Privacy Policy

This policy explains how Glow by Gil collects, uses and protects the personal information you share when making a booking or completing a pre-appointment consultation. It is written to be clear and straightforward — not unnecessarily long.

Last updated: June 2026

Who We Are

Glow by Gil is a home nail studio based in Orpington, South East London, operated as a sole trader. For the purposes of UK data protection law, Glow by Gil is the data controller responsible for your personal data.

To get in touch regarding your data: hello@glowbygil.co.uk

What We Collect

We collect personal data through the booking form at glowbygil.co.uk and the pre-appointment consultation form sent after your deposit is confirmed.

Booking form:

• Name, email address, phone number, and Instagram handle
• Service, design preferences, nail inspo, and appointment details
• Health screening responses — relating to allergies, sensitivities, or conditions that may affect your appointment

Pre-appointment consultation form (sent after your deposit is confirmed):

• Contact details and emergency contact information
• Nail and hand health information
• Allergy and product history
• Consent declarations

Automatically collected:

• IP address — only a truncated, anonymised IP is recorded at form submission, for security and audit purposes; we do not store your full IP address

How We Use Your Data

Your data is used to:

• Review and manage your booking request
• Carry out your appointment safely and appropriately
• Maintain client records for your appointments
• Send appointment-related communications — confirmations, reminders, and aftercare guidance
• Comply with applicable health, safety, or record-keeping requirements

Our legal basis for processing:

• Contract performance — your contact details and booking information are needed to confirm and manage your appointment
• Legitimate interests — keeping appointment and safety records that allow us to provide a consistent, safe service
• Explicit consent — health and allergy data is special category data under UK GDPR and is processed only on the basis of your explicit consent. You give this consent twice: at the time of booking (via the health screening checkbox on the booking form) and again before your first appointment (via the pre-appointment consultation form). Photography for social media is also consent-based.

Storage & Security

Your data is stored securely using Supabase, a cloud database provider. Sensitive consultation data — including health, allergy, and emergency contact information — is stored in a separate, access-restricted database table and is never accessible publicly or shared with any third party.

Appointment-related emails are sent via Resend, a transactional email provider. No personal data is ever sold, rented, or shared for advertising purposes.

How Long We Keep Your Data

• Booking records — retained for 2 years from the date of your last appointment
• Consultation records — retained for 3 years from the date of your last appointment
• Photos — retained until you withdraw consent

If you request deletion of your data, we will action this within 30 days, subject to any legal obligation to retain records.

Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct any inaccurate information
• Deletion — ask us to delete your personal data, subject to any legal obligation to retain records
• Objection — object to processing based on legitimate interests
• Withdrawal of consent — withdraw consent for health data processing or photography at any time, without affecting the lawfulness of processing already carried out

To exercise any of these rights, email us at the address in the Contact section below. We will respond within 30 days.

Third-Party Services

We use the following services to run our booking and communication systems. Each processes data only as necessary to provide their function.

• Supabase — secure cloud data storage (supabase.com)
• Resend — transactional email delivery (resend.com)
• Cal.com — appointment scheduling (cal.com)

None of these services are used for advertising, and no personal data is sold or shared beyond what is necessary to operate your booking.

Photography & Social Media

Glow by Gil may photograph your nails at your appointment for portfolio and promotional use on Instagram, TikTok, and our website. This is done only with your explicit and separate consent, collected as an optional tick on the pre-appointment consultation form.

You can withdraw photo consent at any time by contacting us. This will not affect photos already shared — but we will not publish any further images of your nails once consent is withdrawn.

Contact & Data Requests

To make a subject access request, request deletion of your data, withdraw consent, or raise any privacy concern, please contact:

Subject access requests and deletion requests will be responded to within 30 days of receipt.

If you are not satisfied with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

Changes to This Policy

This policy may be updated from time to time. The date at the top of the page shows when it was last revised. We will notify existing clients of any material changes.