Privacy Policy

Who we are

Hair By Rachel Pointer is a sole-trader hairdressing business. For anything to do with this policy or your personal data, contact us via Instagram or Facebook.

What we collect, and why

When you book an appointment, we collect:

• Your name, and email and/or phone number if you give them — to run your booking, send a confirmation, and contact you about it (e.g. a reminder or a change).
• Your appointment history and any notes we add (e.g. a patch-test date, or an allergy/reaction you’ve told us about) — to give you a safe, consistent service on future visits.
• Whether you’ve opted in to marketing emails — only used if you say yes, and you can withdraw this at any time (see “Your rights” below).
• Any feedback you choose to send us after an appointment — a star rating and, if you write one, a comment.

We do not see or store your card details — payments are handled directly by Stripe (below).

Feedback and reviews

After an appointment we may email you to ask how it went. Answering is entirely optional, and your rating and comment are only ever used to help us improve unless you tell us otherwise.

On that form there is a separate tick box asking whether we may share your feedback on our website. It is off unless you turn it on. If you do tick it, we may publish your rating and comment anonymously — your name, email, phone number and any other personal detail are never shown, and we choose which feedback to display. We may also show the type of service it was for (e.g. “Cut & Blow-dry”) and the month it was left. Please avoid putting anything in your comment that would identify you, since we publish comments as written.

You can change your mind at any time: reopen the link from your feedback email and untick the box, or just contact us and we’ll take it down.

Our legal basis for using your data

Booking/appointment data: contract — we need it to provide the service you’ve asked for. Marketing emails, and publishing your feedback on our website: your separate, explicit consent in each case, given by ticking the relevant box — never assumed, and never a condition of booking.

Who we share it with

We use a small number of trusted service providers to run this site and take payment. We don’t sell your data to anyone, ever.

• Stripe — processes card payments; they receive your payment details directly, we never do.
• Supabase — hosts our booking database.
• Resend — sends booking confirmations, reminders, feedback requests and (if you’ve opted in) marketing emails on our behalf.
• Cloudflare — hosts this website.

How long we keep it

We keep your booking and contact details for as long as you remain a client, plus a period afterwards for accounting/tax records (HMRC requires business records to be kept for at least 6 years). If you ask us to delete your data and you have no outstanding/recent transactions we’re required to keep records of, we will.

Cookies

As a customer browsing or booking, this site doesn’t set any cookies on your device — your basket while booking is held only in your browser’s temporary session storage and cleared once you’re done. The only cookie this site ever sets is a strictly necessary login session cookie, and only for salon staff signing into the admin dashboard. That’s why you won’t see an “accept cookies” box here.

Counting visits

We do count how many people visit the site and which pages they look at, so we know what’s useful and where people get stuck when booking. This is deliberately done in a way that can’t identify anybody: no cookies, nothing stored on your device, no IP addresses, and no identifier that would let us recognise you or link one page to the next. All that’s recorded is the page address, whether the screen was phone-sized, which website you arrived from (if any), and the country. These counts are kept for a limited period and then deleted automatically.

Because nothing here identifies a person, there’s nothing to opt out of — but if your browser sends a “Do Not Track” or “Global Privacy Control” signal, we won’t count your visit at all.

Your rights

Under UK data protection law, you have the right to:

• Ask what personal data we hold about you, and get a copy of it.
• Ask us to correct anything that’s inaccurate.
• Ask us to delete your data (subject to what we’re legally required to keep, e.g. for tax records).
• Withdraw marketing consent at any time — just let us know, or use the unsubscribe link in any marketing email.
• Withdraw permission for us to show your feedback on our website at any time, and have it taken down.
• Complain to the Information Commissioner’s Office (ICO) if you think we’ve mishandled your data.

To exercise any of these, contact us the same way as above (Instagram/Facebook).

Children

Our booking flow is intended for adults booking their own appointment. If you’re booking on behalf of someone under 16, please make sure you have a parent or guardian’s permission to do so.

Changes to this policy

We may update this policy occasionally, for example if we start using a new service provider. The version shown here is always the current one.