Skip to content

Privacy Policy

What Glamorph collects, why we use it, who receives it, and the choices available to you.

Last updated: November 6, 2026

Glamorph is operated by CHOSTELIDIS ANGELOS TOU KONSTANTINOU, trading as Glamorph, at Agiou Eleutheriou 11, Pavlos Melas, 56429 Thessaloniki, Greece (VAT ID: EL171051670).

This Privacy Policy explains how Glamorph ("we", "us", or "our") collects, uses, shares, and protects personal data when you use our mobile apps, web app, public booking pages, websites, and related services (collectively, the "Service"). Glamorph is based in Greece and processes personal data under the EU General Data Protection Regulation (GDPR) and other applicable data-protection laws.

Key Points

  • We collect and use data needed to provide, secure, support, and improve the Service
  • Your photos, documents, client records, and other content remain yours
  • We do not sell personal data or share it with advertisers
  • Beauty professionals and workspace owners control the client data they place in Glamorph. Glamorph processes that data to provide the Service
  • An account-deletion request gives you 30 days to change your mind. Shared business records and records we must legally retain may remain.
  • Data is encrypted in transit, and access is restricted according to account and workspace permissions
  • Website analytics require your consent. You can turn off mobile usage analytics in Settings.

Information We Collect

Depending on the features you use, we collect the following categories of information:

  • Account and authentication data: name, email address, profile photo, account identifiers, login method, session and security records, workspace invitations, and membership role. When you use Apple or Google sign-in, we receive the profile data that provider makes available and never receive that provider's password. Where email sign-in is available, we store a protected password verifier, not your plain-text password.
  • Professional profile, setup and support: profession, business profile, experience, optional goals or challenges, how you found Glamorph, language, time zone, currency, feedback, cancellation comments and information you send to support.
  • Client, appointment, and service records: client names and contact details, preferences, allergies or sensitivities, formulas, notes, services, appointments, sessions, dates, and history. Some of this information may be sensitive. The professional or business using Glamorph is responsible for having a lawful basis, giving required notices, and respecting the rights of its clients.
  • Online-booking and communication data: customer contact details, selected service and professional, requested time, verification status, booking state, rescheduling or cancellation activity, reminder delivery, and calendar-export information.
  • Documents and media: consultation and consent forms, answers, signatures, finalized PDFs, photos, videos, albums, and shareable-gallery settings or access records.
  • Workspace, team, and calendar data: workspace profile, members, professional profiles, permissions, calendar visibility, working hours, time off, closures, breaks, and other scheduling records.
  • Financial and merchant-payment data: manual payment and expense records, amounts, methods, currency, tax or tip values where used, transaction and refund status, provider identifiers, merchant country, connected-account capabilities, terminal or location identifiers, and secure authorization credentials needed for an enabled provider. Payment credentials are handled by the payment provider. Glamorph does not receive or store full card numbers, CVCs, PINs, or customer bank-login credentials.
  • Subscription data: selected plan and calendar capacity, entitlement and trial status, billing period, storefront or web-billing channel, purchase and renewal status, and provider transaction identifiers. RevenueCat manages subscription entitlements across supported billing channels.
  • Device and usage information: device and browser type, operating system, app version, IP address in security records, identifiers for sending device notifications, feature use, errors and performance data. Some records use a coded account identifier rather than your name. This is pseudonymous data: it can still be linked to an account. We do not collect advertising identifiers such as IDFA or GAID.
  • Communication preferences: push, transactional-email, marketing-email, and analytics choices, together with the delivery status needed to honor them.

How We Use Your Information

We use information to:

  • Provide client records, sessions, calendars, online booking, documents, media, payments, expenses, and team workspaces
  • Authenticate users, enforce workspace roles and permissions, and protect accounts
  • Keep records up to date across devices and let you work with core mobile records without an internet connection, with copies stored on our servers
  • Publish and operate booking pages and send verification, confirmation, reminder, rescheduling, and cancellation messages
  • Create, sign, finalize, store, and share documents or galleries at the professional's instruction
  • Manage free, trial, and paid access and verify App Store, Google Play, and web subscription status
  • Connect an eligible Stripe, SumUp, or Square account and initiate or reconcile supported payments, refunds, and provider status updates
  • Send service, security, billing, booking, and support communications, plus marketing messages only where permitted
  • Prevent fraud and abuse, investigate incidents, enforce our terms, and meet legal obligations
  • Measure reliability and product use, troubleshoot errors, and improve the Service within the analytics choices described below

Legal Basis for Processing (GDPR)

Depending on the context, we rely on:

  • Performance of a contract: to create and secure your account and provide the product features, synchronization, communications, storage, subscriptions, workspaces, and support you request.
  • Consent: for marketing emails, website analytics, optional answers during setup and device permissions or communications where consent is required. You can withdraw consent at any time.
  • Legitimate interests: to secure and improve the Service, prevent fraud, diagnose failures, and understand pseudonymous product use, after balancing those interests against your rights.
  • Legal obligation: to keep or disclose records when tax, accounting, payment, regulatory, or other law requires it.
  • Professional and workspace client data: the professional or business normally determines why client and team data is used and acts as its controller. Glamorph processes that data on its instructions to provide the Service, except where we independently need to process limited data for security, billing, legal compliance, or our own service operations.

When Glamorph acts as a processor of client or team personal data on your behalf, the Data Processing Agreement is incorporated into these Terms. By accepting these Terms, you also agree to the DPA for that processing. If you represent a business or organization, you confirm that you are authorized to accept both agreements for it. Data Processing Agreement

Optional SMS and WhatsApp communications

Professionals choose whether to connect these channels and must obtain the required client permission. Glamorph processes reminder schedules, channel consent, opt-outs, message content, provider references and delivery status. Connecting a channel does not by itself authorize messages to every client. Providers may process data outside the EU under the safeguards described below.

Service Providers and Payment Partners

We disclose only the data reasonably needed for the selected feature. These companies process data under their own terms or privacy notices and, where applicable, on our behalf:

  • Apple / Google authentication: verifies your identity and supplies the profile information you choose to share. We do not receive your Apple or Google password.
  • Apple App Store / Google Play: app distribution, purchases, refunds, and store-subscription management. Glamorph receives purchase receipts and entitlement status, not your complete store-payment credentials.
  • RevenueCat: manages subscriptions and confirms access across supported billing channels. Receives a Glamorph account identifier and purchase, product and subscription-access data. The identifier is coded, not anonymous, and can be linked to an account. Billing contact details are shared when the billing channel needs them. Privacy Policy
  • Stripe / Link: web-subscription checkout, payment authorization, billing, receipts, refunds and disputes. For purchases identified as sold through Link, Stripe acts as Merchant of Record. Stripe also processes optional connected-merchant payments. It receives the billing, payment, transaction and fraud-prevention data needed for each role. Privacy Policy
  • SumUp: Provides an optional connection for client payments, payment pages and card readers. Glamorph exchanges the authorization, account, transaction, refund and device details needed for the functions you enable. Privacy Policy
  • Square: Provides an optional connection for client payments, business locations, terminals and payment pages. Glamorph exchanges the account, authorization, transaction, refund and device details needed for the functions you enable. Privacy Notice
  • Cloudflare (R2 and CDN): media storage and delivery, network security and hosting for our websites. Private content uses controlled access. An authorized professional can intentionally publish a booking page or share a document, link or gallery. Privacy Policy
  • Hetzner: EU application and database hosting. Privacy Policy
  • Expo: Delivers app notifications to your device. Receives a device identifier and the notification content. Privacy Policy
  • Amazon Web Services SES: transactional and permitted marketing-email delivery using the recipient address and message content. Privacy Notice
  • PostHog: EU-hosted product analytics using a pseudonymous identifier and bounded usage events. Marketing-site collection requires consent. Mobile users can opt out in Settings. Privacy Policy
  • Sentry: Reports errors to help improve reliability. Our project uses EU hosting. Reports contain error details, device information and a coded account identifier, rather than your name or email. Privacy Policy
  • Google Analytics: marketing-website traffic measurement only after cookie consent. Privacy Policy
  • Twilio: optional SMS delivery and business-number registration. Receives recipient phone numbers, message content, delivery and opt-out data, and the business information required for number registration. Privacy Policy
  • Meta / WhatsApp: optional business connection and WhatsApp messages. Receives business and phone-number identifiers, recipient numbers, template/message content and delivery information. Privacy Policy

We do not sell or rent personal data, and we do not share it for third-party advertising. A professional may intentionally share a gallery, document, booking page, or payment request with a client. That is a product action chosen by the professional, not a sale of data.

Optional Merchant Payment Providers

This section applies only when an eligible professional connects Stripe, SumUp, or Square and uses Glamorph to request, collect, or reconcile a customer payment. Merchant payments are optional and separate from Glamorph subscription billing.

Subscription billing and client-payment integrations serve different purposes. Subscription providers receive the information needed to process your Glamorph purchase and verify access. Connected payment providers receive the information needed for your transactions with clients, as described below. A provider may perform both roles, depending on the transaction.

  • Glamorph stores the connected provider's account and authorization identifiers, business country and currency, setup and payment-readiness status, and relevant location, card-reader or terminal details. Verification and bank details entered on the provider's pages go to that provider. Glamorph does not store full verification documents or bank-login credentials.
  • For payments, deposits, balances, tips, refunds or disputes, we process amounts, currencies, status, dates, provider references, fees and the related client, appointment or workspace reference. We also receive automatic status updates from the provider. Contact details may be sent when needed for the payment page, receipts, fraud prevention or payment messages.
  • The connected provider, its financial partners, and payment networks process payment credentials. Glamorph may receive limited payment-method information such as brand and last four digits for records, receipts, support, and fraud prevention, but not the full card number, CVC, PIN, or customer bank-login credentials.
  • We use provider data only to operate the connection, show status, support payments and eligible refunds, reconcile Glamorph records, prevent abuse, and provide support. Disconnecting a provider stops future access through Glamorph but does not erase records that Glamorph or the provider must retain. Each provider independently processes and retains data under its own agreement and privacy notice.

Data Storage & Security

Our main application and database servers are hosted by Hetzner in the European Union. Photos, videos and other files are stored in Cloudflare R2 with access restricted by default. They are delivered through controlled links or through a link or gallery an authorized professional chooses to share. Connections are encrypted using TLS 1.2 or later. Mobile sign-in credentials use the operating system’s secure storage: iOS Keychain or Android Keystore. Account permissions, team roles and technical and administrative controls also restrict access. No system guarantees absolute security.

On-Device and Browser Storage

The mobile app keeps a copy of core records on your device so you can work without internet. These include client records, appointments, references to photos and videos, manual payments and preferences. Login credentials use the device's secure storage. Supported changes synchronize with our servers when you reconnect. Uninstalling the app normally removes its local data from that device. It does not delete your account or server records. Our websites and web app use essential browser storage for sign-in, security, preferences and consent choices. Analytics are explained below.

Data Retention and Account Deletion

We keep account and business data while needed to provide the Service. An account-deletion request suspends the account and starts a reversible 30-day grace period. After that, the account becomes eligible for deletion review. Permanent deletion follows verification and any applicable legal-retention checks. Shared-workspace records may remain for other members. Expired trial or paid business data may become eligible for cleanup after the 90-day retention period and warning notices. These periods do not guarantee deletion on an exact date. Backups and technical logs expire under their retention cycles. Limited billing, security and legal-claim records may be retained when required or reasonably necessary. Providers retain the data they control under their own policies.

International Data Transfers

Our primary application servers are in the European Union, and our configured PostHog and Sentry projects use EU hosting. Other providers—including Apple, Google, RevenueCat, Stripe, SumUp, Square, Cloudflare, Expo, Amazon Web Services, Twilio, Meta, and their partners—may process data in other countries. Where applicable law requires a transfer mechanism, we rely on safeguards such as adequacy decisions, the European Commission's Standard Contractual Clauses, or another lawful mechanism used by the relevant provider.

Your Rights

Subject to applicable law and any valid exceptions, you may have the right to:

  • Access: ask for a copy of personal data we hold about you.
  • Rectification: correct inaccurate or incomplete personal data.
  • Erasure: request account or personal-data deletion, subject to shared-workspace, legal-retention, and other lawful exceptions.
  • Restriction: ask us to limit certain processing.
  • Portability: receive eligible data in a structured, commonly used, machine-readable format.
  • Object: object to processing based on legitimate interests or to direct marketing.
  • Withdraw consent: withdraw consent at any time without affecting processing that was lawful before withdrawal.

Contact privacy@glamorph.com to exercise a right concerning your Glamorph account. We normally respond within one month. For client data placed in Glamorph by a beauty professional or workspace, contact that business first because it normally controls the record. We will assist it as required. You may also complain to the Hellenic Data Protection Authority or your local supervisory authority.

Children's Privacy

Glamorph accounts are available to users aged 16 or older. A professional may hold records about a minor client only when legally permitted and with any required parent or guardian authorization. Contact privacy@glamorph.com if an account appears to belong to a child under 16.

Cookies & Tracking

Our website uses essential browser storage and asks permission for analytics. Google Analytics and website PostHog analytics load only after that permission. You can change your choice using the consent controls. The web app uses storage needed for sign-in and security. It also sends limited records of service use to our servers to operate and measure the product. The mobile app uses EU-hosted PostHog analytics with a coded account identifier under legitimate interests. You can turn this off in Settings > Privacy. Sentry receives coded error reports. We do not use IDFA, GAID or third-party advertising pixels.

Changes to This Policy

We may update this Policy when our Service, providers, or legal obligations change. We will post the revised version with a new effective date and give additional notice of material changes where appropriate. If a change requires consent, we will request it rather than treating continued use as consent.

Contact Us

For privacy questions, rights requests, or complaints, contact privacy@glamorph.com.