Privacy
Effective 25 September 2026
In short
- Visitors need no account. No analytics, advertising or tracking cookies.
- The map loads only with your permission. Your “near me” location never leaves your device.
- Visit statistics are cookieless and totals only — no one sees who viewed what.
- We never sell data or use it for ads.
1. Who is responsible
Beautify Technologies OÜ, registry code [registry code], [address], Estonia. Data protection: privacy@beautify.ee. We reply within one month.
2. Visitors
- Server logs (IP address, time, page, browser): to run the service and block attacks. Basis: legitimate interest (GDPR Art. 6(1)(f)). Kept up to 30 days.
- Abuse prevention: to protect forms we keep a salted hash of the IP address (not the address itself) for up to 1 hour.
- Salon statistics: we count views and clicks on phone, website and directions. Only monthly totals are stored — no IP address, no cookie.
- Visit statistics: without cookies we count which pages are viewed, where visitors come from (the referring domain or campaign tag), device type, language, search terms (excluding emails and numbers) and shares. Unique visitors are counted with a daily random “salted” hash that is deleted at the end of the day — the same person can't be recognised across days and no IP address is stored. If our host passes a country code (e.g. Cloudflare), we count countries. If your browser sends “Do Not Track” or “Global Privacy Control”, we don't count you at all. Basis: legitimate interest (GDPR Art. 6(1)(f)). Totals are kept for 25 months.
- Share buttons are plain links — no social network scripts or tracking on the page. Data goes to the network only when you click.
- Browser storage: your map choice stays in your browser. See cookies.
3. Map and location
Map. Map tiles come from the OpenStreetMap Foundation (UK), which sees your IP address. That's why the map loads only with your consent (GDPR Art. 6(1)(a)). The UK has an EU adequacy decision. Withdraw consent any time under “Privacy settings” in the footer. OSMF privacy policy.
“Near me”. Your browser asks first. Your location is used only on your device to calculate distances — it never reaches our server.
Directions. The “Directions” link opens OpenStreetMap. Data goes there only when you click.
4. Partners (salons)
| Data | Purpose | Basis |
|---|---|---|
| Name, email, password hash, language | Account, login, notifications | Contract (Art. 6(1)(b)) |
| Profile: name, description, address, location, contacts, services, prices, hours, photos, offers | Public display | Contract |
| Invoice details: company, registry code, VAT no., address, invoice email | Billing | Contract; Accounting Act (Art. 6(1)(c)) |
| Time and version of terms accepted | Proof | Legitimate interest |
| Newsletter consent | Tips and news | Consent (Art. 6(1)(a)) |
| Last login time | Account security | Legitimate interest |
Profiles are public — including to search engines and AI-powered search. A personal phone, email or photos of people you add become public, so add business contacts only and photos you have permission to publish. We automatically strip EXIF data (including GPS location) from photos.
When you look up an address in the dashboard, your browser sends it to OpenStreetMap's Nominatim service.
Emails. We send only transactional emails: account confirmation, security notices, review decisions, orders and plan reminders. News only with your consent. Every email comes from info@beautify.ee and your replies reach the same inbox.
Logging in sets the strictly necessary cookies bf_session and bf_logged.
5. Notices, support and contact form
Content notices (Digital Services Act, Art. 16): we store the notice, reason and, optionally, your name and email to handle it and tell you the outcome. Basis: legal obligation (Art. 6(1)(c)). We don't reveal the notifier's name to the partner.
Support tickets and contact form: we store your name, email, topic and the conversation so we can help and reply. You see the conversation via a personal link we email you. Basis: legitimate interest, or contract for partners. Closed tickets are deleted after 24 months.
6. Who we share data with
- Hosting: [host name], data centre in the EU.
- Email: [email provider], EU.
- Accounting: [accounting service], EU — invoice details only.
We never sell data or share it for advertising. No data leaves the EEA, except map tiles from the OpenStreetMap Foundation (UK) with your consent.
7. How long we keep it
| Partner account and profile | Until you delete the account (one click in the dashboard) |
| Unconfirmed account | 7 days |
| Invoices | 7 years (Accounting Act) |
| Plan requests | 24 months |
| Support tickets | 24 months after closing |
| Visit statistics (totals) | 25 months; the daily hash is deleted at day end |
| Notices and decisions | 12 months after the decision |
| Admin audit log | 12 months |
| Email delivery log (recipient, subject, status — not content) | 90 days |
| Aggregate statistics | 13 months |
| Server logs / abuse hashes | 30 days / 1 hour |
8. Your rights
You can access, correct or delete your data, restrict processing, object, and get your data in a machine-readable format. Partners can download their data and delete their account in the dashboard. You can withdraw consent at any time.
You may complain to the Estonian Data Protection Inspectorate (info@aki.ee) — but please write to us first; we'll usually fix it faster.
9. Security
HTTPS, strongly hashed passwords, HttpOnly and SameSite cookies, locked-down data files, a Content Security Policy and logged admin actions. In a breach we notify the Data Protection Inspectorate within 72 hours and you where required.
10. Changes
We email partners about material changes at least 15 days ahead. The current version is always here.