Privacy policy · SO Beauty

Who is responsible for your data

The controller of your personal data is Rosini Solutions, the trade name of Rosini transports et locations Sàrl (UID CHE-264.039.709), Chemin des Bulesses 16, 1814 La Tour-de-Peilz, Switzerland. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

Data we use

We process the data needed to provide SO Beauty: account data (name, email, sign-in provider), profile data and the photos, videos, posts, comments and reviews you publish; bookings, messages and gift cards; payment data from Stripe (amounts, status, the last digits and brand of a card, never the full card number); device and usage data (IP address, device and app version, push token, security logs); your approximate location, or your precise location only when you allow it to show professionals nearby; and what you send to our support. We do not ask for health data. If you mention allergies or a health condition in a booking or message, it is used only to deliver the service you asked for.

Why we use your data and on what legal basis

We use your data to provide the contract you accept with these terms: your account, profile, bookings, payments, messages and the features of your plan. We use it on the basis of our legitimate interests to keep SO Beauty secure, prevent fraud and abuse, moderate content, answer support requests and improve the service. We use it with your consent for analytics cookies, personalised advertising, push notifications, precise location and marketing messages where the law requires consent; you can withdraw consent at any time without affecting earlier processing. We keep and disclose data when the law requires it, for example accounting records. In Brazil these bases correspond to Articles 7 and 11 of the LGPD.

Who receives your data

When you book, the professional receives your name, contact details and booking details. What you publish is visible to other users and, for public profiles and posts, on the web. Service providers process data on our behalf and under our instructions: Railway (hosting, servers in the European Union), Cloudflare (delivery and security), Auth0 by Okta (sign-in), Stripe (payments), Apple (in-app purchases), Resend (email), Twilio (SMS), Expo, Apple and Google (push notifications), Mapbox (maps), Microsoft Azure (automatic translation), OpenAI (writing suggestions you ask for), PostHog (EU) and Google Analytics (statistics, only with your consent) and Google AdMob (advertising). Google Calendar and Instagram receive data only if you connect them. We may disclose data to authorities when the law requires it, and to a buyer if the business is transferred. We do not sell your personal data.

Google Calendar

Professionals can connect their Google Calendar. SO Beauty then asks Google for one permission, to see and edit the events in your calendars, and uses it for two things only: to add your SO Beauty appointments to your primary calendar (title: the service and the client’s name; description: the booking reference and a link), and to read when your primary calendar is busy so that clients cannot book those times. From your events we keep only an identifier and the start and end times; we do not keep their titles, descriptions or guests, and we read no other Google data. The access is stored encrypted, is never used for advertising, is never sold and is not shared with anyone except the providers that run SO Beauty for us. People at SO Beauty do not read it unless you ask us to, it is needed for security, or the law requires it. You can disconnect at any time in the app: we then remove the appointments we added, revoke the access with Google and delete what we kept. You can also remove the access in your Google Account (myaccount.google.com/permissions). SO Beauty’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Transfers abroad

Some providers process data outside Switzerland and the European Economic Area, mainly in the United States. We transfer data only to countries the Swiss Federal Council or the European Commission recognise as adequate, to providers certified under the Swiss-U.S. or EU-U.S. Data Privacy Framework, or on the basis of standard contractual clauses approved by the European Commission and recognised by the Swiss FDPIC, which also serve as the safeguards required by Article 33 of the LGPD. You can ask us for a copy of the safeguards.

Cookies and similar technologies

The website uses cookies that are strictly necessary for it to work, which need no consent: the sign-in session, security protection, your language (beauty_locale, 1 year) and an invitation code you opened (so_referral, 30 days). Analytics by PostHog (EU) and Google Analytics only start after you accept them in the banner; your choice is kept in your browser’s storage. We do not use advertising cookies on the website. In the app, Google AdMob may use device identifiers for ads after you decide in its consent message; SO Beauty does not track you across other companies’ apps. You can change your choice at any time with the button below or in your settings, and block or delete cookies in your browser.

Advertising and Google AdMob

Eligible SO Free users may see native advertising when it is enabled. External mobile ads can be supplied by Google AdMob. Depending on consent and platform permission, Google may process network or device identifiers, an IP-derived approximate area, consent choices and ad interactions for delivery, fraud prevention and measurement. SO Beauty does not send precise device location to AdMob.

Your advertising choices

Where required, Google User Messaging Platform asks for a decision before the Mobile Ads SDK starts. You can refuse or manage purposes and later reopen the privacy options in SO Beauty settings. The current integration does not request Apple’s tracking permission or IDFA.

Location and targeting

Advertising uses country, region or city only when already available through SO Beauty. Precise location is never requested solely for advertising and is not stored with ad impression or click events.

Retention and sharing

We keep data only as long as we need it for the purposes above: account and content data until you delete your account or the content; bookings, payments and invoices for 10 years, as Swiss accounting law requires; security logs for a short period. We then delete or anonymise the data. Content you deleted can remain in backups for a short time until they are overwritten.

Security

We protect data with encryption in transit, encrypted backups, access limited to the people who need it and monitoring. No system is completely secure. If a breach is likely to put your rights at risk, we inform the competent authority and you as the law requires.

Children

SO Beauty is not intended for children. You must be at least 16, or the age of digital consent in your country if it is higher, to use SO Beauty without the consent of a parent or guardian. Professionals must be adults. If you believe a child gave us data without that consent, contact us and we will delete it.

Your rights

You can access your data, correct it, export it in a common format, delete it, restrict or object to its use and withdraw your consent. Many of these are in the app’s settings (export and account deletion); for everything else, write to us. We answer within 30 days, or sooner where the law requires it, and may ask you to prove your identity. We do not take decisions with legal or similarly significant effects based solely on automated processing.

Your rights by region

Switzerland: you have the rights of the Federal Act on Data Protection and can complain to the Federal Data Protection and Information Commissioner (FDPIC). European Union, EEA and United Kingdom: you have the rights of the GDPR, including portability and the right to object to direct marketing at any time, and can complain to the supervisory authority where you live or work. Brazil: under the LGPD you can confirm whether we process your data, access, correct, anonymise, block or delete it, port it, learn with whom we share it and the consequences of refusing consent, revoke consent, and petition the National Data Protection Authority (ANPD). United States: depending on your state, you can know, correct and delete your data and opt out of targeted advertising; we do not sell personal information, and you can turn off personalised ads in the app’s privacy options. We do not treat you differently for exercising your rights. Other countries: you have the rights your local law gives you.

Changes to this policy

We update this policy when our processing or the law changes. The date at the top shows the latest version, and we tell you about important changes in the app or by email.

Contact

Questions or privacy requests, including as the data protection contact (encarregado) for the LGPD: [email protected]

[email protected]