Privacy Policy

1. Data controller

The data controller is NailBook by BeautyMarketplace srls, Via Valfrè 14, 10121 Torino (IT) — VAT no. 12619090017. For any request concerning your personal data you can contact us at: info@nailbook.eu.

2. Data we collect

We collect the following types of personal data:

• Identifying data: name, email address, phone number.
• Profile data: profile photo, business description, studio address, geographic coordinates.
• Booking data: appointments, services chosen, notes.
• Billing data (studios only): company name, VAT number, tax code, IBAN, legal address, certified email (PEC), SDI code.
• Technical and usage data: access logs, IP address, browser, device, cookies and usage data (pages visited, sessions, interaction events) collected through the analytics tools described in section 6.

3. Purposes and legal bases of processing

• Providing the service (Art. 6(1)(b) GDPR): account management, bookings, notifications.
• Legal and tax obligations (Art. 6(1)(c) GDPR): invoicing, accounting requirements.
• Legitimate interest (Art. 6(1)(f) GDPR): platform security, fraud prevention, service improvement.
• Consent (Art. 6(1)(a) GDPR): marketing communications, push notifications and statistical analysis of how the platform is used (withdrawable at any time).

4. Data retention

Data is kept for the time strictly necessary for the purposes described above. Billing data is kept for at least 10 years as required by Italian tax law. Booking data is kept for 3 years from the appointment date. Account data is deleted within 30 days of a deletion request. Retention periods for analytics data are set out in section 6.

5. Data sharing

We do not sell your data to third parties. Data may be shared with:

• Technical providers (hosting, database, email delivery) acting as data processors under Art. 28 GDPR.
• Analytics providers: HeyCatch, Inc. and its sub-processor PostHog, Inc. (United States), for the purposes described in section 6 only, under HeyCatch's Data Processing Addendum and the safeguards it provides for transfers outside the EU.
• Competent authorities, where required by law.

6. Analytics on how the platform is used (HeyCatch)

To understand how the platform is used and to improve it, NailBook uses HeyCatch, a product analytics service provided by HeyCatch, Inc. (1111B S Governors Ave STE 59736, Dover, DE 19904, USA), which relies on PostHog, Inc. (United States) as its sub-processor. For this data NailBook acts as the controller and HeyCatch as the processor.

• Data processed: pages and screens visited, sessions and their duration, interaction events (clicks, taps and form submissions — never the content of what you type), sign-up and subscription events, a pseudonymous visitor identifier, device and browser data, IP address and approximate geographic area.
• Link to your account: when you sign in, your internal NailBook user id is linked to your visits together with your name and email, so that activity can be followed across sessions and devices. The contents of your appointments, your notes, your billing data and your clients' data are never transmitted.
• Purpose and legal basis: statistical analysis of how the platform is used (Art. 6(1)(a) GDPR — your consent).
• When it starts: analytics tools start only after you accept non-essential cookies in the banner. Without consent, no identifier is written and no event is sent. You may refuse or withdraw consent at any time (see the Cookie Policy).
• Transfer outside the EU: HeyCatch, Inc. and PostHog, Inc. process this data in the United States under the safeguards set out in HeyCatch's Data Processing Addendum (heycatch.ai/dpa). Further information: heycatch.ai/privacy.
• Retention: HeyCatch keeps analytics data for as long as the service is active and for 2 months afterwards, after which it is deleted or irreversibly anonymised.
• Native iOS/Android app: the analytics tools are not included in the native app and collect no data from it (see section 10).

7. Your rights

Under Articles 15-22 GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Request erasure ("right to be forgotten", Art. 17)
• Restrict processing (Art. 18)
• Receive your data in a portable format (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7)
• Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)

To exercise your rights, write to info@nailbook.eu.

8. Camera access

The NailBook app may request access to the device camera solely to let users take or select photos to upload as a profile or salon image. Photos taken with the camera are not shared with third parties and are not used for any purpose other than those stated. Camera access is requested only when you use the photo upload feature and can be revoked at any time in your device settings.

9. Cookies and tracking technologies

NailBook uses cookies and similar technologies to run the service and, with your consent, to analyse how the platform is used.

• Technical cookies (necessary): authentication, session, selected language, storage of your cookie choice. They do not require consent.
• First-party analytics cookies (Google Analytics and HeyCatch): with your explicit consent given in the cookie banner, we use Google Analytics purely as first-party analytics and the HeyCatch product analytics tool described in section 6. We collect aggregated, pseudonymous data (pages visited, sessions, interaction events, device type, approximate geographic area). The advertising features of both Google Analytics and HeyCatch are switched off and are never enabled, not even after consent. You can withdraw consent at any time in the cookie banner or in your browser settings.
• Profiling and advertising cookies: NailBook does not use third-party profiling cookies, does not enable advertising features and does not carry out cross-app or cross-site tracking for advertising purposes.

For more details, see our Cookie Policy.

10. Tracking and App Tracking Transparency (iOS)

NailBook does not carry out cross-app tracking. We do not use the advertising identifier (IDFA), we do not share data with data brokers, and we do not combine data collected by our app with data from other apps or websites for advertising or measurement purposes.

Native iOS/Android app: the native application loads no Google Analytics, HeyCatch or other third-party analytics or tracking scripts, and does not install, collect or store any cookie of any kind — no analytics cookies, no tracking cookies, and not even technical or session cookies. Authentication uses in-memory tokens (not cookies). The native app actively clears all cookies on launch and periodically while in use. No cookie is therefore collected in the native app, the app does not track users within the meaning of App Store Guideline 5.1.2(i), and Apple's App Tracking Transparency (ATT) framework is not required.

Google Analytics and HeyCatch are configured purely as first-party analytics tools: advertising features, Google Signals and audience sharing are switched off and session replay is disabled. The data collected (pages visited, session duration, interaction events, device model, operating system and approximate geographic area) is aggregated and pseudonymous, and is not used to track users across third-party apps or websites. For this reason the app does not use Apple's App Tracking Transparency (ATT) framework, since it does not fall within the App Store guidelines' definition of "tracking".

Personal data (name, email, phone, photos, location) is collected and used solely to provide the booking service and the studio management features, and not for advertising tracking purposes.

11. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure, in line with Art. 32 GDPR.

12. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy. Material changes will be communicated by email or in-app notification at least 15 days in advance.