We are the data controller of the personal information you give us to create and manage your account, billing, and use of the Services, and this notice applies to it.

When you book with, or are added as a client by, a business, that business is the data controller of your client records (bookings, contact details, notes, allergies, patch tests, consent and payment records). Records are associated with the business or freelancer who created them. We process that data only on the business's documented instructions, as its processor. Questions about how a business uses your data, and requests to access, correct or delete your client record, should go to that business first. If you contact us, we will pass your request on to the relevant business where we are able to.

Self-employed freelancers on Glas have their own client relationships, and may work through more than one host business. A freelancer is the controller of the client relationships and records they hold in their own right. A host business is the controller of the client records it holds for its own business, and may be a separate controller from the freelancer for bookings made through it. In each case we act as the processor for whichever of them holds the record, and your booking details are shared between a freelancer and a host business only as needed to provide your booking. Your booking confirmation or the business's page shows who you are booking with, and you can ask them which of them holds your data.

If you are a business using Glas, our Data Processing Agreement sets out our duties as your processor. Contact support@glasapp.co.uk to request a copy.

We collect personal information you voluntarily provide when you register, express interest in our products, participate in activities on the Services, or contact us.

Businesses using Glas can record information about their clients such as allergies and patch test results, and may add free-text notes that include health details. This is special category data. We store it on the business's behalf and do not use it for our own purposes. Businesses are responsible for having a lawful basis and, where required, explicit consent before recording it.

Businesses can record bank details for their staff (account holder name, bank name, sort code and account number), for example to pay them. We store the sort code and account number encrypted, on the business's behalf, and do not use them for our own purposes.

We do not store full card numbers or security codes. Card payments are handled by our payment providers, and businesses can connect Stripe, Square or SumUp to take payments. Those providers act under their own privacy policies. We keep records of transactions (amounts, dates, status and provider references).

Businesses and freelancers who receive payouts through Stripe Connect complete identity and bank verification with Stripe (which may include ID documents, date of birth and bank details). Stripe collects and holds that information as a controller under its own privacy policy. We store only the connected account ID, its verification status and onboarding completion date, the payout country and currency, the account holder name and the account type (individual or company).

We receive information about you from businesses that add you as a client or create a booking for you, from payment providers (for example payment confirmation), and from Google when you use address search.

We use Sentry to collect error and diagnostic reports (such as device and browser details and the page where an error occurred) so that we can fix bugs. We use automated filtering to redact email addresses, phone numbers, form answers, notes and other contact or health fields, and URL query strings, from these reports before they leave our systems. This filtering cannot catch every piece of personal information, such as a name typed into free text.

When a business imports client, staff, service or appointment data from a CSV file, we use an AI service (Anthropic) to match the file's column headings to our fields. The column headings and the first few rows of the file are sent for this purpose, and those rows can include client names and contact details. Anthropic processes this on our behalf and we do not use it for any other purpose.

We use Google Maps Platform (address search, geocoding and map display). Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Under the UK GDPR, we rely on the following legal bases:

You can withdraw your consent at any time by contacting us.

To provide the Services you have asked for, such as running your business account or making a booking.

For client health information, the controlling business is responsible for its lawful basis and for the condition under Article 9 UK GDPR (usually the client's explicit consent).

Where necessary for compliance with our legal obligations — e.g. cooperating with law enforcement or defending legal rights.

Where necessary to protect your vital interests or those of a third party.

We may share your information in connection with any merger, sale, financing, or acquisition of all or part of our business.

Your booking and client information is shared with the business (and the freelancer or staff member) you book with.

We use the following providers to run the Services:

We require these providers to protect your data and use it only to provide their service to us.

Several providers listed above, including Render, Stripe, Square, SumUp, Brevo, Cloudinary, Sentry, Anthropic, Google and Meta, may process data in the United States or other countries outside the UK/EEA. Where they do, we rely on a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Addendum / Standard Contractual Clauses, together with additional safeguards where appropriate. Contact us for more information.

On our website, we use cookies and similar technologies (such as local storage) to maintain security, fix bugs, save preferences, and keep you logged in. These are strictly necessary for the Services to work, so under PECR they do not need your consent. We do not use advertising or analytics cookies. Third-party services we embed (for example Google Maps) may set their own cookies. On the website you can block cookies in your browser settings, but parts of the Services may stop working. In our mobile app the equivalent data is stored on your device and can be cleared by signing out or uninstalling the app.

We retain business account data for as long as the account is active, and financial and transaction records for as long as the law requires (currently up to six years for tax and accounting purposes). Client records are kept for as long as the business that controls them keeps them in Glas. If a business closes its account, or asks us to delete a client record, we will delete or anonymise the affected records on request, subject to any legal retention duty. When we no longer need your information, we will delete or anonymise it. If deletion is not immediately possible (e.g. backup archives), we will securely isolate it until deletion is possible.

We have implemented appropriate technical and organisational security measures. However, no electronic transmission over the internet can be guaranteed 100% secure. You should only access the Services within a secure environment.

You must be at least 18 years old to use the Services. If we learn we have collected data from a child under 18 without a parent or guardian's authority, we will deactivate the account and delete the data. A business may record details of a minor client only as part of a booking made by their parent or guardian, and is responsible for doing so lawfully. Contact us at support@glasapp.co.uk if you have concerns.

These rights apply to us for the data we control (business account holders). For your client records held by a business or freelancer, send your request to them first; we can only act on it on their instructions, and will forward requests we receive. Your rights may include:

We respond to rights requests within one month. We may extend this by up to two further months for complex or numerous requests, and will tell you if so. If we need to confirm your identity or ask you to clarify your request, the time limit is paused until we have what we need. We may ask for proof of identity to protect your data.

If you are unhappy with how we have handled your personal data, please complain to us first at support@glasapp.co.uk, or by post at the address below, marking it "Data protection complaint". We will acknowledge your complaint within 30 days, investigate it without undue delay, and tell you the outcome. If your complaint is about how a business or freelancer handles your client record, we will pass it to them as the controller and tell you we have done so.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. You do not have to complain to us before contacting the ICO.

Click the unsubscribe link in any marketing email, or contact us directly. You may still receive service-related messages necessary for your account.

You can review or update your account at any time via your account settings. To request account deletion, contact us — we may retain some information as required by law.

For privacy rights enquiries: support@glasapp.co.uk

We do not currently respond to DNT browser signals, as no uniform technology standard has been finalised. If such a standard is adopted in the future, we will update this notice.

We may update this Privacy Notice from time to time. Material changes will be communicated via a prominent notice or direct notification. We encourage you to review this notice regularly.

Email: support@glasapp.co.uk

Post: Glasapp, 2 Breaksea Close, Sully, Wales, UK

We are the data controller of business account holders' personal information. For clients' data held on behalf of a business, we act as processor and that business is the controller (see "Who Is Responsible for Your Data?").

You may have the right to request access to, correction of, or deletion of your personal information, subject to applicable law. To submit a data subject access request, or to withdraw consent, contact us at support@glasapp.co.uk.