Privacy Policy

1. Who is responsible

Glammies Hub decides how and why your personal data is used, which under the Nigeria Data Protection Act 2023 makes us the data controller. Questions go to support@glammieshub.com.

A brand you book is a separate controller for what it does with your details after we pass them on, such as running your appointment and keeping its own client records. We are not responsible for what a brand does with your information outside the platform.

2. What we collect

When you book or hold an account

• Your name, email address and phone number.
• Your address, but only when you ask to be seen at your own place. A brand cannot travel to you without it.
• Any notes you add to a booking.
• A profile photo, if you upload one.
• Your booking history: what you booked, when, from whom, and what it cost.
• Payment records: what you paid, when, and the reference our payment provider gave it. We never see or store your card or bank credentials; those stay with the provider.
• A record of what happened to each appointment: when it was booked, confirmed, paid for, finished or cancelled, and who did each of those. It is what answers a question about a booking months later, and it is the evidence in a refund or a dispute.
• Reviews you leave, which are public. See section 4.
• Push notification subscriptions, if you turn them on. Your browser gives us an address to send to; we can revoke it and so can you, from your browser settings.
• Your password, stored hashed. We never see it.

We do not keep a separate customer database of our own. What a brand knows about you is simply what your appointments with that brand add up to, worked out when they open the page rather than stored and maintained somewhere else.

When you look for brands near you

If you use the "near me" search, your browser asks your permission and then gives us your approximate coordinates. We use them to sort results by distance. You can refuse, and the rest of the site works normally without it.

When you run a brand

• Your business name, description, photos, services and prices.
• Your business address and contact details, which are public on your page.
• Bank details for payouts: account number, bank and account name. Never shown to staff or managers, only to the account owner. A copy is kept against each withdrawal, so a transfer can be traced later even if you change your account afterwards.
• Financial records: what you earned on each appointment, our fee, refunds, withdrawals and any adjustments. These are accounting records and are not deleted on request; see section 6.
• Who you invited to your team, and what role you gave them.

Automatically

Ordinary technical data such as your device, your browser, an approximate location from your IP address, and which pages you opened, so we can keep the service running and diagnose faults.

3. Why, and on what basis

• To perform our contract with you: creating your account, taking bookings, passing your details to the brand you booked, reminding you about an appointment you have made, and showing you your history.
• With your consent: your location for "near me", push notifications in your browser, and any marketing email you opt into. You can withdraw any of them at any time.
• Our legitimate interests: keeping the platform secure, preventing fraud and abuse, understanding how it is used so we can improve it, and the occasional suggestion that it has been a while since your last appointment. That last one is sent at most once per appointment, never to somebody who already has another booking, and we stop if you ask.
• Legal obligations: records we are required to keep, including accounting and tax records of every payment, refund and payout, and anti-money-laundering rules.

4. Who sees your information

• The brand you book. They see your name, email, phone, any notes, and your address if the appointment is at your place. They need these to turn up and do the work. They also see their own history with you: what you have booked before, when you last came, what you have paid them and whether you have missed an appointment. That is their own business record, drawn from your appointments with them, and it does not include anything you have done with any other brand.
• The team that brand has invited. Staff and managers helping to run the calendar see the same appointment details. They never see the brand's earnings or bank details.
• Anyone reading a review you leave. Reviews are public and show your first name and the initial of your surname, never your full name, email address or phone number.
• Other clients see nothing. Booked times are never shown to anyone else, and no one browsing a brand can tell who booked what.
• Our payment provider. To take a payment or send a refund we pass them the amount and your email address. They hold the money, not us, and they are the ones who see your bank credentials. We never do.
• Our suppliers: the companies that host our database, send our email and text messages, and deliver push notifications. They act on our instructions and cannot use your data for their own purposes.
• Authorities, where the law requires it.
• Search engines and AI assistants, but only for pages that are public anyway. A brand's page is built to be found, so we describe it in a form search engines and assistants can read: the business name, services, prices, city and rating. A client's name, contact details, address and bookings are never part of that, and pages that need an account are excluded from it entirely.

We do not sell your personal data. There is no version of this where we would.

5. Where your data is held

Our database and file storage are operated by providers whose servers sit outside Nigeria. When your data is transferred abroad we rely on the safeguards the NDPA allows, including contractual protections with those providers.

6. How long we keep it

• Your account and profile: while your account is open, and for 30 days after you delete it (see below).
• Bookings: kept after the appointment, because they are the record of what was agreed, including the price, the terms and, where relevant, what a brand was warned about. Disputes and refunds are argued over exactly this.
• Payment, refund and payout records: kept for as long as tax and accounting law requires, which is longer than an account lasts. These are the platform's books and cannot be edited or removed on request, because a record you can delete is not a record.
• The history of an appointment: kept alongside the booking, for the same reason.
• Photos you upload: until you replace or remove them, and then deleted.
• Reviews: kept while the brand's page exists, because a rating built only from the reviews nobody has removed is not a rating.
• Copies of the emails and text messages we send you, including sign-in codes: in our service logs, so we can check a message went out and fix it when one does not. Logs are kept for a short time and are only seen by our team.
• Records we must keep by law: for as long as the law requires, even after an account closes.

When you delete your account

Deleting your account closes it straight away: you are signed out everywhere, nobody can sign in to it, we stop sending you anything, and your email address and phone number are free to use for a new account. Appointments still to come are cancelled and refunded under the business's terms.

For 30 days you can change your mind. Sign up again with the same email address or phone number and enter your old password, and your account comes back with its history. We ask for the old password, not just a code, because phone numbers are sometimes given to someone new, and they must not be able to reach your account. Appointments that were cancelled when you deleted it stay cancelled.

After 30 days we erase the account: your name, email address, phone number, photo, password, notifications and saved brands are permanently deleted. What we keep is only what the law or other people rely on, as listed above: payment and booking records, and reviews you published, no longer linked to your name.

7. Your rights

Under the NDPA you can ask us to:

• show you the personal data we hold about you;
• correct anything wrong;
• delete data we no longer need;
• stop or limit how we use it;
• hand you a copy in a portable form;
• withdraw a consent you gave, such as location or marketing.

Write to support@glammieshub.com and we will respond within 30 days. If you are not satisfied you can complain to the Nigeria Data Protection Commission.

8. Keeping it safe

Traffic is encrypted, passwords are hashed, and access to data inside the platform is limited by role. A brand's staff can run its appointments, for instance, without ever seeing its bank details. No system is perfectly secure, and we will tell you and the NDPC if a breach puts you at risk.

9. Cookies and browser storage

We use browser storage to keep you signed in and to remember small preferences, like your light or dark theme and where you left off in setup. There is no advertising tracking. Clearing your browser storage signs you out and forgets those preferences.

10. Children

Glammies Hub is not for under-18s. If you believe a child has given us personal data, tell us and we will remove it.

11. Changes

As the platform grows this policy will change. We will update the version and date at the top and tell you when a change is material.