Privacy notice

What this notice covers

Zylo is a booking marketplace for UK salons and spas. This notice explains what this build of Zylo stores when you create an account or book an appointment, and what it does not.

Who we are

Zylo introduces customers and businesses. The business you book with provides the service, and it also keeps its own record of your booking.

Zylo is the trading name used in this notice. Any registered company details appear in the footer of this site, and only when they have been configured.

Account data

If you create an account, we store your name, your email address and a hash of your password. The password itself is never stored, and we cannot read it.

Signing in also creates a session token in your browser. That token is described on the cookies page.

Booking data

When you book, we store the details needed to hold and manage the appointment:

• your name and email address, plus an optional phone number;
• the service, the date and time, and the business providing it;
• any notes you choose to add, which the business can read.

Payments

Card payments are handled by Stripe. Your card details go to Stripe and are never sent to Zylo, which means Zylo does not store card numbers or security codes.

We keep a record of the payment and its status, so a booking can be shown as paid, refunded or unpaid.

Cookies and browser storage

This build uses three items of strictly necessary storage: a locale preference cookie, a session token and a list of bookings made in this browser. They are set out in full on the cookies page.

Retention

Account and booking records are kept for as long as your account is open, and after that for as long as they are needed to run bookings and to meet legal and accounting obligations.

The exact retention periods for this build are still being settled. This notice will state them before the site goes live.

Your rights

You can ask for a copy of the data held about you, ask for it to be corrected, or ask for it to be deleted. You can also object to some uses of it.

A privacy contact address is not configured in this build. It will be published here before launch, and it is the right place to send those requests.

If you booked a service, the business also holds its own copy of the booking, so a request to that business may be needed as well.

Changes

When this notice changes, the new version is published on this page with a new last updated date.