in a risk to the rights and freedoms of affected individuals, we will notify the competent supervisory authority within seventy-two hours of becoming aware of it where required by the General Data Protection Regulation or the United Kingdom General Data Protection Regulation, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to them. We will also comply with applicable United States state breach notification statutes, which impose their own timing and content requirements.
19.1 If you are located in the European Economic Area, the United Kingdom or Switzerland, you have the following rights in respect of your personal information.
Access: to obtain confirmation of whether we process your personal information and, if so, a copy of it together with information about the processing.
Rectification: to have inaccurate personal information corrected and incomplete information completed.
Erasure: to have personal information deleted where it is no longer necessary, where you withdraw consent and there is no other basis, where you object and there is no overriding legitimate ground, or where it has been processed unlawfully.
Restriction: to have processing restricted while accuracy is verified, while an objection is considered, or where processing is unlawful but you prefer restriction to erasure.
Portability: to receive personal information you have provided to us, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible, in respect of processing carried out by automated means on the basis of consent or contract.
Objection: to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time and without reason to processing for direct marketing purposes.
Withdrawal of consent: to withdraw consent at any time where processing is based on consent.
Automated decision-making: not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, and to obtain human intervention, express your view and contest the decision where such processing occurs.
Complaint: to lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, place of work or the place of the alleged infringement. In the United Kingdom, the supervisory authority is the Information Commissioner's Office.
19.2 We respond to requests without undue delay and in any event within one month of receipt. That period may be extended by two further months where the request is complex or where a number of requests have been received, in which case we will inform you within one month of the extension and the reasons for it.
19.3 We do not charge a fee for exercising these rights, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, and will explain why.
19.4 We may need to verify your identity before acting on a request, in order to protect your information from disclosure to a person impersonating you.
19.5 Some rights are qualified. We may decline a request in whole or in part where an exemption applies, for example where compliance would adversely affect the rights of another person, where information must be retained to comply with a legal obligation, or where information is required for the establishment, exercise or defence of legal claims. Where we decline, we will tell you why.
20.1 A number of United States states have enacted comprehensive consumer privacy statutes, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Michigan, where we are established, has not enacted such a statute, but residents of the states listed above have rights under their own state law.
20.2 Subject to the terms and exemptions of the applicable state statute, you may have the right to: confirm whether we process your personal information and access it; obtain a portable copy of it; correct inaccuracies; delete it; obtain information about the categories of personal information disclosed and the categories of recipient; opt out of the sale or sharing of personal information, of targeted advertising, and of profiling in furtherance of decisions producing legal or similarly significant effects; limit the use and disclosure of sensitive personal information; and appeal a refusal of a request.
20.3 We do not sell personal information for monetary consideration, do not share personal information for cross-context behavioural advertising, do not engage in targeted advertising, and do not use personal information for profiling in furtherance of decisions producing legal or similarly significant effects. Accordingly, there is no sale, sharing or targeted advertising for you to opt out of. We honour the Global Privacy Control signal where a browser transmits one.
20.4 We will not discriminate against you for exercising a privacy right. We will not deny you goods or services, charge you a different price, or provide you a different level of service because you exercised a right.
20.5 An authorised agent may submit a request on your behalf where they provide written proof of authorisation, and we may require you to verify your own identity and to confirm that you granted the authority.
20.6 We respond to state privacy requests within the period required by the applicable statute, which is generally forty-five days, extendable by a further forty-five days where reasonably necessary, on notice to you. If we decline a request, you may appeal by writing to privacy@handskillbeauty.com with the words "Privacy Appeal" in the subject line. We will respond to an appeal within the period required by the applicable statute and will inform you of any right you have to contact your state attorney general.
21.1 This Section supplements the rest of this Policy and applies to residents of California under the California Consumer Privacy Act as amended by the California Privacy Rights Act.
21.2 In the twelve months preceding the effective date of this Policy, we collect and, in the course of the twelve months following, expect to collect the following statutory categories of personal information: identifiers; personal information listed in the California customer records statute, being name, address, telephone number and financial account information; commercial information, being records of services obtained or provided and transaction histories; internet or other electronic network activity information; geolocation data at approximate level; visual information, being photographs and videos uploaded; professional or employment-related information, being a professional's trade, qualifications and business details; and inferences drawn to create a profile reflecting preferences.
21.3 We collect these categories from you directly, from your device automatically, from other users with whom you transact, and from our service providers, in particular Stripe and our geolocation and authentication providers.
21.4 We collect and use personal information for the business and commercial purposes described in Section 11. We disclose personal information for business purposes to the categories of recipient described in Section 14 and Section 15.
21.5 We do not sell personal information and have not sold personal information in the preceding twelve months. We do not share personal information for cross-context behavioural advertising and have not done so in the preceding twelve months. We do not have actual knowledge that we sell or share the personal information of consumers under sixteen years of age, and the Platform is restricted to persons aged eighteen and over.
21.6 We do not use or disclose sensitive personal information for purposes other than those permitted under the applicable regulations without a right to limit, and we do not use sensitive personal information to infer characteristics about you. Where account credentials are processed, they are used only to authenticate you.
21.7 Californian residents have the rights to know, delete, correct, opt out and limit as described in Section 20, and the right to be free from discrimination for exercising them. Requests may be submitted at privacy@handskillbeauty.com or through the account settings within the Platform.
21.8 California Civil Code section 1798.83, known as the "Shine the Light" law, permits Californian residents to request information about disclosures of personal information to third parties for those third parties' direct marketing purposes. We make no such disclosures.
22.1 Canada. If you are in Canada, the Personal Information Protection and Electronic Documents Act, or the substantially similar law of your province, applies. You may request access to your personal information and challenge its accuracy, and you may withdraw consent subject to legal and contractual restrictions. Complaints may be made to the Office of the Privacy Commissioner of Canada or to the applicable provincial commissioner. Commercial electronic messages are sent in accordance with Canada's Anti-Spam Legislation.
22.2 Brazil. If you are in Brazil, the Lei Geral de Proteção de Dados applies. You have rights to confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about sharing, information about the consequences of refusing consent, revocation of consent, and to object to processing carried out on a basis other than consent. Complaints may be made to the Autoridade Nacional de Proteção de Dados.
22.3 Nigeria. If you are in Nigeria, the Nigeria Data Protection Act 2023 applies. You have rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with the Nigeria Data Protection Commission.
22.4 South Africa. If you are in South Africa, the Protection of Personal Information Act 2013 applies. You have rights of access, correction, deletion and objection, and the right to complain to the Information Regulator.
22.5 Other jurisdictions. Where the law of your jurisdiction confers rights over personal information that are not described in this Policy, we will honour those rights to the extent that the law applies to us. Please contact privacy@handskillbeauty.com and identify the law you rely on.
22.6 We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the General Data Protection Regulation. Where we become obliged to do so, we will appoint one and update this Policy with the representative's details.
23.1 The Platform is restricted to persons aged eighteen years and over. It is not directed to children and we do not knowingly collect personal information from any person under the age of eighteen.
23.2 We do not knowingly collect personal information from children under the age of thirteen within the meaning of the Children's Online Privacy Protection Act, and we do not offer any service directed to children within the meaning of that Act, of the United Kingdom Age Appropriate Design Code, or of comparable regimes elsewhere.
23.3 If we become aware that a person under eighteen has created an account, we will close the account and delete the associated personal information promptly. A parent or guardian who believes that a minor has provided personal information to us should contact privacy@handskillbeauty.com so that we can take action.
23.4 Professionals must not upload a photograph or video depicting a minor to a portfolio, and must not include information about a minor in a listing, review or message.
24.1 You may delete your account, and request the deletion of the personal information associated with it, directly within the HandSkill Beauty mobile application and on the website at www.handskillbeauty.com, through the account settings menu. No electronic mail, telephone call or form outside the Platform is required.
24.2 A request to delete an account may also be submitted by writing to privacy@handskillbeauty.com from the electronic mail address associated with the account.
24.3 On deletion, your profile, listings and portfolio media are removed from public display immediately. Your account information is deleted or irreversibly anonymised within ninety days, save for the categories identified in Section 17 which we are required to retain, being principally transaction and tax records, records relating to a dispute or legal claim, records of a suspension or termination imposed for safety or fraud reasons, and marketing suppression records.
24.4 Deletion cannot be completed while a booking that has been confirmed remains uncompleted, or while an amount remains owing to or by you. In that case we will tell you what needs to be resolved and will process the deletion once it is.
24.5 Reviews you have written may be retained in anonymised form so that the service history of the professional reviewed is not distorted. Where a review discloses your identity in its text, we will remove that text on request.
24.6 To exercise any other right, write to privacy@handskillbeauty.com describing the right you wish to exercise and the information concerned. We will acknowledge your request, verify your identity, and respond within the period required by the law applicable to you.
25.1 We may update this Policy from time to time to reflect changes in our practices, in the Platform, or in applicable law. The version number and effective date at the head of this document identify the current version.
25.2 Where a change is material, we will notify you by electronic mail to the address associated with your account, by in-app notice, or by both, before the change takes effect, and, where the change requires your consent, we will obtain that consent. Continued use of the Platform after the effective date of a non-material change constitutes acknowledgement of the updated Policy.
25.3 We retain prior versions of this Policy and will provide a copy of the version in force at any particular time on request.
25.4 If you have a question, a concern or a complaint about how we handle personal information, please contact us first at privacy@handskillbeauty.com. We take complaints seriously and will investigate and respond.
25.5 If you are not satisfied with our response, you may complain to the supervisory or regulatory authority in your jurisdiction, as described in Sections 19 and 22. You have the right to do so without first contacting us, although we would welcome the opportunity to resolve the matter directly.
25.6 The English language version of this Policy is the authoritative version. Any translation is provided for convenience only and, in the event of any inconsistency, the English version prevails.
A.R.E., trading as HandSkill Beauty · State of Michigan, United States of America
Privacy & data protection: privacy@handskillbeauty.com
General & account support: support@handskillbeauty.com
Legal notices: legal@handskillbeauty.com
Version 1.0 · Effective 23 July 2026