Privacy Policy

This policy explains how Starlight Hair and Beauty(“we”, “us”) collects, uses, stores and shares personal information through our website at www.thestarlight.beauty, our online booking system, and the staff app our team uses to run the salon. We follow the New Zealand Privacy Act 2020 and its Information Privacy Principles.

Information we collect

Clients and website visitors

• Appointment details — your name, mobile number, email address (optional), the services, stylist, date and time you choose, and any notes you add.
• Visit history — past and upcoming appointments, what was paid and how (cash or EFTPOS; we do not collect or store card numbers), and notes our stylists record to look after you, such as colour formulas or products used.
• Messages — texts and emails we send you about your appointments, and any replies you send back.
• Reviews — the rating, comments and any photos you submit after a visit. Photos are resized and stripped of location and camera metadata before we store them.
• Photos — a profile photo our staff may add to your client record, only with your agreement.
• Technical information — to protect the booking system from abuse we keep a one-way (salted hash) record of the IP address that made a booking request, for rate limiting only.

Our team

For our own staff we hold employment information such as contact details, addresses, emergency contacts, rosters, time off and pay records. Private HR details are visible only to the salon owner.

Information from Google

Parts of the staff app can connect to a Google account. This is optional, is only ever used by the salon owner or a staff member for their own account, and is never offered to clients.

• Google Calendar (linked calendars) — a team member may link their Google Calendar. With their permission we request the calendar.events and calendar.calendarlist.readonly scopes, plus their Google account email address. We use these to (a) add, update and remove their salon appointments on their own primary calendar, (b) list their calendars so they can choose which one to sync, and (c) read the start and end times (and, only if they choose, the titles) of events on that chosen calendar, so the time shows as unavailable in our booking system. We do not read event attendees, attachments or other calendars.
• Google Business Profile— the salon owner may connect the salon’s own Business Profile (business.managescope) so we can keep our listed opening hours up to date and show the salon’s Google reviews on this website.
• Google Places — we display our public Google rating and reviews on this website. This uses public data about our business, not your account.

How we use your information

• To take, confirm, change and cancel appointments, and to manage waiting lists.
• To send appointment confirmations, reminders, rebooking reminders and a thank-you or review request after a visit, by text message and/or email.
• To provide our services safely and consistently, and to keep records of what we have done.
• To respond to your messages and reviews.
• To manage our team, rosters and salon operations.
• To protect our systems from spam, fraud and abuse.

We do not sell your personal information, and we do not use it for third-party advertising. You can ask us to stop sending reminder or marketing messages at any time by replying to a message or contacting us.

Google user data — Limited Use

Starlight Hair and Beauty’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide the calendar-sync and business-listing features described above.
• It is not sold, used for advertising, or used to build profiles of users.
• It is not used to develop, improve or train generalised or non-personalised AI or machine-learning models.
• It is not transferred to anyone else, except as needed to provide those features, to comply with the law, or as part of a merger or sale of the business with notice to users.
• No person reads it except with the user’s consent, for security purposes, or where required by law.

OAuth access tokens are stored encrypted at rest in our database, in a table that only our server can read — not the staff app or other team members. A team member can disconnect their calendar at any time from their team profile, which revokes our access, deletes the stored tokens, removes the appointments we added to their calendar and deletes every event we imported from it. You can also revoke access from your Google Account permissions page.

Who we share information with

We share personal information only with the service providers that run our systems for us, and only as much as they need:

• Supabase — database, file storage and staff sign-in.
• Vercel — website and app hosting.
• Google — our salon email (Gmail), map and review information, and the optional calendar and Business Profile connections described above.
• SMS Gateway for Android (sms-gate.app) — relays our text messages to and from a salon mobile phone.
• Anthropic — our staff can use an AI assistant to help draft replies to reviews, summarise review feedback and suggest service notes. Only the text needed for that task is sent, and Google user data is never sent to it.
• Gravatar — if you have a public Gravatar image, a hashed form of your email address may be used to show it next to your review or client record.

Some of these providers store data outside New Zealand (for example in Australia or the United States). We choose providers that protect information to a standard comparable to New Zealand law. We may also disclose information where the law requires it.

Public reviews

If you leave a review through our website, we may publish your rating, comment, photos and first name with last initial on this website once approved. We will not publish your phone number or email address. Ask us at any time and we will take your review down.

How long we keep it

We keep client records for as long as you are a client and for a reasonable period afterwards, so we can look after you on a return visit and meet our tax and record-keeping obligations. Rate-limiting records are kept only briefly. When information is no longer needed we delete or anonymise it.

Keeping it secure

Access to the staff app requires an individual sign-in, all traffic is encrypted in transit, and database access rules limit who can see what — for example, only the salon owner can see staff HR details. No system is perfectly secure, but we take reasonable steps to protect your information from loss and misuse, and will tell you and the Privacy Commissioner about any serious privacy breach as required by law.

Your rights

You can ask to see the personal information we hold about you, and ask us to correct or delete it. We will respond within 20 working days. If you are not happy with how we have handled your information, you can complain to the Office of the Privacy Commissioner.

Cookies

Our public website does not use advertising or tracking cookies. The staff app uses essential cookies to keep team members signed in and to secure the Google connection process.

Children

Our online booking is intended for adults. A parent or guardian should book for anyone under 16.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. See also our Terms & Conditions.

Contact us

For any privacy question or request, contact our privacy officer (the salon owner):

• By phone: 02102384567
• In person or by post: Starlight Hair and Beauty, 333 Cambridge Terrace, Naenae, Lower Hutt 5011, New Zealand