Privacy Policy

1. Who we are

This app is operated by Empress Piercing Ltd (“Empress Piercing”, “we”, “us”), registered at 159 Holton Road, Barry, Wales, CF63 4HP. We are the data controller for the personal information described here. For any privacy question or to exercise your rights, contact us at privacy@empresspiercing.co.uk. Our ICO registration number is ZB269325.

2. The information we collect

Depending on how you use the app, we may collect:

• Account details: first name, surname, date of birth, email address, postcode (used to suggest your nearest Empress studio), and optionally phone number.
• Photos you upload: selfies you choose to use for the AI piercing visualisation feature.
• Activity in the app: piercing journeys you start, your credit balance, and reward redemptions.
• Messages: questions you send to the in-app AI advisor.
• Technical data: essential storage to keep you signed in, and, only if you consent, analytics about how the app is used.
• Problem reports: if you choose to report an issue with the app, we receive what you tell us plus technical information about what the app was doing at the time. This includes your app version, your device settings (such as screen size, language and accessibility options), a short record of the screens you visited and requests the app made in the minutes beforehand, and a snapshot of your account status. It does not include your photos, your messages to the AI advisor, or anything you have typed elsewhere in the app.
• Credit claims: if you tell us a visualisation did not show the piercing you chose and ask for your credit back, we receive that generated image, the piercing and jewellery you chose, the reason you pick and any note you add, so our team can check it.

3. How and why we use it

We use your information to:

• create and run your account (basis: performance of a contract);
• generate piercing visualisations and answer your questions through our AI features (basis: contract / your request);
• manage credits, membership and prize draws, including reviewing credit claims you make (basis: contract);
• send aftercare guidance and reminders for journeys you start (basis: legitimate interests, and consent where required);
• improve the app through analytics (basis: consent, which you can decline);
• investigate and fix problems you report to us, and find faults affecting other members (basis: legitimate interests, namely keeping the app working correctly for the people who use it);
• meet our legal obligations (basis: legal obligation).

4. AI features and your photos

When you use the visualisation feature, the photo you provide is sent to our AI image processor to generate an illustrative image. Depending on our configuration this is OpenAI or Google (Gemini). When you use the AI advisor, your message is sent to OpenAI to generate a reply. These processors act on our instructions and are not permitted to use your content to train their models for this type of API usage. Uploaded photos and the generated images are held by us only for as long as it takes to create and deliver your visualisation, and are automatically deleted from our systems within 24 hours. Visualisations you choose to save are stored on your own device, not by us.

The one exception is a credit claim. If you ask us to check a visualisation and return your credit, we keep that generated image with your claim until our team has reviewed it. It is deleted as soon as a decision is made, and in any case after 30 days. Your original uploaded photo is never kept for a claim.

5. Who we share it with

We use trusted service providers who process data on our behalf:

• Supabase: database and account/authentication hosting.
• Vercel: application hosting.
• OpenAI: AI visualisation and advisor processing.
• Google (Gemini): alternative AI visualisation processing, when our configuration routes image generation there.
• Fresha: if you choose to book, you are taken to our booking provider's site, governed by their own privacy policy.
• Sentry and PostHog: error monitoring and, with your consent, product analytics, so we can find faults nobody has reported.

Some of these providers process data outside the UK. Where they do, appropriate safeguards (such as UK/EU standard contractual clauses) are in place. We do not sell your personal data.

6. How long we keep it

We keep your account information for as long as your account is active. If you delete your account (see your profile in the app), we remove your profile, journeys and redemption history, and delete your login. Some records may be retained briefly where we are legally required to.

Problem reports you send us are kept for 90 days and are then deleted automatically. If you delete your account before then, any reports linked to it are deleted at the same time.

Credit claims are kept for 90 days and are then deleted automatically (the image in a claim goes much sooner, as described in section 4). If you delete your account before then, your claims are deleted at the same time.

7. Your rights

Under UK data protection law you have the right to:

• access a copy of your data;
• correct inaccurate data (you can edit your profile in the app);
• delete your account and data (Profile → Delete Account, or see how to delete your account if you no longer have the app);
• restrict or object to certain processing;
• data portability;
• withdraw consent (e.g. analytics) at any time;
• complain to the Information Commissioner's Office (ico.org.uk).

To exercise any right, email privacy@empresspiercing.co.uk.

8. Children

The app is not intended for anyone under 16. We do not knowingly create accounts for people under that age. If you believe a child has provided us with personal data, contact us and we will remove it.

9. Cookies and storage

We use essential browser storage to keep you signed in. The app cannot work without it. Analytics is optional and only runs if you accept it; you can change your choice by clearing the app's storage. See the consent prompt shown when you first open the app.

10. Changes

We may update this policy. Material changes will be reflected by the date at the top of this page.