Privacy Policy

Who we are

YXEO ("we", "us") is a booking management platform for beauty and wellness businesses. The data controller is YXEO.eu. Contact: privacy@YXEO.eu.

What data we collect

• Account data — email address, name (from Google or entered manually), authentication tokens.
• Booking data — name, email, phone number, appointment details you provide when booking.
• Usage data — pages visited, actions taken in the app, timestamps.
• Technical data — IP address, browser type, device information collected automatically.

Why we collect it

• To provide the booking service (contract performance, Art. 6(1)(b) GDPR).
• To send booking confirmations, reminders, and cancellation notices (contract performance).
• To comply with legal obligations such as record-keeping (Art. 6(1)(c) GDPR).
• To improve the service and prevent abuse (legitimate interests, Art. 6(1)(f) GDPR).

Who we share data with

• Supabase — database and authentication (EU region).
• Vercel — hosting infrastructure (EU region).
• Resend — transactional email delivery.
• Paddle — processes payments and invoicing on the salon's behalf.
• Sentry — helps us detect and fix bugs.
• Upstash — protects the booking page from abuse.
• Zoho — handles incoming mail to bookings@YXEO.eu.
• The salon or business you booked with can see your name, email, and booking details.

We do not sell personal data.

How long we keep it

Booking records are kept for the period configured by each business (default 36 months). Once all of a client's bookings reach that same retention period, the client's personal data — name, email, phone number — is anonymised. Account data is kept until you delete your account. After deletion, data is anonymised or permanently erased within 7 days.

Your rights (GDPR)

If you have a YXEO account(you're a salon owner or staff member): you can access, correct, delete, or restrict processing of your data directly from your account.

• Access a copy of your personal data (including data portability) — use My account → Export my data.
• Delete your data — use My account → Delete my account.
• Correct inaccurate data or restrict processing — email privacy@YXEO.eu.

If you're a salon's client(you booked an appointment but don't have a YXEO account): the salon you booked with is the controller of your data, not YXEO. YXEO only processes your data on the salon's instructions, as a data processor. To exercise your rights, contact the salon directly. If the salon can't help, or you have a general question about how YXEO handles data, email privacy@YXEO.eu.

Either way, you have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt).

Cookies

We use only strictly necessary session cookies required for authentication. No advertising or tracking cookies are used. No cookie consent is required for strictly necessary cookies under ePrivacy rules.

Changes

We may update this policy. Material changes will be communicated by email or an in-app notice. Continued use after changes constitutes acceptance.