Privacy Notice

Who Is Responsible

IDS Business Live AG (UID CHE-140.202.303), Badenerstrasse 808, 8048 Zürich, Switzerland, is the party responsible for the data processing described in this notice. The commercial-register extract is publicly available: https://zh.chregister.ch/cr-portal/auszug/auszug.xhtml?uid=CHE-140.202.303.

At this time, no formally appointed Data Protection Officer at this time. For any privacy-related matter — a question, a rights request, or a complaint — you can reach us at legal@stylingcorner.ch.

Scope

This notice covers every way you interact with Stylingcorner: the Marketplace website for customers, the mobile app, the PRO business application used by beauty businesses and their employees, and our internal administration area.

It applies to five groups of people: customers with a Marketplace account, owners and administrators of a business listed on Stylingcorner, employees of such a business, owners of a business listing that has not yet been claimed, and visitors to our website.

When Stylingcorner Is Responsible — and When the Business Is

Stylingcorner acts as the responsible party (controller) for: creating and managing your customer account, Marketplace search and discovery including favorites, the account, session, and payment-flow data belonging to a booking, the integrity and moderation of the review system, our security and audit logs, and — until a business claims it — listings we created from publicly available business information.

The beauty business itself is independently responsible for: actually delivering the service you booked, the client records it keeps for its own customer relationships, the employment data of its staff, its role as the payment recipient for customer payments made through Stripe Connect, and the content of its own replies to reviews.

For data a business enters into its own client-management tools and internal scheduling, Stylingcorner acts as a processor on the business's behalf (see the Data Processing Agreement) — with one exception: the login and security account of each individual staff member, for which we remain the responsible party.

Data We Collect From Customers

When you register and manage your account, we collect your contact details and profile information. When registering, you confirm by checkbox that you accept the Terms; the privacy notice is linked there. We store the time of this confirmation, but currently not which version of the Terms applied.

Bookings are only possible with a customer account. When you make a booking, we record the service, time, and business you selected, the salon's cancellation terms shown and accepted by you at booking, and the related payment-flow data. We also process your saved favorites, any reviews you write and the business's replies to them, and your notification preferences (for example newsletters, offers, recommendations, or voucher alerts).

Marketing preferences are stored as yes/no values. Changes you make in the privacy area of your account are additionally logged with a timestamp; changes via the general profile settings and older settings do not have such a timestamp yet.

Location in the Mobile App

Purpose: finding salons near you. When: the app only asks for your location when you tap "Current location" in search or pick a category tile in the search dialog that searches near you. The first time, the operating system's permission prompt appears; only access while using the app is requested, never in the background. The location is determined once each time, not tracked continuously.

What happens to the coordinates: they are sent to our server as search parameters (latitude/longitude or a small surrounding map area) to find nearby salons and to tailor the app's home screen to your area; if you are signed in, your account ID is also sent for the home screen. The coordinates are not stored in our database. Because they are part of the request address, they may appear in server logs (retention: see "Data Retention"). They are not stored permanently on the device; "recent searches" only contain the search term and place name.

Place name: to display the place, the app converts the coordinates into a place name using the operating system's geocoder (Apple on iOS; on Android the system geocoder, typically provided by Google). The respective platform provider receives the coordinates for this.

Without location: you can decline the permission or revoke it at any time in the system settings and pick a city from the list instead; search then works based on that city.

Push Notifications in the App

The app only asks for push permission after you choose "Enable" in the prompt shown after signing in or in your profile's notification settings. We then store, with your account, the device's push token, the platform (iOS/Android), and the app and operating-system versions.

Content: push messages are sent for confirmed, upcoming (reminder), rescheduled and cancelled appointments and for replies to your reviews. Title and text may contain the salon name and the weekday and time of the appointment, never amounts. A data payload with the notification ID, notification type and the related appointment or review ID is included so the app opens the right screen.

Delivery: we hand the message to Expo's push service, which delivers it to your device via Apple (APNs) or Google (Firebase Cloud Messaging). Message content and token reach these providers in the process.

Stopping: you can switch push notifications off at any time in the system settings. When you sign out of the app and when your account is deleted, the device is blocked for push; the blocked entry is currently not deleted.

Website Usage Statistics

Only if you consent to the "Analytics" category in the cookie notice do we record our own usage events on the website (e.g. page views, searches started, categories and salon cards clicked) with a random per-tab identifier — without an external analytics service and without any link to your account. Details, the event list and withdrawal: "Cookies & Tracking" page. The mobile app contains no usage statistics.

Data From Businesses and Employees

A business that registers on Stylingcorner provides company and profile information for its Marketplace listing. We are the responsible party for the login and security account of its staff — owner, administrator, or employee.

Team information entered by the business — a staff member's name, a public bio (when the business enables it for Marketplace visibility), working hours, and internal scheduling entries including absences such as sick leave with an optional free-text note — is entered by the business; we process this data purely as a technical processor.

Claiming a listing or verifying identity may involve uploading an identity or registry document. This is stored privately, is never made publicly accessible, and is used solely to verify the claim.

A business's own client-management records — the customer entries and internal notes it keeps about its own clients — belong to the business. Stylingcorner is only its technical processor here, not the responsible party.

Unclaimed Business Listings

Some businesses visible on Stylingcorner were created by us from publicly available business information that we import as a structured dataset, without that business opening an account. Such a listing is not a partnership, not a verification, and does not mean the business can be booked through Stylingcorner.

An imported business email address is not published; it may, however, be used during a claim to check whether the claimant belongs to the business. Origin, stored details and the procedure for claiming, correcting or removing a listing are described on the "Unclaimed Business Listings" page.

Payments

Stylingcorner uses Stripe in two separate roles: for a business's own PRO subscription (Stripe Billing), we are the responsible party. For a payment a customer makes to the business itself (Stripe Connect, including TWINT), the business is the payment recipient — the funds never pass through Stylingcorner.

Full detail on how payments are handled is on the dedicated "Payments & Stripe" page.

Security

Measures actually in place include password hashing for every account type, mandatory two-factor authentication for internal staff, server-validated sessions, strict data isolation between businesses, and cryptographically verified payment webhooks.

The complete, verified list of what is implemented — and what is deliberately not yet implemented, such as any formal certification or hardware security keys — is on the dedicated "Security" page.

Recipients and Subprocessors

We share data with the following providers that are actually integrated into our systems. Each provider's role and processing location are listed on the "International Data Transfers" page:

Infomaniak (Infomaniak Network SA, Genf) — Hosting of the platform on Infomaniak Public Cloud: application servers, database, cache/queue (Redis) and uploaded files (salon images, verification and claim documents). Data involved: All data stored by the platform: accounts, bookings, business, staff and customer data, and uploaded files. Operator statement: Switzerland — application servers, database, file storage and backups run on Infomaniak Public Cloud. Backups are encrypted before they leave the server and kept for 14 days on the server and 30 days in object storage.

Resend — Transactional email delivery (login codes, account notices, booking confirmations/reminders/changes, PRO billing and team emails). Data involved: Recipient email address, subject and message content — e.g. one-time codes, name, salon name, appointment date/time and services, billing status. Operator statement: USA — Resend stores customer data, including message content and delivery logs, in the United States. Logs are kept for 30 days and backups for 7 days.

Stripe — Payment processing — two separate flows: Stripe Billing (PRO subscription payment to Stylingcorner) and Stripe Connect direct charges (customer payment to the beauty business, incl. TWINT). Data involved: Billing: company name, billing email, internal company/plan identifiers; Stripe returns card brand/last 4 digits/expiry for display. Connect: amount, currency and internal booking identifiers (company, checkout session, appointment); card/TWINT details are entered directly in Stripe's payment form — Stylingcorner never receives full card data. Operator statement: Stripe processes data in the United States and other countries.

Expo (Expo Push Service) — Relaying push notifications to the Stylingcorner mobile app; Expo forwards them to Apple (APNs, iOS) or Google (Firebase Cloud Messaging, Android) for delivery to the device. Data involved: Device push token and the notification itself: title and text (e.g. salon name, appointment weekday/time) plus a data payload with the notification ID, notification type and the related appointment or review ID.

Google Maps Platform (Google Ireland Limited / Google LLC) — The salon-search map, the address autocomplete in Stylingcorner PRO, and turning a visitor's shared coordinates into a town name. Data involved: Visitor IP address, browser user agent, the map area viewed, address search terms typed in PRO, and — only where the visitor has granted the browser's location permission — their approximate coordinates.

The mobile app additionally involves Apple or Google platform services (not processors engaged by us): Apple (iOS) / Google (Android) — push delivery; Apple Maps (iOS) / Google Maps SDK (Android) — in-app map; Apple / Google — reverse geocoding on the device; Google Maps (link) — directions.

Explicitly not in use: Any SMS provider (one-time codes are delivered by email only, via Resend); Any external analytics or tracking SaaS (no Google Analytics, PostHog, Mixpanel, Meta Pixel, Hotjar, Segment or Plausible integration exists). Stylingcorner does run its own consent-based usage statistics on the website — see "Cookies & Tracking"; Any separate cloud storage/CDN vendor for photos (uploaded files are stored on our own hosting at Infomaniak, listed above); Any monitoring, error-tracking or APM tool (no Sentry, Datadog, LogRocket or New Relic integration exists); Mapbox anywhere (the website map uses Google Maps Platform — see the subprocessor register; for the mobile app see the platform services).

International Data Transfers

For no provider have the processing country and transfer mechanism been conclusively confirmed yet. Stripe is an internationally operating payment service provider, so processing outside Switzerland is likely. We therefore do not claim that your data never leaves Switzerland.

The per-provider overview is on the dedicated "International Data Transfers" page.

Data Retention and Deletion

Concrete retention periods have not been decided for most data categories, and we do not state an invented duration here.

A deletion request for a customer account is carried out by an authorised administrator after manual identity verification: the identifying details in the account are replaced or removed and access is blocked. Linked records (e.g. bookings, reviews, the salon's customer file, accounting records, backups) partly remain. Details are on the "Data Retention & Deletion" page.

Your Rights

You generally have the right to access the data we hold about you, to have inaccurate data corrected, to have your account deleted, to receive your data in a portable format, to object to or restrict certain processing, and to withdraw any consent you have given.

When signed in, you submit a request in your account settings under Privacy; without signing in, via the Privacy Rights Center or by email. Every request is handled by our team.

Complaints and Contact

For any privacy question, concern, or complaint, reach us at legal@stylingcorner.ch.

Residents of Switzerland may also contact the Federal Data Protection and Information Commissioner (FDPIC/EDÖB).

Changes to This Document

The version and date of this document are shown above. Every change in substance gets a new version and is recorded on the "Change History" page.