Privacy Policy

1. Scope and our roles

This Privacy Policy applies to personal information processed by CYDEAVOR LLCthrough glossred.com, app.glossred.com, GlossRed public profiles and booking pages, the GlossRed progressive web application, supporting administrative and operational systems used to deliver those services, and another GlossRed service that links to this Policy (collectively, the “Service”).

In this Policy, “GlossRed,” “we,” “us,” and “our” mean CYDEAVOR LLC in its capacity as operator of the GlossRed™ Service.

It does not govern a Professional’s or Shop’s independent website, social account, in-person service, employee record, payment process, downloaded copy of client data, or other activity outside GlossRed. A linked service offered separately by CYDEAVOR LLC under the Cydeavor brand, including a consultation-booking page, is governed by the contract terms presented for that service, and its processing is described by the privacy notice shown there, unless that service expressly incorporates these documents.

GlossRed’s role

GlossRed determines how personal information is used for account creation, authentication, platform security, subscription billing, support, product administration, website analytics and advertising, fraud prevention, and legal compliance. For those activities, GlossRed acts as a business or controller under applicable privacy law.

Professional and Shop roles

Professionals and Shops independently decide why and how they use client information to provide services, communicate with clients, apply appointment policies, maintain business records, export data, or meet legal obligations. They are responsible for their own privacy practices and for copies they view, download, or use outside GlossRed. GlossRed provides workspace tools that process booking and client information under the workspace configuration and authorized users’ instructions. The legal roles for that processing depend on the activity, the parties’ relationship, and applicable law. This Policy does not itself create a data-processing agreement; a Shop that requires one should contact us before using GlossRed for processing that requires such an agreement.

2. Information we collect

Public information

Information intentionally published through discovery or booking pages can be viewed without signing in. Depending on the workspace, this may include a Shop name, logo and slug; a Professional’s public name, photo, biography, specialties and Shop association; services and prices; booking availability; and a verified review’s rating, text, date and Professional or authorized Shop response. Public reviews identify the reviewer as a “Verified client” rather than displaying the client’s actual name. Busy intervals expose occupied time, not client identity. Public information and media may be copied or cached by visitors and services outside GlossRed even after you remove it from the Service. A public media URL may also contain a stable technical identifier associated with the uploader.

Optional directory listings

When you publish a directory listing, the public details you choose to include, such as your professional name, photo, business location, specialties and booking link, are visible to visitors without an account. Publishing a listing does not make your private client records, appointment details, financial entries or billing information public. You can edit or unpublish your listing through directory settings. Search engines and other visitors may retain copies after you remove it. An external booking provider handles information you submit on its site under its own privacy policy.

Booking contact and consent records

When you enter a name and phone number during booking, GlossRed creates a Shop-scoped client record and appointment record containing that booking contact information. A Professional or Shop may allow you to book without a GlossRed account or may require you to sign in. Booking contact details are stored in that Shop-scoped record; submitting them does not update your account name or phone number. Account-free bookings include a record of when you agreed to the Terms of Use and acknowledged this Privacy Policy. A phone number is not verified as belonging to you unless the booking flow expressly completes a verification step. Use your own accurate contact information; the current flow is not designed for an adult to substitute a minor’s identity.

Information not intended for GlossRed

Do not submit Social Security numbers, government ID numbers, full payment-card data, passwords, medical records, precise health or disability information, or other highly sensitive information in profiles, notes, support messages, or other free-text fields. GlossRed is not an electronic health-record system. Professionals and Shops must collect only information they lawfully need.

3. Where information comes from

We collect personal information:

• Directly from you, when you create an account, complete a profile, configure a workspace, make a booking, record a business entry, submit a review, contact support, or exercise a privacy right.
• From other GlossRed users, such as when an authorized Shop manager invites a team member or a Professional or Shop records information connected to an appointment.
• Automatically, through session and preference storage, server and security logs, and operational telemetry if that telemetry is enabled or collected. Optional visitor analytics and advertising tracking are disabled.
• From providers, such as authentication results from Google or Supabase, subscription events from Stripe, bot-protection results from Cloudflare, and provider responses, message identifiers, or error status from Render, Resend, Supabase, and related infrastructure.

4. How we use information

GlossRed uses personal information to:

• Create, authenticate, restore, secure, and administer accounts and sessions.
• Provide Personal, Professional, and Shop workspaces and enforce role-based permissions.
• Publish user-selected profiles and media, services, verified reviews, booking links, and schedule-derived availability.
• Create, confirm, manage, cancel, reschedule, and preserve the history of appointments.
• Operate client, calendar, money, review, waitlist, export, in-app notification, support, and privacy-request tools.
• Determine trial eligibility, process subscription checkout, reconcile Stripe events, administer plan changes, and prevent duplicate or abusive trials.
• Send available authentication, privacy-request, support, review-response, waitlist, incident, billing-provider, security, and legally required communications that GlossRed or its providers have implemented. Marketing choices do not prevent necessary service or security messages.
• Monitor reliability, troubleshoot errors, improve usability, and develop the Service.
• Detect, prevent, investigate, and respond to fraud, spam, abuse, security incidents, prohibited conduct, and violations of our Terms.
• Comply with tax, accounting, legal, regulatory, insurance, dispute, and recordkeeping obligations and protect the rights, safety, property, and integrity of GlossRed, our users, providers, and the public.

Legal bases where required

Depending on the activity and your location, we process information to perform a contract with you, take steps at your request before a contract, pursue legitimate interests such as security and service improvement, comply with a legal obligation, or act with your consent. Before introducing optional analytics or advertising, we will establish the required legal basis and privacy controls. You may withdraw consent at any time without affecting prior lawful processing.

No AI booking features

GlossRed does not currently offer an AI booking assistant or AI receptionist, and does not send account, booking, support, or intake content to a generative-AI provider. We will update this Policy and complete the required privacy and security review before enabling an AI feature to process personal information.

5. How we disclose information

We may disclose personal information to:

• Clients, Professionals, and Shops. Authorized users receive information needed to complete bookings, manage appointments and client relationships, administer workspaces, and display verified reviews. Professionals and authorized Shop owners or managers can view or export relevant client names, contact details, appointment information, reviews, waitlist records, and business entries.
• The public. We disclose the user-selected public profile, media, service, availability, and review information described in Section 2.
• Service providers. Supabase, Render, Cloudflare, Google, Resend, and related providers may host data, authenticate users, protect forms, deliver communications, monitor reliability, or support the Service under applicable restrictions.
• Former analytics and advertising providers. The public website previously used PostHog, Meta Pixel, and CookieYes. These integrations are now removed. Information already disclosed may remain with those providers, subject to applicable retention, deletion, and other privacy obligations described below.
• Payment and financial partners. Stripe and related financial institutions process GlossRed subscription checkout, payment methods, subscription events, and fraud controls.
• Calendar providers you choose. A client’s one-time calendar file includes service, Professional, date and time. A Professional’s one-time file may also include the client’s full name and appointment notes. A private subscription feed includes appointment time, status, service, Professional, Shop name, and a limited client name, typically first name and last initial; it excludes client email, phone, and appointment notes. When you import or subscribe, your chosen calendar provider retrieves and may store that information under its own policy.
• Legal and safety recipients. We may disclose information when reasonably necessary to comply with law or legal process, enforce our Terms, investigate fraud or security events, protect rights or safety, or respond to a lawful government request.
• Business-transfer recipients. Information may be disclosed in connection with due diligence, financing, reorganization, merger, acquisition, sale of assets, insolvency, or a similar corporate transaction, subject to appropriate confidentiality and legal requirements.
• Other recipients you direct. We disclose information when you publish a profile, share a booking or private feed link, export data, connect a service, or otherwise direct us or give valid consent.

A private calendar-feed URL functions as a bearer credential. Anyone or any application with that URL may retrieve the feed until it expires or is revoked. Current feeds expire after 90 days and can be revoked in calendar settings.

We may use and disclose aggregated or deidentified information that cannot reasonably identify you. We will not attempt to reidentify data that applicable law requires us to maintain in deidentified form.

6. Payments

GlossRed uses Stripe-hosted Checkout and billing-management pages for GlossRed subscription payments. Stripe receives payment-card details directly and may also collect billing name or address and device or fraud-prevention data under its own notice. GlossRed does not store full card numbers or the raw card fingerprint in its database. To start checkout, GlossRed sends Stripe the account email, internal user and checkout linkage identifiers, selected plan or price, and trial-approval metadata. We receive and store limited billing and subscription metadata such as billing email, plan and price, customer, subscription and checkout identifiers, status, billing dates, trial eligibility, and payment-event and reconciliation records. A Stripe-provided card fingerprint may be transformed into a keyed equality signal for protected trial-abuse controls before the raw value is discarded.

Appointment-service payments are currently handled directly between a client and the applicable Professional or Shop. A business may manually record an amount, tip, payment-method category, income or expense description, or void reason in GlossRed, but those entries do not mean GlossRed processed or refunded the underlying appointment transaction.

7. Cookies and browser storage

Optional analytics, advertising pixels, and session replay are disabled in the GlossRed application and public marketing website. We do not load PostHog, Meta Pixel, Firebase Analytics, Google Analytics, or CookieYes. This applies to all visitors, including those using Global Privacy Control or Do Not Track.

• Necessary and security. The application uses Supabase session storage, booking consent records, form protection, limited workflow state, and a random first-party trial-device token for login, requested services, security, and abuse prevention.
• Preferences. The public website remembers your chosen appearance in local storage. The application also remembers selected-workspace preferences. These preferences are not used for advertising or visitor analytics.
• Hosting and security. Our providers still process connection information and operational or security logs to deliver and protect the Service.

There is no optional-tracking consent banner because these integrations have been removed. You can clear saved preferences or block browser storage through your browser settings. Blocking necessary storage may prevent login, security, or booking features from working. We will update this Policy and provide required privacy choices before introducing optional tracking again.

The public website attempts to remove its known retired analytics and advertising identifiers from browser storage. This cannot clear another provider's cookies or erase data already held by a provider. PostHog, Meta, and CookieYes may retain information from before removal. Contact hello@glossred.com to ask about that information or exercise an applicable access, deletion, objection, or withdrawal right. See Section 8 for retention and Section 10 for your rights.

8. Retention

We keep personal information only as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, preserve appointment and business history, maintain security, resolve disputes, prevent repeated trial abuse, enforce agreements, and comply with tax, accounting, payment, insurance, and legal obligations. We consider the data’s nature, sensitivity, volume, context, risk, purpose, and applicable requirements.

• Account and workspace records are generally retained while the account or business relationship remains active.
• Appointment, money, review, event, and audit history may remain after cancellation or account deletion when another user or Shop is independently responsible for the shared record or when retention is needed for a documented dispute, business-record, fraud-prevention, or legal-compliance purpose.
• Production waitlist entries and workspace-membership records are designed to be deleted when the associated account is deleted. They may otherwise remain while the account or relevant business relationship is active.
• Stripe subscription, checkout, payment-event, tax, accounting, and dispute evidence may be kept for financial, contractual, fraud-prevention, or legal-retention needs.
• Private calendar feeds currently expire after 90 days and may be revoked earlier. A calendar provider or downloaded copy may persist outside GlossRed after expiry or revocation.
• An expired or revoked feed’s protected token hash, label, and lifecycle metadata may remain as an account, security, or audit record even after the URL stops returning appointments.
• Operational email queue data is designed to be purged on a bounded schedule after delivery, terminal failure, or an undelivered-pending period. Security and operational telemetry, if collected, is designed for bounded operational retention.
• Keyed trial-abuse equality signals may remain after account deletion for as long as reasonably necessary to enforce one-trial rules, investigate abuse, resolve disputes, and protect the Service.
• Privacy-request and administrative evidence may remain after identifying prose is removed when needed to document our response, preserve security, or comply with law.
• Deleted information may remain in provider backups, if applicable, until those backups expire or are overwritten under provider-controlled cycles. Timing and handling depend on the relevant provider and configuration.

When retention is no longer justified, we delete, aggregate, or deidentify the information. A deletion request is reviewed and does not automatically destroy records belonging to another user or Shop. Some shared, fraud-prevention, financial, audit, or legally required records may be restricted, detached from the account, or retained instead of immediately erased.

Before deletion can be completed, a user may need to transfer Shop ownership, resolve future Professional appointments, and cancel or reconcile a paid subscription. When an approved deletion is processed, authored review or response text and author identity are designed to be removed; a rating, verification signal, or Shop-controlled shared-business record may remain after direct account links are removed or identifiers are minimized. A Shop may still be able to associate a retained business record with an appointment or client.

9. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These include encrypted network connections, managed authentication, row-level access controls, least-privilege service credentials, signed Stripe events, restricted and logged administrative access, dependency and secret scanning, and security-advisory review.

No system can guarantee absolute security. Use a strong, unique password, protect your devices and email account, keep private calendar-feed URLs secret, and notify us promptly of suspected unauthorized activity. Do not send passwords, full card details, or highly sensitive information by email or support message. We provide breach notice as required by applicable law.

10. Your choices and rights

Depending on your account, location, and applicable law, you may be able to:

• Review and correct available profile, contact, service, availability, and workspace information in settings.
• Manage in-app and available communication preferences and opt out of product or marketing email if offered while still receiving necessary transactional, account, or security notices.
• Download the account or business information included in GlossRed’s available portable-export tools. These tools do not necessarily contain every retained system, security, billing, audit, or shared-business record.
• Request access to or knowledge of, correction of, deletion of, or a portable copy of personal information.
• Opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive information; object to or restrict certain processing; or withdraw consent, where applicable.
• Appeal a denied privacy request and use an authorized agent where applicable law provides those rights.

Optional tracking is disabled for all visitors. Signed-in users may use the GlossRed Privacy Center for available export and deletion actions. You may also email hello@glossred.com. To appeal a decision, reply to our decision or email us with “Privacy appeal” in the subject line.

We may verify your identity, authority, state of residence, and request details before fulfilling a request. An authorized agent may need to provide proof of authorization, and we may seek direct identity confirmation. We use request information to verify, respond, prevent fraud, and preserve required compliance evidence. We do not require identity verification or account creation for a browser-based sale, sharing, or targeted-advertising opt-out, although we may request limited information needed to apply a non-browser request. We will not unlawfully discriminate against you for exercising a right.

11. Regional privacy rights

United States

Depending on where you live and subject to applicable law and exceptions, you may have the rights described in Section 10. We may decline or limit a request when an exception applies, including to protect another person’s rights, preserve security, complete a transaction, maintain required records, prevent fraud, or comply with law. We will explain the basis and any available appeal process when required.

Advertising, sale, and sharing notice

We do not sell personal information for money. The public marketing website previously used PostHog analytics and Meta Pixel. Those integrations were removed on October 19, 2026. Earlier disclosures of identifiers and internet or network activity to Meta for advertising measurement, audiences, or targeted advertising may constitute a sale or sharing under applicable law. Removing the integrations does not erase previously collected information. Contact us to request access, deletion, an opt-out relating to historical data, or another applicable privacy right; you do not need an account to make a request. We do not knowingly sell or share the personal information of anyone under 16, and we do not use sensitive personal information to infer characteristics for advertising.

European Economic Area, United Kingdom, and Switzerland

Where applicable, you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, as well as the right to complain to your local data-protection authority. You may contact us first so we can try to address the concern.

12. International transfers

GlossRed is operated from the United States. Personal information may be processed in the United States and other countries where our providers operate. Those countries may have different privacy laws from your place of residence.

Where transfer restrictions apply, GlossRed and its providers must use a transfer mechanism or safeguard required by applicable law. Depending on the provider and transfer, this may include an adequacy decision, approved contractual clauses, or another lawful mechanism. Contact us for information about safeguards relevant to your information. This statement does not claim that GlossRed is certified under a particular privacy framework.

13. Children and minors

You must be at least 18 years old to create a GlossRed account or book as a guest. The Service is not directed to children, and minors may not create Personal, Professional, or Owner/Shop accounts or submit guest bookings. The current Service does not provide a designated proxy or minor-booking workflow. Do not create an account for a minor or submit a minor’s personal information through an adult account or guest booking.

We do not knowingly collect personal information directly from a child under 13, permit child accounts or guest bookings, or knowingly sell or share the personal information of anyone under 16. If you believe a minor created an account or provided information in violation of this section, contact us so we can investigate and take appropriate action, including deletion where appropriate.

14. Third-party links and services

GlossRed may link to or interoperate with services operated by Professionals, Shops, Google, Stripe, Meta, calendar providers, social networks, or other third parties. Their independent privacy practices are governed by their own notices. Review those notices before providing information directly to them.

A third party’s independent policy does not reduce GlossRed’s responsibility for personal information we process under applicable law.

15. Changes to this Policy

We may update this Privacy Policy as the Service, providers, or laws change. We will post the revised Policy, update its version and date, and maintain it at the canonical GlossRed privacy URL. If a change is material, we will provide additional notice through the Service, by email, or by another reasonable method before it takes effect when required. Consent-dependent processing will not be expanded without any choice required by law. We will not apply a material change to previously collected personal information in a materially incompatible manner without advance notice and consent when applicable law requires it.

16. Contact us

Questions, concerns, Nevada verified do-not-sell requests, and other privacy requests may be submitted through the signed-in Privacy Center where available or sent to: