Handled with care.

This policy explains how BeautyIQ collects, uses, shares and protects personal information in connection with the BeautyIQ platform, our public website and our consultation process.

It applies to two distinct relationships. Where you are a beauty business using BeautyIQ, we act as a processor of the records you hold about your own clients, students and team. Where you are an individual dealing with BeautyIQ directly, for example by requesting a consultation, we act as a controller of that information.

As a processor, we act only on the documented instructions of the business that operates the workspace. Requests from an individual to access, correct or erase records held in a customer workspace are directed to that business, and we support them in responding.

As a controller of our own enquiry, billing and website data, we determine the purposes described in this policy and are accountable for them.

Consultation and enquiry details, including name, business name, role, email address, telephone number and the description of your business you choose to share with us.

Account information for users of a workspace, including name, work email address, role and access level.

Records created by a customer inside their workspace. Depending on the modules configured, this may include lead, client, student and team records, contact details, treatment or course history, appointment and attendance records, notes, tasks, messages and payment status.

BeautyIQ records payment status only. Where a payment provider is used, card and bank details are handled by that provider and are never stored by BeautyIQ.

Service and security logs, including IP address, device and browser type, timestamps, pages viewed and actions taken within the workspace. These are used to operate, secure and improve the platform.

Some beauty and aesthetics businesses record information that may constitute health data, such as contraindications, patch tests, allergies or consultation notes. Where a customer chooses to record such information, they remain responsible for establishing a lawful basis and an appropriate condition for processing it, and for obtaining consent where required.

We process personal information for the purposes below, relying on the lawful basis stated in each case.

We send marketing communications about BeautyIQ only where you have asked to hear from us or where permitted by law in a business context. Every message includes an unsubscribe instruction, and withdrawing consent takes effect without affecting anything else in this policy.

Marketing consent is stored against the individual contact record rather than at the level of the workspace. Campaign tools respect that flag, so a contact who has not agreed to hear from you cannot be included in a marketing send.

Any record can be marked Do Not Contact. That status suppresses the record from campaigns and from outreach prompts across every module, and it is retained even where other fields are cleared, so the instruction is not lost.

Where a record originates from discovery rather than direct entry, BeautyIQ retains the source of the information so that the origin of any contact can be explained. Discovery draws only on information that is publicly available or supplied by the business itself.

BeautyIQ Intelligence summarises activity within a single workspace. It highlights priorities, follow-ups, capacity and observations, and produces an IQ Score to indicate the relative strength of an opportunity.

Scores and observations are derived from counted signals within the workspace, such as recency of contact, stage, engagement and completeness of a record. Every score can be expanded to show the signals that produced it.

Intelligence is advisory. BeautyIQ does not make decisions producing legal or similarly significant effects about an individual without human involvement, and scores are not used to profile individuals beyond the operation of the customer's own business.

Workspace records are not used to train third-party foundation models. Where an AI provider is used to generate a summary or a suggested reply, that content is processed under contract for the customer's benefit only.

We share personal information only with sub-processors who help us deliver the platform, including cloud hosting, database, email delivery and AI providers, each engaged under written terms imposing equivalent obligations. A current list of sub-processors is available on request.

We may also disclose information where required by law, to establish or defend legal claims, or to a successor entity in connection with a merger or acquisition, subject to the protections in this policy.

We do not sell personal information, and we do not share workspace records with other customers or with advertising networks.

Where information is transferred outside the United Kingdom or the European Economic Area, we rely on an adequacy decision or on standard contractual clauses together with a transfer risk assessment, and we apply encryption in transit and at rest.

We apply encryption in transit and at rest, role-based access control, least-privilege administrative access, audit logging of significant actions, isolated environments and regular review of dependencies. Access to production data is restricted to personnel who require it to provide support.

Workspace records are retained for as long as the workspace is active. Following termination, records are available for export for thirty days, after which they are deleted from active systems and removed from backups within a further ninety days.

Enquiry and consultation information is retained for twenty-four months from the last interaction. Financial records are retained for the period required by law.

In the event of a personal data breach, we will notify the affected customer without undue delay and provide the information required for them to meet their own notification obligations.

Subject to applicable law, you have the right to access the personal information we hold about you, to have it corrected or erased, to restrict or object to certain processing, to receive it in a portable format, and to withdraw consent where consent is the basis of processing.

Where the information sits inside a customer workspace, please contact that business directly. Where BeautyIQ is the controller, contact us using the details below and we will respond within one month.

If you are not satisfied with our response, you may complain to your local supervisory authority. In the United Kingdom, this is the Information Commissioner's Office.

Our website uses strictly necessary cookies to operate securely, and limited analytics to understand which pages are useful. We do not use advertising cookies or cross-site tracking.

The BeautyIQ application uses only the storage required to keep you signed in and to remember your interface preferences.

BeautyIQ is a business platform and is not directed at children. Where a customer records a student under the age of eighteen, that customer is responsible for obtaining any consent required from a parent or guardian.

We may update this policy to reflect changes to the platform or the law. Where a change is material, we will notify customers in advance through the platform or by email. The effective date at the head of this page always reflects the current version.