Privacy
Privacy policy
GlowReserve · Last updated 19 October 2026
GlowReserve lets you find beauty businesses, book appointments and leave reviews, and lets businesses manage their bookings. This policy explains what personal data we handle, why, who receives it, how long we keep it and the rights you have. It follows the EU General Data Protection Regulation (GDPR), as applied in Austria, and Nigeria's Data Protection Act 2023 (NDPA).
In short
- We use your details to run your account, your bookings and your reviews, and nothing else.
- When you book, the business you book with sees your name, phone, email and booking details.
- Business owners prove who they are with ID photos; those photos are deleted two months after we decide.
- We never sell your data or use it for advertising.
- Questions or requests about your data: support@mmiri28.com
1. Who is responsible
GlowReserve is an app of mmiri28, owned and managed by Charles Bernard Aghadi, Graz, Austria. Email: support@mmiri28.com. We have not appointed a data protection officer, as the law does not require one for an organisation of our size; please send any privacy question or request to that address.
2. What we collect and why
Your account
Your email address and password (stored only in scrambled form by our sign-in provider), a username, and if you add them, your full name, phone number and profile picture. Your username cannot be changed later.
Why and legal basis: To create and run your account (Art. 6(1)(b) GDPR; section 25(1)(b) NDPA). Codes we send to confirm your email or phone number protect your account (Art. 6(1)(f) GDPR; section 25(1)(f) NDPA).
Bookings
The business, service, staff member and time you choose, the booking status, any note you add, and the name, phone number and email address you give for the booking. We send booking messages by email and SMS (for example when a booking is requested, confirmed or declined) and show them in the app.
Why and legal basis: To make and manage the booking you ask for (Art. 6(1)(b) GDPR; section 25(1)(b) NDPA).
Reviews
Your star rating and comment after a booking. Reviews are public, together with your name and profile picture (never your phone number), so other customers can choose a business.
Why and legal basis: You choose to publish a review; we show it in our legitimate interest in honest reviews (Art. 6(1)(f) GDPR; section 25(1)(f) NDPA). You can ask us to remove your review at any time.
If you run a business on GlowReserve
Your business name, description, category, address, city, phone, email, logo, cover and portfolio pictures, services, prices, opening hours and staff. This information is public, because customers need it to find and book you. Please only add staff details your staff have agreed to.
Why and legal basis: To list your business and manage bookings (Art. 6(1)(b) GDPR; section 25(1)(b) NDPA).
Business verification
Before a business is published, its owner proves who they are. We ask for a confirmed email and phone number, the type of ID document, photos of the document (front, and back where it has one), a selfie and a selfie holding the document. These photos are kept in a private storage area that only our admins can open, and only to make the decision. Two months after an admin verifies or rejects the request, the photos are deleted automatically. The decision, its date and who made it stay, so a verified business keeps its badge.
Why and legal basis: To keep customers safe from fake businesses, which is in their and our legitimate interest, and as a step before you can list a business (Art. 6(1)(b) and (f) GDPR; section 25(1)(b) and (f) NDPA). We do not use these photos for automatic face recognition, and we do not use them for anything else.
Notifications
In-app notifications about your bookings, reviews and verification, stored with your account.
Using the website
Our host processes technical data such as your IP address, browser and the pages you open, to deliver the website and protect it against misuse (Art. 6(1)(f) GDPR; section 25(1)(f) NDPA). We use only the cookies needed to keep you signed in. Your light or dark setting is remembered in your own browser's storage and never sent to us. We do not use advertising or tracking cookies, we do not run analytics, and our fonts are stored with GlowReserve itself, so opening a page does not contact Google.
3. Who sees your data
- The business you book with sees your booking, your name and the contact details you gave, so it can serve you.
- Everyonecan see business listings, including the business's own phone and email, and published reviews with the reviewer's name and picture.
- Your profile, including your phone number, is visible only to you, to our admins and to businesses you have booked with. Other users cannot see it.
- Our admins see what they need to run GlowReserve, including verification photos while a request is open.
We share data with the service providers below, who process it on our behalf under a data processing agreement. We do not sell, rent or trade personal data, and we disclose it to authorities only where the law requires us to.
| Provider | What they do for us | Transfer safeguard |
|---|---|---|
| Supabase, Inc. | Database, sign-in and private file storage | Standard contractual clauses |
| Netlify, Inc. (USA) | Hosts the website and runs scheduled tasks such as the verification clean-up | EU–U.S. Data Privacy Framework |
| Resend (USA) | Sends booking and account emails | EU–U.S. Data Privacy Framework |
| Twilio Inc. (USA) | Sends SMS messages and phone confirmation codes | EU–U.S. Data Privacy Framework |
4. Transfers outside the EU and Nigeria
Some providers above are based in the United States. Netlify, Resend and Twilio are certified under the EU–U.S. Data Privacy Framework, which the European Commission recognises as adequate (Art. 45 GDPR); Supabase uses the European Commission's standard contractual clauses (Art. 46 GDPR). Our team works between Austria and Nigeria, so a team member may handle your request from either country, only as far as needed to run the service you use.
5. How long we keep data
- Account, profile and business listing: while your account exists. When you ask us to delete your account, we delete your profile and business listing.
- Bookings: while your account exists, so you and the business can see your history. A booking stays with the business after you delete your account, without your profile, where the business needs it for its own records.
- Reviews: until you or we remove them.
- Verification photos: deleted two months after an admin verifies or rejects the request. Photos for a request that is still waiting stay until it is decided.
- Technical logs: kept by our host for a limited time, for security.
We review what we hold from time to time and delete what is no longer needed.
6. Your rights
Under the GDPR and the NDPA you have the right to access your data, correct it, have it deleted, restrict how we use it, receive the data you gave us in a common format, and object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time. You can change most of your profile yourself in the app; for anything else, email support@mmiri28.com. We reply within one month and may ask you to confirm your identity first. Using your rights is free.
We do not make decisions about you by automated means alone, and we do not build profiles of you.
7. Complaints
Please tell us first at support@mmiri28.com so we can put it right. You can also complain to the Austrian Data Protection Authority (www.dsb.gv.at), the Nigeria Data Protection Commission (ndpc.gov.ng) or the authority where you live in the EU.
8. Security
GlowReserve is served only over an encrypted connection. Access to data is limited by account rules in the database, verification photos are kept in a private storage area, and passwords are stored only in scrambled form. If a breach puts your data at risk, we will inform you and the authorities as the law requires.
9. Children
GlowReserve is meant for adults. We do not knowingly collect data from children; if you believe a child has given us personal data, please contact us and we will delete it.
10. Changes to this policy
We update this policy when GlowReserve or the law changes. The date at the top shows the latest version. If a change significantly affects how we use data you have already given us, we will tell you in the app or by email.
mmiri28's website has its own policy: mmiri28.com/privacy