Privacy Policy

LuxeFlow.beauty is a product of LuxePulse Limited, a Nigerian technology company registered with the Corporate Affairs Commission (RC 9632158). In this policy, "LuxeFlow", "we", "us", and "our" mean LuxePulse Limited operating the LuxeFlow.beauty platform: software-as-a-service for beauty and wellness studios. We process two distinct categories of personal data: • Studio data: information about the studios that subscribe to LuxeFlow (owner email, business name, contact details, billing information). • End-customer data: information about the clients booking services with those studios (name, contact, booking history, payment records). Studios are the controllers of this data; LuxeFlow is the processor acting on their behalf. This Privacy Policy explains what we collect, why, and your rights. Each studio publishes its own customer-facing privacy notice on its tenant subdomain or custom domain.

Account information: name, email, phone number, business name, business address, subdomain, password (hashed), Paystack identifiers. Billing information: subscription tier, invoice records, transaction references. Card details are processed by Paystack and are never stored on our systems. End-customer information (on behalf of studios): client name, contact, booking and visit history, photographs uploaded by the studio, service ratings, payment records. Technical information: IP address, browser type, device identifiers, pages visited, time stamps, error logs. Used for security, fraud prevention, and platform improvement. Communications: support tickets, email correspondence, complaint records.

• Provide the LuxeFlow platform: hosting your studio's data, running your booking flow, sending booking confirmations, processing payments. • Bill you for the subscription and collect payment via Paystack. • Send service-related notifications (account changes, billing receipts, security alerts, support replies). These are not marketing. • Improve the platform: aggregated, de-identified usage analytics to find bugs and prioritise features. • Comply with legal obligations (tax records, court orders, anti-fraud). We do not sell your data. We do not sell your end-customers' data.

LuxeFlow offers tiers with different infrastructure models. Where your data is stored depends on which tier your studio is on. • Starter: your studio's data is stored on the LuxeFlow shared database, isolated from other studios via row-level security. Emails are sent through the LuxeFlow Resend account. • Pro: your studio's data is stored on the LuxeFlow shared database with the same row-level isolation as Starter. Emails are sent through the LuxeFlow Resend account. Pro unlocks expanded feature limits and capabilities. • Enterprise: same infrastructure as Starter and Pro, plus your own custom domain. LuxeFlow manages all hosting and email on your behalf. In all cases, primary data hosting is provided by Supabase (a third-party processor); email delivery by Resend; payments by Paystack.

We share personal data only with third-party service providers necessary to run the platform. These are bound by contractual confidentiality and data protection obligations. Current processors: • Supabase: database and file storage • Resend: transactional email delivery • Paystack: payment processing (PCI-DSS compliant) • Vercel: application hosting and CDN • Cloudflare: DNS, DDoS protection, edge caching We do not share data with third parties for their own marketing. We may disclose data when compelled by law, court order, or to investigate fraud or terms violations. International transfers: our infrastructure providers (Supabase, Resend, Vercel, Cloudflare) are based outside Nigeria, mainly in the United States and Europe. Your data may therefore be processed in those countries. We pick providers that meet recognised data-protection standards and that are contractually accountable for the data they handle on our behalf.

Active studio data: retained for as long as your account is active. Closed accounts: you have 30 days from cancellation to export your data. After that, account data is deleted from production systems, with up to 60 further days for routine backup expiry (so 90 days in total). Records we are legally required to keep, such as tax invoices, are retained for the period the law requires. End-customer records inside a studio: governed by the studio's own retention policy; LuxeFlow provides export and deletion tools. Audit logs and security events: 12 months minimum.

Under the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR), and similar regimes elsewhere, you have the right to: • Access the personal information we hold about you • Correct inaccurate or incomplete information • Request deletion (subject to legal retention obligations) • Restrict or object to processing • Receive your data in a portable format (CSV / JSON) • Withdraw consent at any time • Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or the regulator in your jurisdiction. To exercise any of these rights, email privacy@luxeflow.beauty. We aim to respond within 30 days.

We protect your data with industry-standard controls: TLS for all data in transit, encryption at rest for sensitive secrets (Supabase service keys, Paystack credentials), password hashing with bcrypt, HMAC-SHA512 verification of payment webhooks, rate-limiting on public endpoints, and audit logging of state-changing actions. No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and, where required, the relevant supervisory authority within 72 hours.

LuxeFlow uses strictly necessary cookies to keep you signed in and protect against CSRF. We do not use third-party advertising trackers on the marketing site. Studios may add their own analytics on their tenant site; that is governed by the studio's own privacy notice.

LuxeFlow is intended for use by adults operating a business. Studios may collect end-customer information including for minor clients receiving beauty services; in those cases, studios are responsible for obtaining parental consent in line with applicable law.

We may update this policy from time to time. Material changes are notified to active account holders by email at least 30 days before they take effect. The "Effective" date at the top of this page reflects the latest version.

LuxeFlow is a product of LuxePulse Limited (RC 9632158), Nigeria. Privacy: privacy@luxeflow.beauty General: hello@luxeflow.beauty For data-protection enquiries, please use the privacy@ address so we can route your request promptly. For the contractual side of the Service, see our Terms of Service at /terms.