Privacy Policy

Information you give us:

• your name, email address and phone number;
• details about your booking — occasion, region, location, preferred dates, service chosen and anything you write in the notes;
• anything you tell us about allergies, sensitivities, skin conditions or recent treatments, which we use only to deliver your service safely;
• messages and requests you send through the client portal, including change and cancellation requests.

Information recorded as part of running your booking:

• your booking history and status, the quoted price, and a record of what has been paid, when, and by which method;
• the date and time you accepted our terms and conditions when you enquired;
• standard technical information handled by our hosting provider — such as your IP address — used to serve the site and protect it from abuse.

We do not collect or store your card details. Where a payment link is used, your card is handled entirely by that payment provider, not by us.

• To perform our contract with you — answering your enquiry, confirming and delivering your booking, taking payment, and handling changes, cancellations and refunds.
• Our legitimate interests — keeping records of bookings and payments, protecting the site from abuse, and defending or resolving a dispute if one arises.
• Your consent — using photographs of your look in our portfolio and on social media. You can decline this before your appointment, or ask us to stop using an image at any time afterwards.
• Legal obligation — keeping financial records for as long as tax and accounting rules require.

We don't sell your data, and we don't share it with advertisers. We use a small number of service providers to run the business, and they only process your data on our instructions:

• Supabase — hosts the database that holds your booking records, and the storage that holds photographs.
• Resend — sends the emails we send you, such as sign-in links and booking confirmations.
• Cloudflare — hosts and serves the website itself, and protects it from abuse.

We may also share information where we're legally required to, or where it's necessary to establish or defend a legal claim.

We use one cookie: an encrypted sign-in cookie that keeps you signed in to the client portal for up to 90 days. It's strictly necessary — the portal can't work without it — and it holds nothing beyond your session.

We don't use analytics cookies, advertising cookies or third-party trackers, so there's no cookie banner to click through.

SlaybySabb is based in the United Arab Emirates, and the providers listed above operate internationally, so your information may be processed outside the country you live in. Where that happens we rely on those providers' own safeguards for international transfers.

We keep booking and client records for as long as you're a client and for up to 6 years afterwards, which covers the period in which a dispute or a tax enquiry could arise. Enquiries that never become bookings are kept for up to 2 years. You can ask us to delete your information sooner — see clause 7.

You can ask us to:

• give you a copy of the information we hold about you;
• correct anything that's wrong or out of date;
• delete your information, where we don't need to keep it for a legal or accounting reason;
• stop using your photographs, or withdraw any other consent you've given;
• restrict or object to how we're using your information.

Email us at slaybysabb@gmail.com and we'll respond within 30 days. If you're in the UK or EU and you're not happy with how we've handled a request, you can also complain to your local data protection regulator.

Your booking records sit behind authentication, portal sign-in links are single-use and time-limited, and the sign-in cookie is encrypted and signed. No system is perfect, but we take looking after your information seriously — if something ever went wrong that affected you, we'd tell you.

The site isn't intended for children. Bookings for clients under 18 are made by a parent or guardian, as set out in our terms and conditions.

If we change how we handle your information, we'll update this page and the date at the top. Where a change materially affects you, we'll tell you directly.

Any question about your data, or a request under clause 7, goes to slaybysabb@gmail.com.