GLÂME PRIVACY POLICY

Last update: July 10, 2026

Before you access our Services and share any personal data with us, make sure to read our Privacy Policy. If you access our Services and share data for a Recipient, ensure that this person has the Privacy Policy read by them or by their parent or legal guardian.

We want you to make informed decisions about what personal data you share with us and how you share it.

This Privacy Policy explains who we are, how we process your personal data and how you can exercise your privacy rights.

We encourage you to review our Privacy Policy and our Terms of Service periodically to stay informed.

1. General

1. Data controller

We are SAS Glâme Paris, registered at 11 Rue Carnot 94270 Le Kremlin-Bicetre, France, (“Company”, “we”, “us” or “our”). We operate an on-demand beauty service platform that enables Customers to discover, request, book, receive and pay for beauty services provided by Artists.

This Privacy Policy applies to personal data we process when providing our website at https://www.glame.paris/privacy-policy and any mobile application that links to this Privacy Policy (together, the “Services”).

If you have any questions regarding the processing of your personal data, please contact us at support@glame.paris.

2. Data practices across our Services

Our Services vary in the following aspects:

1) Content and functionality

Personal data you share with us will depend on the specific Service (e.g., Website, App or other product) that you access or use and the specific features available within that Service, including features relating to your rights under applicable laws.

2) Ways to exercise your privacy rights

The only universal method to exercise your privacy rights across all our Services is by contacting us at our contact email: support@glame.paris. Other ways may differ depending on the specific Service you access or use.

2. Scope of personal data processing

1. Data subjects

We value the privacy of those who access and use our Services.

Our data protection system is designed to safeguard personal data of adults and minors (“Data subjects”).

We have three main categories of data subjects:

Artists are beauty professionals, such as hair stylists and makeup artists, who apply to join our Services and provide beauty services.

Customers are individuals who use or intend to use our Services to discover, request, book, receive or pay for beauty services, including individuals who sign up to receive launch updates or exclusive offers.

Recipients are individuals for whom Customers discover, request, book, receive or pay for beauty services. When providing any personal data of Recipients for the purposes described in this Privacy Policy, Customers confirm that the Recipients have read and understood this Privacy Policy and the Terms of Service and agree to their content.

In this Privacy Policy, we generally refer to data subjects, whether Artists, Customers or Recipients, as “you”. Where necessary for clarity, we refer specifically to Artists, Customers or Recipients.

2. Children

Our Services are intended for Users aged 18 or over. Minors may only be Recipients of Beauty Services where the booking is made by a parent or guardian, or with the consent of a parent or guardian. In that context, we may process minors’ personal data only as necessary to provide the booked Beauty Services and in accordance with this Privacy Policy.

Before giving consent for processing minor’s personal data, you should carefully read this Privacy Policy, our Terms of Service and any other documents we make available to you regarding our data practices and the functionalities of our Services.

If you have additional questions about our privacy practices related to children, please contact us at support@glame.paris.

3. Personal data we process

We want to make it clear that processing of your personal data is necessary for providing our Services.

Without data processing, we cannot technically and organizationally provide our Services to you.

You are not required to share your personal data with us if you do not agree with our data processing activities or for any other reason.

We do not intentionally collect special categories of personal data unless this is strictly necessary and lawful, for example, where you choose to provide such information in a support request.

We may collect certain categories of personal data as described below.

1) Account and account-linked data

  • Name (first name and last name provided during registration)
  • Data received from Google or Apple when signing in with Google or Apple (display name, bio, profile/avatar image URL)
  • Email address
  • Phone number (collected for bookings and stored in the account profile where applicable)
  • Login and account identification
  • Location-related data (non-GPS), including service address and Paris district/postal area for booking eligibility and scheduling. We do not use device GPS/location APIs for tracking
  • Authentication session data (access tokens and refresh tokens to keep account signed in)
  • Account preferences (“remember my contact details” / “remember my address” for faster booking)
  • Third-party integrations linked to the account (e.g. Google Calendar connection status, sync metadata and OAuth-related metadata managed on our backend)
  • Marketing and newsletter data, including newsletter subscription status, marketing preferences and the source of signup, such as the app, website or Meta Lead Ad.

2) Device and technical data

We collect limited device and technical data necessary to operate our website and app:

  • Mobile platform (iOS or Android) for app behaviour and compatibility
  • Locally stored app data (authentication tokens and saved booking form preferences stored on the device)
  • Push notification data (device push token, notification permission status, linked to the account for delivery of service-related alerts)
  • Server and infrastructure logs (IP address, request timestamps and device/browser user-agent for security, fraud prevention and service operation)

3) Service-related data

3.1) Artist-related service data
  • Valid identity document
  • Proof of the right to work in France, where applicable
  • Proof of registration as a self-employed entrepreneur or under any other form of business (the SIREN / SIRET and VAT number, where applicable)
  • Professional qualification, including any relevant experience data and portfolio materials
  • Insurance certificates
  • Artist payment details (Stripe Connect onboarding status and Stripe account identifier)
3.2) General service data
  • Artist availability and schedule data (working hours, time off, daily bookings, client name/email shown in the artist schedule)
  • Service selection (chosen beauty services, add-ons, duration, pricing)
  • Booking details (date and time, status, assigned artists)
  • Service notes (instructions for the Artist, information about the Recipient and/or Customer)
  • Booking history (upcoming and past appointments)
  • Ratings and feedback (scores and optional text comments about artists after a beauty service)
  • Photos of the results of the beauty service provided
  • Calendar integration usage (whether a booking was added to the Customer’s or Artist’s Google Calendar)
  • Address search queries (when Customers or Artists search for an address, search text is sent to the French official address API (BAN / data.gouv.fr) to autocomplete Paris addresses)

4) Communications and support data

When you contact us by email, through in-app support features or by phone, we process the contact details you provide, such as your email address or phone number, as well as the content of your communication and any information necessary to respond to your request.

We also process feedback, ratings and comments that you submit after bookings.

5) Purchase and transaction data

  • Payment status (paid, pending, refunded, etc.)
  • Transaction amounts (service price, fees, VAT, commissions, artist share)
  • Stripe payment identifiers (checkout session ID, payment ID, receipt URL where applicable)

Payment card data is entered and processed by Stripe in a secure payment flow (WebView/checkout).

We do not store full card numbers on our servers.

4. How we process your personal data

To process your personal data, we need a purpose, meaning a reason why we process the data, as well as a legal basis, meaning the legal ground under the GDPR that allows us to process the data.

We process your personal data for the following purposes and on the following legal bases:

1) To create, manage and secure your account in our Services

We process account and account-linked data, device and technical data on the following legal basis:

Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.

2) To onboard Artists and connect them to our Services

We process account and account-linked data and Artist-related service data on the following legal basis:

Processing is necessary for the performance of a contract with the Artist or to take steps at the Artist’s request before entering into a contract.

3) To verify an Artist’s professional suitability to provide beauty services

We process Artist-related service data.

We rely on the Artist’s consent. The Artist may withdraw their consent at any time.

4) To provide our Services, booking creation, scheduling, appointment management

We process account and account-linked data, service-related data, device and technical data, communications and support data and purchase and transaction data on the following legal basis:

Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.

5) To enable the Artist to provide the booked beauty services

We process account and account-linked data, service-related data, communications and support data and purchase and transaction data on the following legal basis:

Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.

6) To process payments, refunds, commissions, fees and related transaction records

We process account and account-linked data, service-related data and purchase and transaction data on the following legal bases:

1. Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.

2. Where we are required to keep accounting, tax or transaction records, processing is necessary for compliance with a legal obligation.

7) To send service-related communications and notifications

We process account and account-linked data and any other category of data relevant to the communication on the following legal bases:

1. Processing is necessary for the performance of a contract with you.

2. Where required by law or platform rules, we rely on your consent for push notifications. You may withdraw your consent at any time.

8) To send exclusive offers or other marketing communications

We may process account and account-linked data and any other category of data relevant to the communication on the following legal basis:

We rely on your consent. You may withdraw your consent at any time.

9) To respond to support requests and other communications initiated by you

We may process account and account-linked data, and any other category of data relevant to the communication on the following legal bases:

1. Processing is necessary for the performance of a contract where the request relates to our Services.

2. In other cases, we rely on our legitimate interests in responding to enquiries and managing relationships between Customers, Recipients and Artists.

10) To collect and review ratings, feedback and comments

We may process service-related data and communications and support data on the following legal basis:

We rely on our legitimate interests in assessing beauty service quality, improving our Services and managing relationships between Customers, Recipients and Artists.

11) To use service-related information in marketing communications

We may process service-related data on the following legal basis:

We rely on your consent. You may withdraw your consent at any time.

12) To maintain security, prevent fraud, troubleshoot errors and operate our infrastructure

We may process any category of data relevant to the issue identified or investigated on the following legal basis:

We rely on our legitimate interests in ensuring the security, reliability and proper functioning of our Services, preventing fraud and protecting our infrastructure.

13) To comply with legal obligations

We may process any category of personal data to the extent required by the relevant legal obligation on the following legal basis:

Processing is necessary for compliance with a legal obligation, including accounting, tax, regulatory, record-keeping and lawful request obligations.

14) To establish, exercise or defend legal claims

We may process any category of personal data that is relevant to the claim on the following legal basis:

1. We rely on our legitimate interests in protecting our legal rights and defending or pursuing claims.

2. Where special categories of personal data are relevant to a claim, we process them only to the extent necessary for the establishment, exercise or defence of legal claims.

We do not intentionally collect special categories of personal data. If you choose to provide such information to us, for example in a support request or beauty service note, we will process it only where this is necessary, lawful and limited to the relevant purpose.

Right to withdraw your consent

If you gave us your consent for the processing of your personal data, you have the right to withdraw your consent at any time.

If you withdraw your consent, we will stop processing your personal data for the purpose for which it was withdrawn.

Withdrawing your consent does not affect the lawfulness of processing carried out based on your consent before its withdrawal.

5. How we share your personal data

We may share your personal data with the following categories of recipients where this is necessary for the purposes described in this Privacy Policy.

Service providers

We use service providers that help us operate our Services. These service providers process personal data only to provide services to us and in accordance with our instructions, where they act as our processors.

These service providers include:

Customers, Recipients and Artists

We may share limited personal data between Customers, Recipients and Artists where this is necessary.

Artists may receive booking information required to perform the requested beauty service, such as the Customer’s or Recipient’s name, contact details, service address, booking time, selected beauty services and relevant service notes.

Customers and Recipients may see relevant Artist information associated with their booking, such as the Artist’s display name, profile image, beauty services provided and other booking-related information.

Affiliates

We do not currently share personal data with affiliates. If our corporate group structure changes, we may share personal data with affiliates where this is necessary for the purposes described in this Privacy Policy and subject to applicable data protection requirements.

Corporate transactions

If we are involved in a merger, acquisition, financing, restructuring, transfer of business or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards and notice where required by law.

Public authorities and legal disclosures

We may disclose your personal data to courts, law enforcement authorities, regulators, government authorities or other third parties where we believe such disclosure is necessary:

  • to comply with applicable laws or enforceable governmental requests
  • to establish, exercise or defend legal claims
  • to investigate, prevent or take action regarding suspected fraud, cheating, abuse, security incidents or other unlawful or unauthorized activity
  • to enforce our Terms of Service or other applicable terms and policies; or
  • to protect the rights, property, safety and security of the Company, Customers, Recipients, Artists or other persons

6. How we store your personal data

We process your personal data only as long as necessary to provide our Services, fulfil the purposes described above in the Section “How we process your personal data”.

The retention period for your personal data is determined by the following criteria:

  • The duration for which personal data is needed to provide our Services.
  • The nature of personal data (e.g., general or sensitive).
  • Any requests for deletion of personal data by Customers, Recipients or Artists.
  • Any contractual or legal obligations requiring the ongoing processing of personal data.

The retention periods for the following categories of personal data are defined as follows:

3 years after account deletion:

  • Account and account-linked data
  • General service data
  • Communications and support data

5 years after account deletion:

  • Insurance certificates

10 years after account deletion:

  • Purchase and transaction data
  • Artist payment details (Stripe Connect onboarding status and Stripe account identifier)

12 months:

  • Device and technical data

For details on why we process your data, refer to the section “How we process your personal data”.

7. Cross-border transfer of your personal data

Personal data is processed in the places where we, our data processors and other data recipients are located. This means that your personal data may be transferred to and maintained on servers located outside your state, province, country or other governmental jurisdiction, where the applicable laws and regulations may differ from those of your jurisdiction.

We are located in France. Depending on the Services you use, the purposes of processing and the location of our service providers, partners or infrastructure, your personal data may be processed in other jurisdictions whose data protection laws may differ from those of your country of residence.

When we transfer personal data across borders, we do so only where such transfer is permitted under applicable law. Where required, we take appropriate measures designed to protect personal data during cross-border processing.

In particular, where personal data is transferred outside France, we may transfer it:

  • to a country or territory that provides a level of personal data protection recognised as sufficient under applicable laws (adequacy decisions)
  • on the basis of a contract or other binding arrangement requiring the recipient to apply data protection measures and safeguards required under applicable laws (standard contractual clauses or equivalent lawful safeguards, where required)
  • where you have given explicit consent to the transfer, where consent is an available legal basis

8. Push notifications and unsolicited messages

We may send push notifications or alerts to your mobile device to provide service updates, promotional communications, and other related messages, if you have agreed to such notifications.

You can deactivate these notifications by changing your notification settings on your device.

9. Security of your personal data

We implement technical, organizational and legal measures in an effort to protect personal data from loss, theft, misuse, unauthorised access, disclosure, alteration and destruction, taking into account the nature of the personal data that we process and the risks associated with it.

The high level of security and safety of your personal data is also ensured by our data processors, whose data processing practices are described in their privacy policies. Read more about it in the Section “How we share your personal data”.

No security system is perfect. Therefore, we cannot guarantee the absolute security of our Services or that personal data will not be intercepted while being transmitted to us.

For your protection, we recommend accessing or using our Services within a secure environment.

3. Your Privacy Rights

1. List of your rights

Under the GDPR, you have the following rights:

Right to withdraw your consent

If you gave us your consent for the processing of your personal data, you have the right to withdraw your consent at any time.

If you withdraw your consent, we will stop processing your personal data for the purpose for which it was withdrawn.

Withdrawing your consent does not affect the lawfulness of processing carried out based on your consent before its withdrawal.

Right to be informed

You have the right to be informed about the collection and use of your personal data. This includes information on the purposes of processing your data, the categories of data being processed, the retention periods for that data and with whom it will be shared.

Right to access

You can request confirmation that your personal data is being processed and obtain a copy of the data, as well as additional information about the processing, such as the purposes, categories of data, recipients and retention periods.

Right to rectification

If you find any inaccuracies in the personal data we hold about you, you can request a correction.

Right to data portability

You can obtain and reuse your personal data for your own purposes across different services.

Rights related to automated decision-making

You can opt out of profiling activities used for making decisions that could have legal or similarly significant effects on you.

Right to restrict processing

You can restrict the processing of your personal data when:

  • you contest the accuracy of your personal data;
  • you suspect that the processing is unlawful;
  • you believe that we no longer need your personal data for the purposes of processing, but you may require your personal data for the establishment, exercise or defence of legal claims;
  • you object to the processing of your personal data based on our legitimate interest while we are verifying whether our legitimate interest overrides yours.

Right to object

You can object to processing based on legitimate interests.

Right to opt out of processing for advertising purposes

You can object to the processing of your personal data for advertising purposes and/or for analytics purposes.

If you object to the processing of your personal data for advertising and/or analytics purposes, we will cease processing your data for such purposes.

When you use our Services, third parties may process data about your mobile device and how you use our Services in order to serve ads on other apps or websites that are tailored to your interests.

Examples of data that may be processed can include: IP addresses, identifiers associated with your mobile device or applications on the device, how you use our apps, items you put in your basket or any links you click on when you are in our apps.

If you wish to opt out, please use one of the following methods:

  • For instructions on how to “Limit Ad Tracking” on the iOS, please visit this link.
  • For instructions on how to “Opt out of interest-based ads” on Android OS, please visit this link.

Right to erasure

You can request the deletion or removal of your personal data, in particular, when:

  • your personal data is no longer necessary for the purposes of its processing;
  • you withdraw consent on which the processing is based and there is no other legal ground for the processing;
  • you object to the processing based on our legitimate interest;
  • you suspect that your personal data has been unlawfully processed.

Right to lodge a complaint

If you believe that our processing of your personal data infringes your rights, you may lodge a complaint with the relevant data protection authority. In France, this is the National Commission on Informatics and Liberty (Commission nationale de l’informatique et des libertés, CNIL): https://www.cnil.fr/.

2. How to exercise your rights

You can exercise your rights within our Services or by contacting us at support@glame.paris.

When you exercise your rights, we will confirm your identity by comparing the details in your request with the information you have previously shared with us. This may involve contacting you at the email address associated with your access to and use of our Services.

To respond to your request, it is necessary for us to verify your identity. Therefore, you can only exercise the above rights by submitting a verifiable request, which must:

1) Provide sufficient information to reasonably verify that you are the individual whose personal data we have collected or an authorised representative;

2) Describe your request with enough detail to allow us to properly understand, evaluate and respond to it.

We use the information provided solely for verification purposes and will not request additional details unless essential. Any extra information you provide will be deleted once the verification process is complete.

We will not respond to requests if we cannot verify your identity and therefore cannot confirm that the personal data we hold pertains to you.

4. Cookies

Our website uses cookies and similar technologies to operate securely, prevent misuse and support basic website performance.

The website is built with Squarespace and may use Squarespace cookies, including crumb and test, which help protect the website against security risks and technical errors. These cookies are necessary for the website to function properly.

We also use Google reCAPTCHA cookies, such as rc::a and rc::c, to help identify bots and protect the website against spam and malicious automated activity.

The website may also use technical cookies and similar technologies, including GCLB for load balancing and Statsig-related local storage entries for feature evaluation, website stability and performance-related purposes.

Where cookies or similar technologies are not strictly necessary, we use them in accordance with the consent choices available on the website.

5. Updates

We may update this Privacy Policy from time to time as necessary to protect our users, provide up-to-date information and address legal and technical changes. The most current version of the Privacy Policy will govern our processing of your information and will be available here.

If you have questions or concerns about this Privacy Policy, please contact us at support@glame.paris.