Privacy & Cookie Policy

1. Who we are

MMM Beauty is a nail, brow and skin studio based in Brackley, UK. We provide salon services and related products, including digital gift cards and online booking.

2. Information we collect

We may collect the following types of information:

• Contact details – such as your name, email address, phone number and postal address.
• Booking information – services booked, appointment dates and times, and notes relevant to your treatment.
• Payment details – processed securely by our payment providers (for example, card details entered through our booking or payment system). We do not store full card numbers on our own systems.
• Communication history – messages and emails you send to us, and responses we send to you.
• Website usage data – IP address, browser type, pages visited and interactions with our website, collected through cookies and similar technologies.
• Marketing preferences – whether you have chosen to receive updates, news or offers from us.

3. How we use your information

We may use your information to:

• Manage and confirm your appointments and bookings.
• Provide treatments and services safely and effectively.
• Send appointment reminders, confirmations and important updates.
• Process payments and manage deposits, refunds or fees.
• Improve our website, services and client experience through analytics and feedback.
• Send newsletters or marketing communications where you have opted in, or send occasional updates about similar treatments to existing clients who have recently booked or purchased with us, always with an easy way to unsubscribe.
• Comply with legal obligations, such as record-keeping and responding to lawful requests.

4. Legal basis for processing (UK GDPR)

We rely on one or more of the following legal bases:

• Contract – to provide the services you have booked and manage your appointments.
• Legitimate interests – to improve our services, manage our diary, communicate important information about your bookings, and send limited marketing about similar treatments to clients who have recently booked or purchased with us (you can unsubscribe from this at any time).
• Consent – for newsletter sign-ups and other marketing communications where you have actively opted in, and for non-essential cookies, where required.
• Legal obligation – to comply with applicable laws and regulations.

5. How we share your information

We do not sell or rent your personal data to third parties.

What we share depends on how you interact with us.

When you use this website

• Square – payment processing and online booking.
• Resend – transactional email (booking confirmations, gift cards and contact form responses) and the email newsletter list.
• Google (GTM / GA4) – tag management and website analytics.
• Sentry – error monitoring and performance telemetry.
• Vercel – website hosting, Vercel Analytics, and performance monitoring.
• Cloudflare Turnstile – spam and bot protection on forms.
• Sanity – content management for this website.

When you message us, or book and manage appointments through our client portal

• Meta – if you message us on WhatsApp, Instagram or Facebook, your message reaches us through Meta's systems.
• Anthropic – powers Lumi, our booking assistant. When you message us, Anthropic's AI may read your message and help draft a reply for our team to review before it's sent.
• Clerk – account authentication and sign-in code delivery, for clients with a portal account.
• Neon – our portal's database hosting provider.
• Upstash – rate-limiting and caching infrastructure that keeps our systems secure and responsive.
• PostHog – client portal product analytics.
• Microsoft Clarity – session and heatmap analytics, to understand how the client portal is used.

These providers only process your data on our instructions and are required to keep it secure and confidential. Some are based outside the UK (including in the United States); where that's the case, we rely on an approved transfer mechanism, such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

We may also disclose information if required by law, regulation, or in response to a valid request from a public authority.

6. Data retention

We retain your personal data only for as long as necessary. In practice:

• Consultation and patch-test forms, which can include health information, are kept for 7 years from the date you signed them, in line with the retention period generally used for UK treatment and insurance records.
• Booking, order and loyalty records are kept for as long as your account is active, or as needed to meet our accounting and legal obligations.
• Marketing communications continue until you withdraw consent or unsubscribe.
• Internal security and access logs are kept for a shorter period, purely for operational and security purposes.

To request a copy of your data, or ask us to delete it, email hello@mmm-beauty.co.uk. We'll respond within one month. When data is no longer needed, it is securely deleted or anonymised.

7. Your rights

You have the right to:

• Request access to the personal data we hold about you.
• Ask us to correct inaccurate or incomplete information.
• Request deletion of your data where it is no longer needed, or object to certain types of processing.
• Withdraw consent for marketing at any time.
• Lodge a complaint with the UK Information Commissioner's Office (ICO) if you are unhappy with how we handle your data.

To exercise your rights, please contact us using the details on our Contact page.

8. Cookies & similar technologies

Our website uses cookies and similar technologies to:

• remember preferences and improve your browsing experience,
• understand how visitors use the site,
• support basic functionality and security.

Some cookies are essential for the site to function. Others (such as analytics cookies) are optional and may require your consent.

We don't set any analytics cookies unless you choose "Allow" in the cookie banner. Until then, analytics runs without storing anything on your device.

You can manage cookies:

• via our cookie preference banner (where available), and
• through your browser settings. Please note that disabling certain cookies may affect how the site functions.

9. Updates to this policy

We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on our website.