Privacy policy

The platform is run and maintained by a private individual in Lithuania ("GlowBook"); once a legal entity is registered, its full details will be given here. Data questions: info@glowbook.lt.

The details of clients a professional enters in their own client book, those clients’ visit history and notes, and the professional’s income and expense records are the professional’s: the professional is the controller of that data, and GlowBook stores and processes it on their behalf as a processor.

Account data: name, email address, phone number (if you give one), chosen language.

Professional profiles: description, city, address, services, prices, working hours, languages served, photos.

Bookings: service, date, time, place, price, status, how it was paid.

A professional’s client book: client name, phone, email, date of birth (if entered), notes, visit history, opt-out from SMS.

Messages between client and professional, and reviews.

A professional’s income and expenses, and uploaded receipts and invoices (photos or PDF) — in private storage, visible only to that professional.

Shop orders: items, quantities, pickup, payment method.

The mobile app’s notification identifier (push token), if you allow notifications.

Payments are handled by Stripe. We never see or store card details.

To run bookings, payments, refunds, messages, the shop and the professional’s work tools (calendar, client book, income, expenses, reports) — performance of our contract with you.

Emails and app notifications about bookings, orders and messages — performance of the contract. You can turn emails off in Settings.

A day-before SMS reminder to a registered client — only if you consented in Settings (you can withdraw it any time).

SMS to clients a professional has entered in their client book: a day-before reminder (the professional can switch it off) and, if the professional turns them on, a come-back invitation and a birthday greeting. This is the professional’s legitimate interest in reminding their own clients of their own visits; every SMS carries a link to stop further messages.

A trust score from the history of attended and cancelled visits, to protect professionals’ time from no-shows — legitimate interest. It only decides whether a deposit is needed when booking.

Keeping accounting records — legal obligation.

A professional turns the AI add-on on themselves; without it no data is sent to any AI service.

Receipt scanning: the photo or PDF of an uploaded receipt or invoice is sent to Anthropic (Claude) to read the amount, date, seller and other fields. The professional checks the result and saves it themselves.

Replies to clients: when a client writes to a professional, Anthropic receives the conversation text (up to the last 20 messages) and the professional’s services, prices, hours, free times and cancellation terms, plus this client’s visits with this professional. The professional’s private notes about the client and other clients’ data are not sent.

By default the AI only prepares a draft, which the professional reviews and sends. If the professional switches on automatic replies, the AI answers only simple questions itself (prices, free times, address); such messages are marked "answered by the AI assistant". The AI makes no decisions with legal effects for you — it does not create, change or cancel bookings.

Anthropic processes the data under its commercial terms: data received through its API is not used to train its models.

If a professional chooses to connect Google Calendar, we request a single permission: "https://www.googleapis.com/auth/calendar.events".

We use it only to add a confirmed booking to your calendar and remove it when the booking is cancelled. We do not read or change any other calendar events.

We store only the refresh token and the IDs of the events we create. The token is encrypted with AES-256 before it reaches the database — see "How we protect your data" below. We do not store or copy your calendar contents.

We do not share Google account data with third parties, use it for advertising, or use it to train AI models. Google Calendar data is not sent to the AI add-on.

You can disconnect at any time in GlowBook settings or at myaccount.google.com/permissions. Disconnecting deletes the stored token.

GlowBook’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The professional you book with, order from or write to sees your name, contact details, bookings, orders and messages.

Service providers the system cannot run without: Supabase (database and sign-in, on our server), Stripe (payments, subscriptions), our email provider, Twilio (SMS), Expo (app notifications), Google (calendar, if connected), Anthropic (only with the AI add-on), OpenStreetMap (map tiles — see "Cookies and third-party requests").

Some of these providers (Stripe, Twilio, Expo, Google, Anthropic) may process data outside the European Economic Area, mainly in the USA; such transfers rely on the EU Standard Contractual Clauses in the providers’ agreements.

We do not sell data or use it for advertising.

Account, profile, client-book and message data — while the account is active; when an account is deleted, they are deleted, except what we are required to keep.

Booking, payment, income and expense records — as long as accounting law requires.

Receipt and invoice files — until the professional deletes the expense or the account.

If a professional does not pay for the plan, their data is not deleted: it stays visible to them, only the profile is hidden from clients.

Transport: all traffic is HTTPS-only (TLS 1.3), and plain HTTP requests are redirected to the secure address.

Google access token: encrypted with AES-256 before it is written to the database, with a fresh initialisation vector for every token. The encryption key lives in a server environment variable, not in the database, so a copy of the database alone cannot decrypt any token.

The database is not reachable from the internet — only the application connects to it, over a private internal network.

Access control in the database: every table has row-level security (RLS) policies and column privileges. Email addresses, phone numbers, Google tokens and Stripe identifiers are not available through the public API; a professional’s client book, income, expenses and receipts are visible only to that professional, and a conversation only to its participants.

Receipts and invoices are kept in private storage and opened only through short-lived links.

We never store or see passwords — Supabase Auth handles them and keeps only a cryptographic hash.

Administrative access to the server is by SSH key only; password login is disabled.

Card details never reach our servers — Stripe handles them.

We use only two cookies, and both are strictly necessary: "NEXT_LOCALE" remembers your chosen language, and, once you sign in, "sb-…-auth-token" keeps your session.

In browser storage (not cookies) we keep only what you type in: the shop cart until you order, and the report header fields. This is not sent to us.

We use no analytics, advertising or tracking cookies. When you open a map (in search or when choosing an address), your browser downloads map tiles from OpenStreetMap servers, which see your IP address as any website does. The pages make no other third-party requests.

That is why there is no consent banner: under EU ePrivacy rules consent is only required for cookies that are not strictly necessary, and there are none here. You can delete both cookies in your browser settings — you will simply need to choose your language and sign in again.

You can access, correct and delete your data, restrict its processing, object to processing based on legitimate interest, and receive your data in a portable format.

You see and edit most of your data yourself in your account. Otherwise write to info@glowbook.lt — we reply within one month.

If you are in a professional’s client book, contact that professional about your data first; you can stop SMS through the link in the message. You can also contact us and we will help.

You have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).

We update this policy when what the platform does changes. The date at the top shows the last change; we will tell registered users about material changes by email.