Privacy Policy

1. Who we are

TimeForGlow is an online marketplace and salon operations product. Customers can find approved salons, search by place, and book treatments. Salon owners can manage profiles, diaries, customers and optional integrations from a dashboard.

Privacy questions: hello@timeforglow.com.

A formal legal entity name, registration number and postal address for the operator have not been confirmed for publication. See Operator details. Until those details are confirmed, contact us by email.

2. TimeForGlow’s role and each salon’s role

TimeForGlow operates the website, accounts, marketplace search, booking technology, transactional messages we send, and platform features such as optional Google Calendar sync for entitled salons.

Each salon decides how it runs its business: services, prices, staff, opening hours, cancellation practice at the venue, treatment delivery, and any additional customer records it keeps outside TimeForGlow. When you book, the salon receives the booking details needed to provide the appointment. How a salon uses your information after the visit is the salon’s responsibility and may be covered by that salon’s own notices.

Demo profiles under /demo are simulated listings. They are not affiliated with the named businesses and are not live partners.

3. Information we collect

Account and profile

When you register we store your name, email address and a hashed password. You may add a phone number or birthday later. We record whether your email has been verified. Phone verification and SMS messaging are not enabled on the live service today.

Bookings and salon records

Bookings store the customer account, treatment, staff member, time, price, currency, status and related payment-policy fields. Salon profiles store business name, address, map coordinates, description, services, staff schedules, photos you upload, reviews, and operational notes the salon adds about its customers (for example preferences or no-show history for that salon).

Location search

If you search by postcode or address, or use “Salons near me”, we process the place text or device coordinates you provide so we can show nearby salons. Place lookup is performed through our server-side location provider (see below). We do not require location access to browse the site.

Communications

We send transactional email needed to run the product (for example email verification codes, password reset and booking-related notices where email delivery is configured). Marketing campaigns are not active. Support tickets you open are stored so we can reply.

Technical and security data

We keep session records, authentication attempt logs and short-lived verification codes (and related send limits) to secure accounts. We do not operate a third-party analytics or advertising pixel on the site today.

4. How we use information

• Create and secure accounts, including email verification before booking or salon registration.
• Show marketplace results, salon pages and maps for approved partners.
• Create, change and cancel bookings and show them in customer and salon dashboards.
• Send transactional messages and support replies.
• Provide salon tools such as diaries, customer lists, embeds and optional calendar sync.
• Prevent abuse, debug failures and meet legal requests where we are required to do so.

Creating an account or using the site is not treated as consent to every possible form of data processing. Where a specific optional feature needs extra permission (for example connecting Google Calendar), we ask for that permission in context.

5. Service providers we actually use

We only describe providers that the live product uses or has credentials prepared for:

• Hosting and database: the TimeForGlow application and PostgreSQL database run on our application server infrastructure serving timeforglow.com over HTTPS.
• Transactional email: Hostinger SMTP, sending from hello@timeforglow.com for verification, security and booking-related messages.
• Location services: Geoapify (with OpenStreetMap attribution in the product) for server-side geocoding of search places. The API key is not exposed in the browser.
• Google Calendar: optional OAuth connection for salon owners with an eligible trial or subscription (see the next section).

Card checkout, Stripe Connect payouts, SMS delivery, Mailchimp marketing and Reserve with Google are not activated for live charging or messaging on the public service today, even where code paths exist for a future switch-on.

6. Google Calendar connection

Salon owners who have an eligible one-month platform trial or paid entitlement may connect a Google account from the salon dashboard. Customers do not connect Google Calendar through TimeForGlow.

Permissions we request

• https://www.googleapis.com/auth/calendar.events — create, update and delete TimeForGlow booking events on the calendar the owner selects, and list events so we can import busy times.
• https://www.googleapis.com/auth/calendar.calendarlist.readonly — list calendars so the owner can choose which calendar to sync.

We do not request unrestricted full-calendar admin scopes beyond those listed.

What we read

After connect, we read the owner’s calendar list for selection. For the selected calendar we read upcoming events (about the next 30 days) to import busy intervals. We store event timing identifiers needed to keep busy blocks in sync. We do not copy Google event descriptions or attendee lists into customer-facing TimeForGlow pages.

What we write

For confirmed TimeForGlow bookings we create or update Google events titled like “Busy · [service name]” with a short note that customer contact details and treatment notes are not exported. Private extended properties identify the TimeForGlow booking and salon so we can update or delete the same event later. Cancelled or no-show bookings remove the matching Google event when sync runs.

What we store

On our servers we store the connected Google account email, OAuth refresh and access tokens for that salon, the selected calendar id, optional staff mapping, sync status, and mappings between TimeForGlow bookings/busy blocks and Google event ids. Access is limited to the salon owner’s TimeForGlow workspace systems that perform sync; we do not sell this data or use it for ads.

Who can access it

The connecting salon owner (and platform operators maintaining the service) can manage the connection in the dashboard. Marketplace customers cannot open the salon’s Google account.

Disconnect and deletion of Google data

Owners can disconnect Google Calendar in the dashboard. Disconnect revokes the Google token where possible, deletes the stored Google link and tokens for that salon, and removes TimeForGlow copies of Google-derived busy blocks and event mappings for that salon.

Google API Services User Data Policy — Limited Use

TimeForGlow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data is used only to provide and improve the user-facing calendar sync features described above (busy import and booking event sync). It is not used for advertising, not sold, and not transferred to third parties except as needed to operate those features (for example hosting the application) or as required by law. Human review of Google user data is not part of normal product operations and would only occur if needed for security, to comply with law, or with appropriate user permission.

7. Cookies and similar technology

We use an HTTP-only session cookie named tfg_session so you stay signed in. It is set for our site, marked Secure in production, and uses a Lax SameSite policy. We do not currently set advertising or analytics cookies.

8. Retention and deletion

We keep account, booking and salon records while they are needed to provide the service, resolve disputes, secure the platform and meet legal obligations. We have not published fixed multi-year retention schedules for every data type.

You may ask us to correct or delete personal information by emailing hello@timeforglow.com. We may need to retain limited records where the law requires it (for example completed booking history tied to a salon’s legitimate business records) or where deletion would break security logs that protect other users. Salon-held notes about a customer are also visible to that salon while the salon account remains.

9. Security

Passwords are stored as one-way hashes. Sessions use server-side tokens. Access to production systems is limited to people operating TimeForGlow. No security measure is perfect; please use a strong unique password and tell us promptly if you suspect account misuse.

10. International processing

TimeForGlow is used by customers and salons in more than one country. Information may be processed on servers and by providers in locations different from where you live. If that applies to you, your information may be transferred across borders to operate the service.

11. Your choices and rights

Depending on where you live, you may have rights to:

• access personal information we hold about you;
• correct inaccurate information;
• request deletion or restriction in certain cases;
• object to certain processing; and
• lodge a complaint with a data protection authority.

To exercise a request with TimeForGlow, email hello@timeforglow.com. We do not claim that a specific privacy certification or regulatory approval has been completed.

You can update profile details while signed in, disconnect Google Calendar from the salon dashboard, and stop using optional location features by not submitting place search or device location.

12. Updates to this policy

We may update this Privacy Policy when the product or providers change. The effective date at the top will change when we do. Significant changes that affect Google user data uses will be reflected here before new uses begin.

13. Contact

Privacy enquiries: hello@timeforglow.com