Privacy Policy — HandzBeauty

We take your privacy seriously. This policy explains what we collect, why, and the choices you have. We follow the Nigeria Data Protection Act (NDPA) 2023 and global best practices.

What we collect

From shop owners

Name, email, password (hashed), phone, shop name, location.
Bank name, account name, and account number — used only to display to your customers so they can pay you.
Photos and descriptions you upload for your portfolio and services.
Booking, sales, and customer profile data you create on the platform.

From customers

Name and phone number provided during booking.
Optional selfie for the AI haircut recommender (processed in-memory and never stored unless you opt in).
Reviews you post and the booking they relate to.

Automatically

Basic device info (browser, OS) and IP address for security and abuse prevention.
Anonymous usage analytics so we can improve the product.

What we don't collect

We do not store your card details — we never collect them.
We do not read or store your bank login.
We do not sell your data to anyone, ever.

How we use it

To run the booking, payments, and reviews features you signed up for.
To send transactional notifications (booking confirmations, no-show alerts, retention prompts you trigger).
To prevent fraud, fake reviews, and platform abuse.
To analyze usage in aggregate so we can improve features.

Who can see what

Customer phone numbers are visible only to the shop they booked, and to HandzBeauty staff for support.
Bank details are shown only to customers with an active booking that requires payment.
Reviews are public, with the reviewer's first name only.

Data storage and security

Data is stored on encrypted servers and protected with row-level security policies that ensure shop owners can only access their own customers and bookings. Passwords are hashed; we cannot recover them. We use HTTPS everywhere.

Your rights under the NDPA 2023

The Nigeria Data Protection Act 2023 grants you the following rights, which we honour without charge:

Right of access — request a copy of all data we hold on you.
Right to rectification — ask us to correct inaccurate data.
Right to erasure — ask us to permanently delete your data ("right to be forgotten").
Right to data portability — receive your data in a machine-readable format (JSON).
Right to object — withdraw consent for non-essential processing such as analytics.
Right to lodge a complaint — contact the Nigeria Data Protection Commission (NDPC).

You can exercise the rights to access, portability, erasure, and consent withdrawal instantly and without contacting us at our self-serve Privacy tools page.

Data Protection Officer (DPO)

HandzBeauty has appointed a Data Protection Officer responsible for monitoring our compliance with the NDPA 2023 and serving as your point of contact for any privacy-related concern.

Email: dpo@handzbeauty.com
General privacy queries: privacy@handzbeauty.com
Postal: Data Protection Officer, HandzBeauty, Lagos, Nigeria
Response time: within 14 days of receipt

If you are not satisfied with our response, you may escalate to the Nigeria Data Protection Commission at ndpc.gov.ng.

Cookies

We use a small number of cookies. Essential cookies keep you signed in and protect against attacks — these cannot be disabled. Analytics cookies are only set if you opt in via our cookie banner; they help us understand which features are useful and contain no personal data. You can change your choice anytime at Privacy tools.

Third-party services

We use trusted infrastructure providers (cloud hosting, AI inference for the recommender, transactional email). Each is bound by data processing agreements that prohibit using your data for their own purposes.

Children

HandzBeauty is not directed at children under 13. We don't knowingly collect data from minors. If you believe we have, email us and we'll delete it.

Changes

Material updates to this policy will be announced in-app and by email at least 14 days before they take effect.