Privacy Policy

1. Information We Collect

We collect the following information.

• Information you give us: your name, email address, a way to contact you (phone number, Instagram or Facebook link) and, if you choose to give it, your date of birth (it is required only if you create your account through the business's registration link); your booking details (service, date and time, the address for a mobile appointment, and any notes); your preferred language and contact method; and any review you write (the name on your profile — your email address if you have not set a name — the service you booked, your rating and your comments; reviews are published on the website as soon as you submit them). The business also keeps notes about your appointments.
• Information we keep to make booking easier: up to five of your most recent booking addresses, the offers you have used, and your email, birthday-email and reminder preferences. If you ask to change a birthday you have already given, we also keep a record of the request and the decision.
• When you sign in with Google: your email address, whether Google has verified it, and your name. We do not store your Google profile picture or your Google Account ID. See "3. Google Account Data" below.
• When you sign in with Terranimus or with an email address and password: your email address and, for a password, only a salted one-way hash of it — never the password itself.
• When you use the AI booking assistant: what you type or dictate, plus the details described in "5. AI Booking Assistant".
• Technical information: our hosting and network providers record your IP address and the web address of each page requested in server logs (for the link in a birthday email, that address includes your birthday); our own application also logs some sign-in events, such as your email address when you sign in with Terranimus; and the website stores a sign-in token and some preferences in your browser (see "10. Cookies and Local Storage").

2. How We Use Your Information

We use your information to create and secure your account; schedule and manage your appointments; send booking emails and Google Calendar invitations (see "3. Google Account Data" and "4. Emails and Offers"); send you birthday emails and offers (unless you switch them off); work out which offers you qualify for (using your date of birth, booking history and whether you have written a review); respond to messages you send us by email, Instagram or Facebook; run the optional AI booking assistant; keep the website secure and prevent misuse; and meet our legal obligations. We do not sell your personal information, and we do not use it for third-party advertising.

3. Google Account Data

Makeup by Vi uses Google in two separate ways. Customers are never asked to connect their own Gmail, Google Calendar or Google Drive to this website.

Signing in with Google (customers). If you choose "Continue with Google", Google gives this website a signed sign-in token for your Google Account, using only the standard sign-in permissions (openid, email and profile). From that token we read your email address, whether Google has verified it, and your name, and we use them to find or create your account and customer record so that you can sign in and book. The token can contain other profile details, such as your profile picture; we do not store or use them, and we do not store your Google Account ID. Signing in with Google gives us no access to your Gmail, Google Calendar, Google Drive or contacts, and we never receive a Google access token or refresh token for you.

The business's own Google account. The business owner connects Makeup by Vi's own Google account to this website from a private administrator screen, and can reconnect or disconnect it there at any time. For that one account the website requests three permissions (scopes):

• https://www.googleapis.com/auth/calendar.events — (1) when a booking is requested and Google is connected, we place a placeholder event on the business's Google Calendar so that the time is not offered to anyone else; it is titled with the service and your name and contains the service, your name and, if you gave them, your phone number and notes, and nobody is invited, so Google sends you nothing at this stage; (2) when the business owner approves the booking, the same event becomes a calendar invitation: we add a Google Meet link and your booking email address as a guest, so that Google sends you the invitation, and the event also contains your appointment address if you gave one; (3) we read the events on the business's Google Calendar so that customers are not offered times when the business owner is busy (see below). If the booking is moved, declined or cancelled we update or delete that same event. The website only updates or deletes events whose IDs it stored when it created them.
• https://www.googleapis.com/auth/gmail.send — to send the emails described in "4. Emails and Offers" from the business's Gmail address. This permission can only send email: it cannot read, list or delete anything in the mailbox. If the business has set up regular (SMTP) email settings instead, the website sends through those and this permission is not used.
• https://www.googleapis.com/auth/drive.file — to save a one-page PDF receipt for a booking in the business's Google Drive and attach it to your calendar invitation. The receipt shows your name, the service, date, time, address (if any) and price. It is shared by a link that anyone who has the link can open; it is not listed or searchable. This permission lets the website see only the files it created itself.

We do not read, search, list or download the mailbox, or any Drive files other than those this website created. The website does read the events on the business's Google Calendar (the primary calendar, plus any other calendar the business owner adds in the administrator settings) every few minutes, only to learn when the business owner is busy so that customers are not offered those times. Google sends each event with its details, which can include a description, location and guests; the website keeps only the event's title, start and end time, whether it lasts all day, and Google's identifiers and link for it, in its database. The title can be seen only by the business owner and administrators; customers are shown only that the time is unavailable. We do not use these events for anything else. The other information we read back from Google is the identifiers and links of the events and files this website creates (including the Google Meet link), the email address of the connected Google account, the names of the calendars it reads, and the tokens needed to keep the connection working.

Storage. From Google sign-in we keep your email address, name and language in your account and customer records in our database. From the business's Google connection we keep the authorisation token (a "refresh token") and the OAuth client ID and secret in the website's database on our hosting provider's servers, and, for each booking, the Google Calendar event ID and Meet link, and a copy of the business's calendar events described above. The website also keeps a copy of each email it sends (recipient, subject and message) in a file on the server.

Keeping and deleting it. We do not delete this information automatically on a schedule; we keep it until it is deleted as described in "8. How Long We Keep Your Data and Deleting It". When a booking is declined or cancelled in our system we delete its calendar event; if it had already been sent as an invitation, Google notifies the guest. The copy of an event from the business's calendar is deleted when that event is deleted from Google Calendar. Receipts are not deleted automatically: they stay in the business's Google Drive, open to anyone with the link, until the business owner deletes them. The business owner can disconnect the Google account at any time in the administrator settings, which erases the stored authorisation token, the OAuth client ID and secret and the copies of calendar events from our database; disconnecting there does not itself remove the permission on Google's side, so the owner should also remove the website's access at https://myaccount.google.com/permissions. If you signed in with Google, you can remove this website's sign-in access at the same address; that does not delete the records we hold, which you can ask us to delete.

Sharing and protection. We do not sell Google user data and we do not use it for third-party advertising. We use your email address and name to send you our own booking, birthday and (unless you switch them off) promotional emails (see "4. Emails and Offers"). We share Google user data only to run the website: with Google itself (to deliver the calendar invitation and emails) and with our hosting, database and network providers. We do not transfer Google user data to anyone else, except where needed for security, to comply with the law, or with your consent. The business owner and staff who need your name, email address and booking details to run your appointment can see them in the website's admin screens; we do not otherwise read Google user data unless you ask us to (for example in a support request), it is needed to investigate abuse or a security problem, or the law requires it. We do not ourselves use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models. We use the safeguards described in "7. How We Protect Your Data".

Makeup by Vi's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. Makeup by Vi does not use information received from Google Workspace APIs (Gmail, Google Calendar, Google Drive) or from Google sign-in to develop, improve or train non-personalized (generalized) AI and/or ML models, and does not transfer it to third-party AI tools for that purpose. See https://developers.google.com/terms/api-services-user-data-policy

4. Emails and Offers

We send you the following emails.

• Booking emails: "booking received", "booking confirmed" and "booking not accepted" messages for your appointments. A copy of a "booking received" notice also goes to the business mailbox and, if the owner has switched it on, to the administrators. The "booking confirmed" email may also invite you to leave a review in return for a discount, if one is being offered.
• A Google Calendar invitation: when the business owner approves your booking and Google is connected, Google emails you a calendar invitation (see "3. Google Account Data").
• Birthday emails: if you have given us your date of birth, we automatically send you a birthday email with an offer. The booking link in that email includes your date of birth and language so that the booking assistant can suggest days around your birthday without asking again; the request logs of our hosting and network providers may therefore contain it.
• Promotional emails: offers or messages that the business owner chooses to send to customers.

Birthday and promotional emails are on by default for customers who give us their email address. Promotional emails include an unsubscribe link, and you can also switch them off in your profile. To stop the automatic birthday email, email contact.viishere@gmail.com and we will turn it off for you (the promotional-email switch in your profile does not cover it).

5. AI Booking Assistant

The website has an optional AI booking assistant. When you use it, what you type or dictate, and details it looks up to help you — such as your bookings, available times and offers, and dates around your birthday if you ask about a birthday offer or open the birthday booking link from one of our emails — are sent to an AI service provider (DeepSeek, api.deepseek.com) so that it can reply. Your email address is not included. Dictation uses your browser's built-in speech recognition, which in browsers such as Chrome sends your audio to the browser maker's speech service; we receive only the text. The AI provider is based in China, states that it stores information there and may use inputs to improve its services, and handles information under its own terms. This website does not store the conversation beyond your browser session. Please do not type sensitive information such as payment card or health details. You can book without using the assistant.

6. Sharing Your Information

We do not sell or rent your personal information. We share it with the following, as needed to run the website and your appointments:

• Google — sign-in, if you choose it; the placeholder and invitation events for your booking on the business's Google Calendar; delivery of your Google Calendar invitation and booking emails; storage of receipts (see "3. Google Account Data"); and Google Fonts, which loads in your browser (Google Maps address search is used only on the business owner's own admin screens).
• Our hosting and database provider (Spaceship) and our network and security provider (Cloudflare), which process your requests and keep logs that include your IP address.
• The AI service that powers the optional booking assistant (see "5. AI Booking Assistant").
• OpenStreetMap (Nominatim), whose address-search service receives the address text you type into the booking form's address box as you type, and the address you choose when we work out the travel distance.
• Terranimus, if you choose to sign in with it.

Photos of completed work may be shown publicly on this website and on Instagram or other social channels; you can ask us not to share photos of your work by telling us before your appointment. Reviews you write are published on the website. We may also disclose information where the law requires it or to protect safety and security. These providers handle your information under their own terms and privacy policies, and we cannot control how they use it. Some process information outside Australia: for example, the AI provider (DeepSeek) states that it stores data in the People's Republic of China and may use inputs to improve its services.

7. How We Protect Your Data

We use these safeguards: this website is served over HTTPS (requests made over plain HTTP are redirected to HTTPS); passwords are stored only as salted one-way hashes; sign-in tokens are cryptographically signed; and our database is protected by network access controls at our hosting provider. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you as the law requires.

8. How Long We Keep Your Data and Deleting It

We do not currently delete information automatically after a set period. We keep your account, customer and booking records, reviews, and the copies of emails that the website sends, until they are deleted. To ask us to delete your account and personal information, email contact.viishere@gmail.com. We will respond within 30 days and delete what we can; some items (your account record, birthday-change history, calendar events, receipts and email copies) are removed manually by the business owner. We cannot delete copies held by others — for example your own copy of a calendar invitation or email, server logs kept by our hosting and network providers, or information held by the AI service provider — and we may keep information that the law requires us to keep.

9. Your Rights

You can ask us to show you the personal information we hold about you, correct it, or delete it, by contacting us using the details below; you can also update most of your details in your profile (a change to a date of birth you have already given needs the business owner's approval). We will respond within 30 days. If you are not satisfied with how we have handled your information, you may contact the Office of the Australian Information Commissioner (https://www.oaic.gov.au).

10. Cookies and Local Storage

This website does not set a sign-in cookie and does not use advertising or analytics cookies. Instead it stores data in your browser: a sign-in token (kept until you log out), a cached copy of your profile and some site data to speed up pages, your language choice, and, for the AI assistant, the current conversation (for the browser session only). During "Continue with Terranimus" sign-in the website sets one short-lived cookie (10 minutes) to complete the sign-in securely. Services loaded from other companies — Google (the sign-in button on the sign-in page, and Google Fonts) — may set their own cookies or identifiers under their own policies. Our network provider (Cloudflare) and OpenStreetMap (address search) also receive your requests.

11. Children's Privacy

Our services are intended for adults. If an appointment is for someone under 18, we ask that a parent or guardian make the booking. We do not knowingly collect personal information directly from children under 13; if you believe a child has given us personal information, contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent version.

13. Contact Us

Makeup by Vi, Building 5, 38 Kitchener Parade, Bankstown NSW 2200, Australia. For questions about this policy, or to see, correct or delete your information, email contact.viishere@gmail.com or message us on Instagram @makeup.byvi.