Privacy Policy

This privacy policy explains how Alizeti Microlocs ("we", "us", "our"), a microloc installation and maintenance business based in the United Kingdom, handles personal information collected through our website at www.alizetimicrolocs.com (the "website"), our booking system and our related communications.

We are the data controller for the personal information described in this policy. If you have any questions, contact us at alizetilocs@gmail.com or on WhatsApp.

When you book an appointment, we collect:

• your name, email address and phone number;
• the service you have chosen and your requested date and time;
• your location (area) and, where you provide it, your address for mobile appointments;
• any notes you choose to share with us about your hair or appointment.

When you send us an enquiry, we collect your name, email address, phone number (optional) and your message.

When you respond to a calendar invitation we send through Google Calendar, Google shares your response (accepted, declined or maybe) with us.

Technical information: to protect our forms from spam and abuse, we use Cloudflare Turnstile, which processes your IP address and browser information. We use Vercel Web Analytics to understand how the website is used in aggregate; it does not use cookies and does not identify individual visitors.

We do not knowingly collect special category data. Please do not include health or other sensitive information in your notes unless it is necessary for your appointment.

We use your personal information only to run our business and provide our services, specifically to:

• receive, review, confirm, reschedule and cancel your appointments;
• send you booking confirmations, updates, reminders and cancellations by email and WhatsApp;
• send you a calendar invitation for confirmed appointments so you can add them to your calendar;
• respond to your enquiries;
• plan travel to mobile appointments at the address you provide;
• keep business and accounting records, and protect our website against fraud and abuse.

Our legal bases under UK GDPR are: performance of a contract (to arrange and provide the services you book), our legitimate interests (to run and secure our business and respond to enquiries), and legal obligation (to keep required records). We do not send marketing messages and we do not sell your personal information.

Our booking system connects to Google Calendar using Google's APIs. Only our own business Google account is connected, by our staff, from our private admin area. Clients never sign in with Google on our website.

What Google data we access. With our business account's permission, the website uses the Google Calendar permission to see, create, change and delete events on calendars owned by that account (calendar.events.owned), together with the account's email address. It uses this to access:

• the email address of the connected business Google account, to show which account is connected;
• the calendar events that our booking system itself creates for confirmed appointments (date, time, location, description and guest list), including the response status of the client invited to each appointment.

How we use it. We use this access only to create, update and cancel appointment events on our business calendar, to send clients a Google Calendar invitation for their appointment, and to show our staff whether a client has accepted, declined or not yet replied to that invitation. We do not read, analyse or use any other events or data in the connected calendar.

How we store and protect it. We store the connected account's email address, an encrypted access (refresh) token, and the identifier of each appointment event in our secure database. The token is encrypted with AES-256-GCM and is never shown in the website.

How we share it. We do not sell, rent or share Google user data with anyone, and we do not use it for advertising. Google user data is not transferred to any third party except as needed to provide the booking features described above, to comply with the law, or with explicit consent.

No AI training. We do not use Google user data to develop, improve or train generalised artificial intelligence or machine-learning models.

Limited Use. Alizeti Microlocs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access and deletion. The connected account can be disconnected at any time from our admin settings, which revokes the token and deletes it from our database, or from Google Account permissions. Clients can decline or delete a calendar invitation at any time in their own calendar, and can ask us to delete their information as described in section 8.

We share personal information only with service providers who help us run the website and our booking system, and only as needed for that purpose:

• Vercel: website hosting and anonymous usage analytics;
• Supabase: secure database hosting for booking and client records;
• Google (Gmail and Google Calendar): sending emails and calendar invitations, and managing our appointment calendar;
• Meta (WhatsApp Business): sending appointment messages to your phone number;
• Cloudflare (Turnstile): protecting our forms from spam and abuse.

Some of these providers may process data outside the UK. Where they do, they are required to protect it with appropriate safeguards, such as the UK International Data Transfer Addendum or equivalent contractual protections. We may also disclose information if required by law.

We keep booking and client records for as long as needed to provide our services and to meet our legal, accounting and tax obligations, after which they are deleted. Enquiries are kept in our email only for as long as needed to respond and follow up. If our Google account is disconnected, the stored Google token is deleted immediately.

Our website uses encrypted connections (HTTPS). Access to booking records is limited to authorised staff through a password-protected admin area, and sensitive credentials such as access tokens are encrypted at rest. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• object to or ask us to restrict how we use your information;
• ask us to transfer your information to you or another organisation.

To make a request, email alizetilocs@gmail.com. We will respond within one month. If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We only use cookies that are strictly necessary: a secure session cookie for staff signed in to our admin area, and cookies that Cloudflare Turnstile may set to protect our forms. We do not use advertising or tracking cookies.

Our website is not directed at children under 13, and we do not knowingly collect their personal information online.

We may update this policy from time to time. The latest version will always be on this page with the date it was last updated. Please also read our Terms & Conditions.