Legal

Privacy Policy

Last updated: June 21, 2026

WebGlow, operated by Abdelkhalek Zine ("we", "us", "our"), provides a website and booking platform for beauty salons. This policy explains what personal data we collect, how we use it, and your rights. We've written it in plain language — no unnecessary legalese.

1. What data we collect

Salon owner accounts

• Email address and password (stored as a secure hash — we never store your password in plain text)
• Salon name, subscription tier, and subscription status

End-client data (collected on behalf of salons)

When a visitor uses a salon's WebGlow-powered website to book an appointment, place an order, check loyalty points, or chat with an AI concierge, we collect:

• Name, email address, and phone number
• Appointment details (service, date, time)
• Order details (products, quantities, amounts)
• Loyalty points balance (linked to email address)
• AI chat conversation messages

Usage data

• Rate-limit counters (a session token and request count used to prevent abuse — not linked to your identity and deleted within 24 hours)

2. How we use this data

• To operate the booking, storefront, loyalty, and AI concierge features
• To allow salon owners to view and manage their clients' interactions via the WebGlow dashboard
• To send appointment confirmations and order acknowledgements to clients (via the salon's configured contact method)
• To generate AI responses in the chat concierge feature (see Section 4)
• To prevent abuse of our public-facing functions

We do not sell personal data to third parties. We do not use client data for advertising purposes.

3. Infrastructure — where data is stored

All platform data is stored using Supabase (supabase.com), a managed PostgreSQL database and authentication service. Supabase stores data in secure, encrypted infrastructure. You can review Supabase's own privacy policy and data processing terms on their website.

3a. Sub-processors

We use the following third-party services to operate the platform. Each acts as a sub-processor under applicable data protection law:

• Supabase, Inc. — database, authentication, file storage, and serverless functions. Data stored in US-East AWS infrastructure. Privacy policy
• Paddle.com Market Limited ("Paddle") — payment processing and subscription management. Paddle acts as the Merchant of Record for all WebGlow subscriptions, meaning Paddle is the seller of record on your receipt and handles payment data (card numbers, billing addresses) directly. WebGlow does not store your payment card details. Paddle privacy policy
• Resend, Inc. — transactional email delivery (booking confirmations, subscription reminders, contact notifications). Privacy policy
• Groq, Inc. — AI language model API used to power the chatbot feature on Elite-tier salon sites. When a visitor sends a message to the AI concierge, the message content is transmitted to Groq for processing. Privacy policy
• Vercel, Inc. — hosting and serverless function execution for the WebGlow platform. Privacy policy

4. AI chatbot and Groq

Groq's API is used only for Elite-tier salons that have explicitly enabled the chatbot feature. If you do not wish to have your messages processed by Groq, do not use the AI chat feature. You can still book appointments and browse services without interacting with the chatbot.

Groq's privacy policy is available at groq.com/privacy-policy.

5. Who can see your data

• Salon owners can view their own clients' bookings, orders, loyalty balances, and chat sessions via the WebGlow dashboard. They cannot see data belonging to other salons.
• WebGlow administrators have access to platform-level data for operational and support purposes only.
• No other parties have access to client data through our platform.

6. Lawful basis for processing (GDPR)

For users in the European Economic Area (EEA) and UK, we process personal data on the following lawful bases:

• Contract performance — processing your account data and salon data is necessary to deliver the service you subscribed to.
• Legitimate interests — preventing abuse, rate-limiting, platform security, and sending transactional notifications related to your account.
• Consent — where required (e.g., optional email marketing, if introduced in future). You may withdraw consent at any time.

7. Your rights (GDPR & CCPA)

If you are in the EEA, UK, or Switzerland, you have the following rights under the GDPR:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your personal data, subject to legal or contractual retention requirements.
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format.
• Right to restrict processing — ask us to pause processing your data in certain circumstances.
• Right to object — object to processing based on legitimate interests.
• Right to lodge a complaint — you have the right to lodge a complaint with a supervisory authority in your country.

If you are a California resident, under the CCPA you have the right to:

• Know what personal information we collect, use, disclose, or sell (we do not sell personal data).
• Request deletion of your personal information.
• Opt out of the sale of your personal information (not applicable — we do not sell data).
• Non-discrimination for exercising your privacy rights.

To exercise any of these rights, contact us at: zzine6943@gmail.com. We will respond within 30 days (or 45 days where permitted by law).

8. Data retention and deletion

Client data is retained for as long as the associated salon account is active on the platform. Salon owners may delete individual client records from their dashboard. When a salon account is permanently closed, associated client data is deleted within 60 days.

10. Cookies and tracking

WebGlow uses essential session cookies for authentication (so you stay logged in to the dashboard). We do not currently use any third-party advertising trackers, analytics pixels, or retargeting technologies. If this changes in a future update, this policy will be updated and you will be notified.

11. International data transfers

Our infrastructure (Supabase, Vercel) is hosted primarily in the United States. If you access WebGlow from the EEA or UK, your data may be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent mechanisms approved by applicable regulators.

12. Changes to this policy

We may update this policy as the platform evolves. The "Last updated" date at the top of this page reflects when changes were last made. Continued use of the platform after changes constitutes acceptance of the updated policy.

13. Contact

Questions about this privacy policy? Email us at zzine6943@gmail.com.