Privacy policy

Who is responsible

The controller is the operator of Lichio named at the end of this page (“we”). Please send any data protection questions to the e-mail address given there.

What this policy covers

The lichio.app website, the enquiries you send us, the accounts of salons and their teams in the Lichio app, and the accounts of the salons' clients (Lichio account). Booking data at the salons we process for the salons as a processor – see Bookings with salons.

Visiting the website

We use no tracking or advertising cookies and no third-party analytics. Fonts and images are served from our own server. The server briefly keeps technical logs (IP address, time, page visited) to keep the service secure – based on our legitimate interest (Art. 6(1)(f) GDPR) and only for as long as that requires.

Cookies

We use cookies only where they are needed: a session cookie after signing in to the app or to a client account on a salon's website (valid for 14 days). The service does not work without them, so they need no consent.

Enquiry form

We process your name, business name and type, city, e-mail, phone and message to answer you and prepare a possible contract (pre-contractual steps, Art. 6(1)(b) GDPR). We keep enquiries for up to 24 months after the last contact unless a contract follows.

App accounts

For salons and their teams we process name, e-mail, phone where given, role, language and records of sign-ins and changes. We need these to perform the contract (Art. 6(1)(b) GDPR) and to secure the service (point f). We keep them for the duration of the contract and up to 12 months afterwards.

Accepted documents

At the first sign-in to the app and when a client account is registered, we record who accepted which document, in which version and when, with the IP address and browser. It is the evidence of the contract (points b and f). Records of salon teams are kept for the contract and 3 years after it ends; records of clients until their account is deleted.

Accounts of the salons' clients

• An account a client creates on a salon's website is a Lichio account, and we are its controller. It works at every salon that uses Lichio.
• We process the e-mail, name, language, password (only encrypted), sign-ins and the acceptance of the account terms to provide the account (point b) and protect it (point f).
• A salon receives the client's name and e-mail only when the client books there or saves their details there; the bookings and the customer card are then the salon's data.
• A registration nobody confirmed is deleted after 7 days. An account nobody used for 3 years is deleted; we send a warning a month before.
• Clients delete their account themselves in its settings, where they can also download their data.

Billing

We process billing details to perform the contract and meet legal obligations (points b and c) and keep them for as long as accounting and tax law requires.

Bookings with salons

When you book with a salon, the salon is the controller of your data. Lichio processes it on the salon's behalf under a data processing agreement. Please contact the salon with questions about your booking.

Who receives data

Only providers who help us run the service, and only as far as necessary:

• hosting: servers in a data centre in Germany (netcup GmbH)
• sending e-mail: Amazon Web Services EMEA SARL, data centre in Frankfurt
• backups: Cloudflare, Inc., storage in the EU
• Instagram posts, only when a salon connects its account: Meta Platforms Ireland Ltd.
• reading a price list from a photo, only when a salon sends us one: Anthropic PBC (USA, standard contractual clauses); price list photos should contain no personal data

Transfers outside the EU

We only transfer data outside the EU in the case above, with safeguards under the GDPR, in particular the European Commission's standard contractual clauses.

Security

Connections are encrypted (HTTPS), each salon's data is kept separate, access depends on roles, passwords are stored only in hashed form, and we back up daily.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time – just e-mail us. You can also complain to a data protection authority, in particular in the EU country where you live.

Changes

We update this policy when something changes, for example a new feature or provider. The version published here always applies.