Style Hub Pro
Privacy notice
1. Scope and roles
This explains how the Style Hub Pro operator uses information for accounts, security, billing, support, marketplace administration and platform operation. For client treatment records, appointment notes and workforce information entered by a subscriber, the relevant business/professional normally decides the purpose and is controller; Style Hub Pro normally processes on its instructions. Roles depend on the facts.
2. Information
- Identity, contact, credentials and authentication events.
- Business identity, staff role, permissions, profile, qualifications and insurance confirmation.
- Client identity, appointments, preferences, photographs, communications and treatment notes supplied through a business.
- Potential special-category information such as allergies, health considerations, medication or pregnancy where recorded lawfully.
- Subscription, invoice, Stripe customer and transaction references—not full card details.
- Marketplace listings, applications, rental preferences and messages.
- Notification recipients, content, delivery status, channel choices, and dated consent, withdrawal and STOP records.
- Device, browser, IP, diagnostic, security, audit and support information.
3. Sources
Information comes from individuals, their business/professional, authorised managers, account activity, payment/communications providers and use of the service. A business entering client information must give that client its own appropriate privacy information.
4. Purposes and bases
| Purpose | Typical basis |
|---|---|
| Accounts, authentication, plans and requested features | Contract or requested pre-contract steps |
| Security, abuse prevention, diagnostics and audit | Legitimate interests; legal obligation where applicable |
| Billing, tax and accounting | Contract and legal obligation |
| Support, complaints and legal claims | Contract, legitimate interests and legal claims |
| Necessary account and appointment communications | Contract or legitimate interests; these must not contain promotional content |
| Optional email, SMS or WhatsApp marketing | The customer’s separate channel-specific consent, unless the sender has documented another applicable PECR permission |
| Suppression and opt-out records | Legal obligation and legitimate interests in honouring the customer’s choice |
| Reliability statistics | Legitimate interests, using minimised/de-identified data where possible |
Marketing options are off by default and separate from account terms. A customer can withdraw through Message preferences without losing the service. Businesses controlling special-category information must identify both an Article 6 basis and Article 9 condition. General terms acceptance is not explicit health-data consent.
5. Booking recommendations
The platform may calculate durations and slots from services, client characteristics, approved evidence and diary rules. This organises bookings; it does not diagnose, assess suitability or make legal/similarly significant decisions. Professionals review evidence and can exclude it or restore standards. Ask the relevant business to explain/correct information affecting a booking.
6. Recipients
Information may be shared as needed with the subscriber and authorised users; Supabase (infrastructure/authentication); Vercel (hosting); Stripe (payments); Resend (email); Xero when a business owner enables accounting integration; and, only when activated, Twilio/WhatsApp (communications). A connected business controls what accounting information is sent to its own Xero organisation and can disconnect the integration. We may disclose to advisers, insurers, a purchaser under confidentiality, regulators, courts or law enforcement where lawful. We do not sell personal information.
7. International transfers
Where providers process outside the UK, we use applicable UK adequacy regulations, the UK IDTA or UK Addendum and suitable risk/supplementary safeguards. Contact us for relevant safeguard information.
8. Retention
| Information | Normal period/criterion |
|---|---|
| Account and subscriber content | For the account/contract plus a reasonable export period |
| Invoices/payment/tax records | Normally 6 years after the relevant financial year |
| Security/diagnostic logs | Normally up to 12 months unless needed for an incident/claim |
| Support/complaints | Normally 24 months after closure; up to 6 years for claims |
| Notification delivery records | Normally up to 12 months |
| Consent evidence | While relied upon and normally up to 6 years afterwards where needed to demonstrate compliance |
| Marketing suppression/STOP record | For as long as reasonably necessary to ensure the opt-out continues to be honoured |
| Unsuccessful/withdrawn applications | Normally up to 12 months unless needed for a dispute |
| Backups | Overwritten on the provider’s controlled cycle after deletion |
Subscribers may require longer professional/legal retention and must set their own schedule. Limited data may be retained for law, fraud/security or legal holds, then deleted/anonymised.
9. Security
Measures include encrypted transport, authentication, tenant/role restrictions, restricted server credentials, signed payment webhooks, upload/input limits, access records and fail-closed billing/message controls. No system is risk-free. Report suspected compromise promptly.
10. Rights
Depending on circumstances you may request access, correction, erasure, restriction, portability or object, and withdraw consent without affecting earlier processing. You have an absolute right to object to direct marketing. For business-controlled treatment records contact that business first; we will assist. Identity may be verified and lawful exemptions apply.
11. Complaints
Email info@stylehubiw.co.uk. You may complain to the ICO at ico.org.uk/make-a-complaint or 0303 123 1113.
12. Children
Business accounts are for adults. Businesses serving minors are responsible for lawful age, parental responsibility, consent and safeguarding processes and must minimise children’s data.
13. Device storage
The app uses essential browser storage for authentication, session continuity, preferences and drafts. We do not currently use optional advertising cookies. Optional analytics/marketing technologies will stay off until appropriate information and consent controls exist.
14. Changes and required details
Material changes will be notified where appropriate. Before general paid launch, add the operator’s legal name, geographic address, company/VAT details where applicable and confirm its ICO fee/registration position.