Privacy Policy

This policy covers information handled through the Service. It does not cover the practices of a salon or beauty professional you visit in person, or of any third-party store, site or app you reach from a link inside the Service. Those parties have their own policies.

Information you give us

• Account information: your first name, last initial, email address, a password (held by our authentication provider as a salted hash, never in readable form), and your confirmation that you are 18 or older.
• Your Hair Passport: the hair details, appointments and services, dates, notes, care notes, goals, saved inspiration and preferences you choose to enter.
• Photos you upload to your Passport, including any information contained in the image files themselves.
• Text you dictate with the microphone and then intentionally save.
• Messages you send us, including support emails, and email addresses you type in to invite someone.
• If you apply as a beauty professional: the professional details and any verification materials you submit.

Information we collect automatically

• Technical information your browser or device sends when loading the Service: IP address, browser and operating system type, device screen size, referring page, and the pages and dates of your requests.
• Product analytics: a small, fixed set of events that tell us whether people can complete key steps — for example that an appointment was logged, that the care page was opened, or that a product recommendation was viewed or clicked. These events carry counts, category labels and step names only. They do not carry your name, email address, notes, photos or free-text entries.
• Diagnostic information: error and crash reports used to find and fix problems.
• Email delivery outcomes for messages the Service sends you: delivered, bounced, or reported as spam.
• Local storage on your own device: the sign-in session, and small preferences such as answers you gave in Find My Products and whether you dismissed the install prompt. See the Cookie Policy.

Information we do not collect

• We do not record or store microphone audio. Speech recognition is performed by your own browser or device; only the resulting text reaches us, and only if you save it.
• We do not ask for or store payment card numbers. The Service is free during the beta.
• We do not knowingly collect information from anyone under 18.
• We do not collect precise device location.

• To create and maintain your account and show you your own Hair Passport.
• To operate the features you use: logging appointments, storing photos, care guidance, goals, product suggestions and invitations.
• To send the emails the Service needs to work — confirming your email, resetting your password, changing your email address, and invitations you choose to send.
• To keep the Service secure: authenticating you, preventing abuse, enforcing sending limits, and investigating suspected misuse.
• To diagnose and fix errors and to improve usability, using the analytics events described above.
• To respond to your support requests.
• To comply with law and to enforce our Terms.

We do not use your Passport content to train machine-learning models, and we do not sell your Passport content.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract, to provide the Service you signed up for; our legitimate interests, to keep the Service secure, functioning and usable; your consent, where we ask for it, for example when you choose to invite someone or share information with a professional; and compliance with legal obligations. Where we rely on consent, you can withdraw it at any time.

• Service providers who run the Service on our behalf: our hosting, database, storage and authentication provider; our email delivery provider; our product analytics provider; and our error-reporting provider. They process information under contract, on our instructions, and for no purpose of their own.
• At your direction: when you invite someone by email, or share Passport information with a beauty professional inside the Service. Private technical notes written by a professional are not shown to other professionals or published.
• Legal and safety: when required by law, subpoena or valid legal process, or where necessary to investigate abuse, enforce our Terms, or protect the rights and safety of people.
• Business transfer: if Beauty Passport is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction. We will give notice before your information becomes subject to a different privacy policy.

We do not send your Passport content, photos or free-text notes to our analytics provider, and we do not share your information with advertising networks or data brokers.

Photos you add are stored in private storage tied to your account. They are not publicly browsable and are served only through authorized, time-limited links to you and to people you have chosen to share with. You can remove a photo yourself at any time, and removing your account removes your photos.

Some text boxes offer a microphone so you can speak instead of type. Your browser or device performs the speech recognition and may transmit audio to the operating system or browser vendor under its own policy. Beauty Passport never receives, records or stores the audio. The transcribed text appears in the box for you to review, and is stored only if you save it as part of your Passport.

We use a small number of strictly necessary cookies and browser storage entries, plus analytics storage. Details, purposes and your choices are in the Cookie Policy.

• Account and Passport information: for as long as your account exists. If you delete your account, your Passport entries, notes and photos are erased and your account is removed.
• Backups: residual copies may persist in encrypted backups for a limited period after deletion before being overwritten.
• Operational and security records: limited records of what was sent, and of deletion and consent actions, are kept in de-identified form so we can show that we handled a request correctly.
• Analytics events: retained by our analytics provider under its standard retention period. They are not tied to your name or email address.
• Legal holds: we keep information longer where we are required to, or where it is needed for an ongoing dispute or investigation.

Information is transmitted over encrypted connections and stored with encryption at rest. Access to Passport data is enforced at the database level so that one account cannot read another account's records, and administrative access is limited to the people who need it. No online service can promise perfect security, and we make no absolute guarantee. If we become aware of a breach affecting your information, we will notify you and any regulator as required by law.

• Access and portability: request a copy of the information we hold about you.
• Correction: you can edit most Passport entries yourself, or ask us to correct anything else.
• Deletion: you can delete entries and photos yourself, and delete your whole account from inside the Service.
• Objection and restriction: ask us to stop or limit a particular use, where the law gives you that right.
• Withdraw consent: stop future sharing you previously approved.
• Analytics opt-out: see the Cookie Policy.
• No discrimination: we will not degrade your experience for exercising a privacy right.

To make a request, email hello@joinbeautypassport.com from the address on your account. We may need to verify that the request comes from you. We aim to respond within 30 days, or 45 days where the law allows and we tell you why. You may appeal a refusal by replying to our response, and residents of the EEA or UK may complain to their local data protection authority.

Beauty Passport supports non-medical hair and grooming services. Your Passport is a personal beauty record, not a medical record, and the care guidance in the Service is general information rather than professional or medical advice. Please do not enter medical or health information into your Passport.

The Service is for adults aged 18 and older. We do not knowingly collect information from children. If you believe someone under 18 has created an account, email hello@joinbeautypassport.com and we will remove it.

Beauty Passport is operated from the United States, and our providers may process information in the United States and other countries. Where information is transferred out of the EEA or UK, we rely on the transfer mechanisms our providers make available, such as standard contractual clauses.

We may update this policy as the Service develops. The date at the top shows the last update. For material changes, we will give notice in the Service or by email before the change takes effect. Continuing to use the Service after a change means you accept the updated policy.

Privacy questions, requests or concerns: hello@joinbeautypassport.com. Please write from the email address on your account so we can identify you.