Privacy Policy

Who is responsible for your data

The data controller is Lashes by Mariya Draganova, a lash and brow studio in Stara Zagora, Bulgaria, run personally by Mariya Draganova.

Address: str. General Stoletov 69, Stara Zagora. Phone: +359889542165.

Email: [email protected] — use it for any question about this policy and to exercise your rights.

[FILL IN: legal form, registered name and company number (ЕИК)]

What we collect when you book

The booking form records:

• your name, phone number and email;
• the service you chose, the date and time, and the price at the moment of booking;
• a note, if you wrote one, and a promo code, if you used one;
• the language you booked in, so we write to you in it.

If you create an account we also keep your password in protected form (never as plain text). You may add a birthday — day and month only, no year — and remove it from your account at any time.

To look after you better on your next visit, Mariya may add a short note about the work to your client record and link a gallery photo to it. Only she sees those notes.

Where your data goes

Your data lives in the site's database, on a server we run. To make the site work we also use a few outside services. Each receives only what it needs, and only to do its job for us:

• Google Calendar (Google) — every confirmed appointment is written to the studio's calendar as an event carrying your name, phone number and email.
• Resend — sends the confirmation, cancellation and aftercare emails and the password links.
• Slack — notifies Mariya of every new request and cancellation, with your name, phone number and the service.
• Cloudflare — the site sits behind Cloudflare's network, and the booking form uses Cloudflare Turnstile to check you are not a bot without making you solve puzzles. Turnstile may process browser and IP address data to do that.
• Sentry — errors on the site are reported to Sentry so we can fix them. Reports do not include anything you typed, and we do not record what you do on the site.
• Google Maps — the map in the Contact section is loaded from Google, which may set cookies of its own.

Some of these providers are in the United States and operate under the EU's standard contractual clauses. None of them uses your data for its own purposes.

Emails you may receive

About your appointment: confirmation, cancellation, an aftercare reminder and a link to set a password. These are part of the service and are sent while you have an appointment with us.

As an existing client you may also receive a reminder that a refill is due, a note if you have not visited in a while, a birthday greeting and occasional news or promotions. Every such email carries an unsubscribe link, and one click stops all of them.

Cookies and tracking

The site sets a single cookie, “client_session”, and only when you log in to your account, so it can recognise you between pages. There are no advertising trackers, no Google Analytics, no Facebook Pixel or anything similar. We do not sell or rent your data to anyone.

Photos and social media

The photos in the gallery are of our own work, taken in the studio. If a photo of your lashes or brows appears in the gallery or on our profiles and you would rather it did not, write to us and we will take it down.

We prepare the studio's Facebook, Instagram and TikTok posts with a scheduling tool we host ourselves. It has access only to our own accounts, and only to publish content and read basic profile information and post statistics. It does not collect or store data about other users of those platforms. Access can be revoked at any time from the connected-apps settings of each platform.

How long we keep your data

We keep your appointments and client record for as long as you are our client, so we can see your history on your next visit, and delete them on request. Unfinished registrations expire on their own within 24 hours, password links within 7 days, and the server's technical log is cleared after 30 days.

Your rights

Under the General Data Protection Regulation (GDPR) you can ask for a copy of your data, have it corrected or deleted, restrict how it is processed, object to marketing messages and receive it in a portable format. Just write to [email protected] and we will answer within one month.

We process your data to deliver the appointment you requested (contract), out of our legitimate interest in keeping the site secure and in reminding existing clients, and — for your birthday — only with your consent. If you believe we are not respecting your rights, you can contact Bulgaria's Commission for Personal Data Protection (cpdp.bg).

Changes

If we change this policy we will update the date at the top. Significant changes will also be announced on the site.