Privacy and data retention

Last updated 8 September 2026

What we hold while your account is open

• Your name and email address, from however you signed in.
• Any address you save — street line, second line, town, postcode, and any access note or gate code you add. These are encrypted before they are stored, so they are not readable in the database itself.
• Your appointments — what you booked, when, from whom, what it cost, and what happened to it afterwards.
• A reference to each payment, held by our payment processor. Card numbers are entered into their form and never reach us.
• Photographs a stylist uploads. Hidden location data is stripped out of every image before it is stored — a phone photograph carries the coordinates it was taken at, accurate to a few metres, and none of that survives. We never run face recognition, face matching or any similar analysis on a photograph.

Your address, and who can see it

Your street address is not shown to your stylist when you book. She sees your town and the driving distance, and nothing more precise.

The full address — including access notes and any gate code — is shown to her from 24 hours before the appointment until 24 hours after it ends, and only once your deposit has cleared. That single rule decides every screen and every email she gets: a confirmation sent days ahead carries the town, and one sent for an appointment already inside that window carries the street, because by then the window is open.

The first time your address is handed to a stylist is written to a permanent record — the appointment, the stylist, and the moment. It is the one reading of your data we log rather than a change, and it exists so that “who has my address, and since when?” has an answer.

Deleting your account

There is a Delete account section at the bottom of your account page. It tells you what will happen, asks you to type DELETE, and then does it.

It happens immediately. Not within thirty days and not at the next scheduled purge — the deletion runs while you wait, and the page you land on afterwards is already looking at an account that is gone.

It cannot be undone. There is no restore, no grace period and no support request that can bring it back. Signing in again later with the same email gives you a brand-new empty account that shares nothing with the old one.

One thing can stop it. If you have an appointment still coming up, the deletion is refused and the screen lists those appointments so you can cancel them first. We do not cancel them for you, because cancelling costs somebody money or an afternoon and that decision is yours to make one appointment at a time. The normal cancellation policy applies: a client cancelling inside her stylist’s free-cancellation window forfeits the deposit and outside it gets it back in full, and a stylist cancelling always refunds her client’s deposit in full.

What is deleted immediately

If you are a client

• Your name, email address and phone number are erased from your account record.
• Every address you have saved — street line, second line, access notes and gate codes — is deleted outright. These were stored encrypted; the encrypted values go too.
• Notification subscriptions, so no device of yours can be notified again.
• The record of emails and notifications we sent you.
• Any scheduled work still queued against you — reminders, notices — is cancelled.
• Reviews you wrote stay attached to the appointment they describe, because a stylist’s rating average is built from them and quietly changing her public score is not ours to do. They show as “Former client”, with no month and nothing else. Nobody can tell who wrote one.

If you are a stylist

• Your booking page stops existing. The handle is released, so your link returns a genuine “page not found” rather than a page with the lights off.
• Your services, prices, weekly hours, date exceptions, scheduling rules and travel fee rules are deleted.
• Every photograph — portfolio, profile picture, cover image — is deleted from storage, not just unlinked from a page.
• Your bio, your starting location and your town are erased.
• Your name, email address and phone number are erased from your account record.

The exception: money and appointments

We keep the financial record of appointments for seven years. This is the one thing deleting your account does not remove, and it is not a choice we can make differently.

What is kept:

• the appointment’s reference, and which stylist it was with
• the service names and prices, the travel fee and the distance driven
• the deposit charged, the platform fee taken, and any refund amount
• the payment references our card processor gave us
• the appointment’s date and time, its status, and the history of how that status changed

What is not kept on it: your name, your phone number, your street address, your access notes, or any note you typed. The address is deleted outright, and the appointment is left holding only the distance and the travel fee that was charged for it.

Why seven years

Tax. Payments made to stylists through GLOSS are reportable income, and the records underneath them have to stay available for years afterwards. Deleting them on request would mean being unable to substantiate a tax form already filed.

Card disputes. A cardholder can dispute a charge long after it was made, and the only defence against a dispute is the record of what was bought, when, for how much, and what happened afterwards. An account deleted the week before a dispute would leave the stylist with no way to keep money she had earned.

Whose record it is. These rows are attached to a marker where your account used to be: the reference survives with every personal field emptied out. Nothing joins back to a person any more.

The history cannot be edited. The log of what happened to a payment is permanent by design. The database itself refuses to change or remove a line in it, so nobody — not us, not a future change to our software, not somebody with direct access — can quietly rewrite it. It holds references, statuses and amounts. It is never allowed to hold a name, an address, a phone number or an email, and that is enforced on every write, precisely because these lines outlive the accounts they describe.

What we do not control

Deleting your GLOSS account does not reach into other companies’ systems.

• Our card processor keeps its own record of every payment, refund and payout. That is its legal obligation as the processor, not ours, and we could not delete it if we wanted to.
• A stylist’s payout account is hers, not ours. Deleting a GLOSS stylist account leaves it untouched and still hers, because it may hold money, a payout schedule and tax records that have nothing to do with us. She closes it herself if she wants it closed.
• Our email provider keeps delivery logs of messages already sent, the same way any mail server keeps a log of mail it handled. We cannot retract an email that has already arrived in somebody’s inbox.
• Our error monitor holds nothing personal by design. Everything on its way there passes through a filter that removes emails, phone numbers and street addresses. There is nothing about you in it to delete.

Cookies

GLOSS sets only the cookies it cannot work without: one that keeps you signed in, and ones our payment processor sets to complete a payment and to detect fraud. There is no advertising, no analytics that follow you between sites, and nothing that builds a profile of you — which is why there is no consent banner to click through. Signing out clears the session.

Changes

If this policy changes in substance, the date at the top of this page changes with it.