Privacy Policy of Nailfolio

The controller of your personal data is …, NIP: …, registered at: …, Poland (hereinafter: the Controller).

The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data.

Nailfolio is not intended for persons under the age of 16. Persons under 16 may not register an account on their own or use the app (Art. 8(1) GDPR).

We collect the following personal data:

Data provided during registration: email address (required), name or display name (required for Stylists), phone number (optional), city (required for Stylists).

Data optionally provided in the profile: business or salon name, address (street, postal code, country), website, booking link, Instagram link.

Technical data collected automatically: IP address, browser type (user agent), device type, session data (token, expiry time).

Nail art photos: uploaded by Stylists to their gallery. Photos should not contain faces or identifying information, see section 5.

Client contact data (optional): phone number and contact email visible only to paired Stylists.

We process your data for the following purposes:

Service delivery: account registration, authentication (Google, Apple, magic link), gallery management, QR pairing, Session Share, Staff Accounts.

Communication: system notifications (e.g. session expiry, changes to the terms), transactional emails (registration confirmation, plan changes, trial end reminder).

Security: session monitoring, abuse detection, logging access to contact data (ContactAccessLog), protection against unauthorized access.

Internal analytics: anonymous usage statistics (number of accounts, activity, plan distribution). We do not profile users for advertising purposes.

We process data on the following legal bases (Art. 6(1) GDPR):

Performance of a contract (Art. 6(1)(b)): processing necessary to provide the service, registration, gallery management, uploading and displaying photos, pairing, payments.

Consent (Art. 6(1)(a)): providing optional contact and profile data, cookie/analytics consents (PostHog, Google Tag Manager, Google Analytics 4, Microsoft Clarity), and marketing/newsletter consents.

Legitimate interest of the Controller (Art. 6(1)(f)): Platform security, abuse prevention, internal analytics, enforcement of claims.

Legal obligation (Art. 6(1)(c)): retention of billing data in accordance with tax regulations.

Photos uploaded to the gallery should depict nail art exclusively. It is prohibited to upload photos containing faces, identity documents, or other identifying information.

Nail art photos do NOT constitute biometric data within the meaning of Art. 9 GDPR. We do not process photos for the purpose of identifying individuals.

The copyright owner of the photos is the Stylist who uploaded them. The Controller processes photos solely to display them in Nailfolio in accordance with the license granted in the Terms of Service.

Photos are stored with the provider Cloudinary (USA) on the basis of the EU-US Data Privacy Framework (EU-US DPF) adequacy decision; see Section 8 for details. After you close your account, photos remain available throughout the 90-day account recovery period. You may request permanent erasure of your photos at any time (Art. 17 GDPR).

During QR pairing, the following data is exchanged: the Stylist account identifier, the Client account identifier, and the pairing date.

After pairing, the Client gains access to: the Stylist's photo gallery, display name, city, and contact details (if the Stylist provided them).

The Stylist gains access to: the Client's name and contact details (if the Client provided them in their profile). Every time a Stylist accesses a Client's contact data is recorded in the ContactAccessLog system.

The Client can revoke pairing in the app settings, which immediately cuts off the Stylist's access to their data.

The Session Share feature lets a client share selected gallery photos directly with a stylist. The client picks a stylist from her list of paired stylists and sends the selected photos from her device.

Shared photos are available in the Stylist's Session Clipboard for 7 days from the moment of sharing.

After 7 days, the sharing data is automatically removed from the active view. The system retains only an audit record of the sharing event (without photo content) in the event log.

Your data may be shared with the following data processors:

Stripe (payment processor, USA, EU-US DPF): email address and data necessary for payment processing. Stripe acts as an independent data controller, see Stripe's privacy policy for details.

Mailgun (email delivery, USA, EU-US DPF): email address for delivering transactional messages and notifications.

Cloudinary (image hosting, USA, EU-US DPF): photos uploaded to gallery for storage and optimization.

Neon (database, USA, EU-US DPF): account, gallery, and activity data for service delivery.

Render (application hosting, USA, EU-US DPF): data processed on servers for service delivery.

Cloudflare (CDN and protection, USA, EU-US DPF): technical connection data for attack protection and content delivery optimization.

Google Tag Manager (tag management, USA, EU-US DPF): managing and loading analytics scripts (including Google Analytics 4). Loaded only if you consent via the cookie banner.

Google Analytics 4 (web analytics, loaded via Google Tag Manager, USA, EU-US DPF): anonymized IP address, page views, and usage events for product improvement. Only if you consent via the cookie banner.

Microsoft Clarity (UX analytics, USA, EU-US DPF): anonymized session recordings, heatmaps, and click data for interface improvement. Only if you consent via the cookie banner.

PostHog (product analytics, USA; data stored in the EU (Frankfurt), under Standard Contractual Clauses, SCC): usage events, heatmaps, and session recordings with form fields masked and sensitive URL parameters redacted, for product improvement. Only if you consent via the cookie banner.

We do not sell your personal data. We do not share data with advertising companies. We do not profile users for marketing purposes.

Data may be disclosed to law enforcement or courts pursuant to applicable law.

Every instance of a paired Stylist viewing a Client's contact data is recorded in the ContactAccessLog system.

Recorded information: Stylist identifier, Client identifier, date and time of access, type of data viewed.

Purpose: ensuring accountability in accordance with Art. 5(2) GDPR. Clients have the right to obtain information about who accessed their contact data and when.

General principle: we retain data no longer than necessary for the purposes of processing and for the periods required by law.

Active account data: retained for the entire duration of service use.

Data after account closure: for 90 days the account remains restorable (recovery) by logging back in. After 90 days the account is permanently closed and access expires. You may request data erasure at any time (Art. 17 GDPR), which we carry out subject to legal obligations (e.g. the obligation to retain billing data).

Billing data: retained for the period required by tax law (5 years from the end of the year in which the transaction occurred).

Session Share data: automatically deleted after 7 days.

Event log: retained in accordance with the Controller's retention policy (up to 12 months).

Under the GDPR, you have the following rights:

Right of access (Art. 15): you may obtain information about what personal data we process.

Right to rectification (Art. 16): you may request correction of inaccurate data.

Right to erasure (Art. 17): you may request data erasure at any time by contacting the Controller (privacy@nailfolio.app). We carry it out subject to legal obligations. Closing your account in the app settings is a separate feature: for 90 days the account remains restorable, and after that period it is permanently closed.

Right to data portability (Art. 20): you may request a copy of your data in a machine-readable format.

Right to object (Art. 21): you may object to processing based on legitimate interest.

Right to restriction of processing (Art. 18): you may request restriction of processing in certain situations.

Right to withdraw consent: you may withdraw your consent to data processing at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Right to lodge a complaint: you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl.

We do not use automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the GDPR, that would produce legal effects or similarly significantly affect the user.

User sessions are managed via HTTP headers (header-based authentication), not traditional cookies. This is due to the app architecture running as a WebView in mobile applications.

Browser localStorage is used solely to store user interface preferences (e.g., selected color theme, language).

We use Google Tag Manager to manage and load our analytics scripts. We run analytics tools (PostHog, as well as Google Analytics 4 loaded via Google Tag Manager and Microsoft Clarity) only after you give consent in the cookie banner (details in the data sharing section). We do not use advertising cookies and do not share data with advertising companies.

For matters related to personal data protection, you may contact the Controller:

Email: privacy@nailfolio.app Address: …, …, Poland

Supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland. Website: www.uodo.gov.pl.