Privacy Policy

1. Data Controller

Kutikulla Beauty Store, Rua Câmara Pestana 25, Coimbra, Portugal. For data-related questions, contact us at: privacidade@kutikulla.com

2. Data We Collect

• Identification: name, email address, phone number.
• Appointments: chosen service, date, time, appointment notes.
• Orders: products, delivery address, purchase amount.
• Technical: session cookies for authentication (strictly necessary).

3. Purpose and Legal Basis

• Providing appointment and order services — GDPR art. 6(1)(b) (contract performance).
• Sending email and SMS notifications about your appointments — art. 6(1)(b).
• Customer management and commercial communications — art. 6(1)(f) (legitimate interest).

4. Sub-processors

• Supabase (database and authentication) — EU, Frankfurt.
• Resend (transactional email) — EU.
• Twilio (SMS notifications) — US, with Standard Contractual Clauses in place.
• Ifthenpay (payment processing) — Portugal.
• Railway (application hosting) — EU.

5. Data Retention

• Customer data: 3 years from last activity.
• Billing and order data: 10 years (Portuguese fiscal obligation).
• Deleted account: data anonymized within 30 days.

6. Your Rights

• Access: you may request a copy of your personal data.
• Rectification: you may correct inaccurate or incomplete data.
• Erasure: you may request deletion of your data ("right to be forgotten").
• Portability: you may receive your data in a structured format.
• Objection: you may object to processing based on legitimate interest.
• Complaint: you have the right to lodge a complaint with the CNPD (www.cnpd.pt).

7. Cookies

We use only strictly necessary session cookies for authentication (Supabase). We do not use tracking, advertising, or third-party analytics cookies.

8. Contact

To exercise your rights or ask privacy questions, email us at: privacidade@kutikulla.com. We will respond within 30 days.