1. Who we are

Arctic Studios ("we", "us") operates this platform, which connects customers with independent beauty and aesthetics studios and practitioners. For the personal data described here, Arctic Studios is the data controller. The studio you book with is a separate, independent controller of the booking and health information you give them.

Questions or requests: hello@arcticstudios.uk.

2. Data we collect

Account & profile: name, email, phone, date of birth, password, and any photo or bio you add.

Booking & treatment: the studio, treatment, date, notes, and health information you provide on intake/consent forms (e.g. allergies, medical history).

Payments: handled by our payment processor; we store order records and status, not your full card number.

Shop & orders: products ordered, delivery address, order history.

Verification: for practitioners/studios, qualification and identity documents.

Social & content: posts, comments, messages, and media you upload.

Technical: device/usage data, and, only with your permission, camera, microphone and location (for calls and the map).

3. Special-category (health) data, Article 9

Health information on intake and consent forms is "special-category" data under UK GDPR Article 9. We process it only on the basis of your explicit consent, which you give on each form, and use it solely for your treatment, safety and records. You can withdraw consent at any time by contacting the studio or us.

4. Our lawful bases

Contract, to provide the app, bookings and orders you request.

Consent, for health data (Art.9 explicit consent), marketing, and device permissions.

Legitimate interests, to run, secure and improve the platform and prevent fraud/abuse.

Legal obligation, to meet tax, safety and law-enforcement requirements.

5. Artificial intelligence and automated processing

We use AI (large language models supplied by Anthropic) in four places, and a human is always able to review the outcome.

Verification: qualification certificates, licences, insurance policies and identity documents you upload are read by AI to extract the details and check for signs of tampering. Insurance policies and injectable treatments are always reviewed by a person. Other documents are approved automatically only where the AI is highly confident and finds no problems; anything else goes to a person.

Photo and video safety: profile photos, posts, stories and images sent in messages are checked against our prohibited-content rules before or shortly after they appear.

Social posts: captions and images on the public feed are screened. The most serious categories are removed automatically. All other outcomes are a report for a person to decide, and no account is ever suspended or banned by AI.

Support: when you message support you may receive an AI-written acknowledgement. A person then replies.

Your right to a human decision: where an automated check affects you (for example a qualification not being approved), you can ask us to have a person review it. Email hello@arcticstudios.uk and we will re-check it ourselves.

Your documents and images are sent to Anthropic solely to perform these checks on our instructions, under a data-processing agreement, and are not used to train their models.

6. Who we share it with

The studio/practitioner you book with (so they can provide your treatment).

Our processors, who act on our instructions: Supabase (database & auth hosting, EU), Anthropic (AI checks described in section 5, US), our payment processor, Google (maps), Slack (our internal review desk) and our calling provider. We put data-processing terms in place with each.

Authorities or advisors where we are legally required to, or to protect our rights.

We never sell your personal data.

7. International transfers

We aim to keep data in the UK/EEA. Where a processor operates outside it, we rely on UK adequacy or standard contractual clauses to protect your data.

8. How long we keep it

We keep your data while your account is active and for as long as needed for the purposes above and to meet legal/accounting duties. Treatment and consent records may be retained for the period required for insurance and healthcare-record purposes. When no longer needed, we delete or anonymise it.

9. Your rights

You can access, correct, port, restrict, object to, or erase your data, and withdraw consent. Delete your account any time in Settings → it removes your account data. To make a Subject Access Request, use Settings/Documents or email us.

You can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

10. Cookies and storage on your device

We do not set cookies of our own. We use your browser local storage and session storage instead, which the law treats in the same way as cookies. Strictly necessary storage keeps you signed in, holds your basket and remembers interface preferences such as theme and language, and is always in use. Everything else starts switched off and is used only if you turn it on.

There are three categories: Strictly necessary, Analytics and Marketing. Analytics and Marketing default to off, not answering the banner is never treated as agreement, and you can change or withdraw your choice at any time.

If your browser sends a Global Privacy Control signal, we detect it and honour it as a standing opt-out, so Analytics and Marketing stay switched off unless you deliberately choose otherwise.

We currently use no third-party analytics service and no advertising or tracking tags. If that ever changes, we will name the provider here and in our Cookies and Storage Policy before it is switched on. The full list of what is stored is in that policy.

11. Children

The app is for users aged 16 and over, and we follow the ICO Children’s Code. Certain treatments are strictly 18+ and are age-verified at booking.

We ask for your date of birth when you create an account. We use it to apply age-appropriate settings and safety limits, and to check eligibility for age-restricted treatments. We do not show your date of birth to other members: where an age is displayed, only the age is shown. For members aged 16 and 17 we apply higher privacy settings by default, keep them out of the social side and out of social search, limit their conversations to text and voice notes, and never show their current workplace to the general membership.

12. Security, diagnostics and abuse prevention

We protect data with encryption in transit, access controls and row-level security. No system is perfectly secure, but we work to keep your data safe and will notify you and the ICO of a qualifying breach as required.

Sign-in protection: to limit password guessing and to stop our sign-up and password-reset forms being used to send unwanted email, we briefly record attempts made through those forms. Each record holds a one-way hash of the email address rather than the address itself, the IP address, which form it was, and whether it failed or was blocked. These records are deleted automatically after 24 hours, and any block lifts by itself.

Bot protection: the app includes a Cloudflare Turnstile check for the sign-up and password-reset forms. It is not currently switched on. If it is enabled, a verification token and your IP address will be sent to Cloudflare to confirm the submission is not automated, and we will update this policy.

Abuse prevention: we record the IP address of signed-in sessions so that fraud and misuse can be investigated, and we check a device IP address against free trials already claimed so the same device cannot take repeated trials under new addresses. A shared IP can produce a false match, so this is only ever a supporting signal.

Diagnostics: when the app crashes we record the error, where it came from and the type of page you were on, so it can be fixed. Personal data is stripped out in your browser before the report is sent, so addresses, phone numbers, postcodes, card-shaped numbers, record identifiers and access tokens are replaced with placeholders. Where you were signed in, the report is linked to your account so we can tell whether a fault affected one person or everybody.

13. Marketing messages and campaign measurement

Marketing emails and marketing text messages each need their own separate opt-in, and both are off unless you turn them on. We record when and where you gave that permission.

Every marketing email carries an unsubscribe link, and your mail app's own unsubscribe button works too. It takes effect without needing you to sign in. By default it stops marketing emails; stopping marketing texts as well is offered as a separate, deliberate step.

Unsubscribing stops marketing only. You will still receive service messages about a booking you have made, such as confirmations, reminders, changes and cancellations, because stopping those would mean missing an appointment you have paid for.

Campaign measurement: only if you turn on the Marketing category, we record which advertising campaign brought you to us. We keep the campaign labels in the link you arrived through, a single advertising click identifier where present, the host name of the referring site but never the full referring address, and the landing page path with any query string discarded. It is attached to your account only when you create an account, make a booking or complete business onboarding. It is not used to track you across other websites and is never sent back to an advertising network.

14. Changes & contact

We may update this policy; we’ll post the new version here with a revised date. Contact us any time at hello@arcticstudios.uk.