Information you provide directly:

• Account information: full name, email address, phone number, password, account type (client or professional).
• Profile information: bio, profile photo, business name, business description, address, service listings.
• Portfolio content: photos, images, and descriptions uploaded by Service Providers to showcase their work.
• Booking information: services selected, dates, times, staff preferences, special requests, cancellations.
• Payment information: billing details are collected and processed by Stripe. Krowned does not directly store credit card numbers, CVVs, or full bank account numbers.
• Communications: messages sent through the platform, support requests, reviews, and responses.
• Location: business address, service area (for mobile stylists), and client location when searching for nearby providers.

Information collected automatically:

• Device & usage data: IP address, browser type, operating system, device identifiers, pages visited, actions taken, timestamps, referring URLs.
• Location data: approximate location derived from IP address; precise location only with your explicit consent (e.g., “Find stylists near me” feature).
• Cookies & similar technologies: see Section 5 and our Cookie Policy.

• Provide the service: create and manage accounts, process bookings, facilitate payments, enable communication between clients and Service Providers.
• Transactional communications: booking confirmations, reminders, cancellation notices, payment receipts, payout notifications.
• Improve the platform: analyze usage patterns, fix bugs, develop new features, optimize search and recommendations.
• Safety & trust: detect fraud, enforce our Terms, verify Service Provider identities, moderate reviews.
• Marketing (with consent): promotional emails about new features, special offers, or relevant stylists. You can opt out at any time.
• Legal compliance: respond to legal requests, enforce our rights, comply with applicable laws and regulations.

We process personal data based on:

• Contract performance: processing necessary to fulfill our agreement with you (e.g., processing bookings, payments).
• Legitimate interests: improving our platform, preventing fraud, marketing our services (balanced against your rights).
• Consent: where you have given explicit consent (e.g., marketing emails, precise location access).
• Legal obligation: where processing is required by law (e.g., tax reporting, responding to valid legal process).

We never sell your personal data.

We share information with the following categories of recipients:

Other users: When you book a service, we share your name, contact information, and booking details with the Service Provider. When a Service Provider lists services, their business information is publicly visible.

Legal requirements: We may disclose information if required by law, subpoena, or court order, or if we believe disclosure is necessary to protect our rights, safety, or the safety of others.

Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

We use cookies and similar technologies for authentication, preferences, and analytics. For a detailed breakdown of what cookies we use and how to control them, see our Cookie Policy.

Essential cookies: Required for the platform to function (authentication, session management, security). Cannot be disabled.

Analytics cookies: Help us understand usage patterns and improve the platform. Can be opted out of.

Preference cookies: Remember your settings (theme, language, location history).

We do not currently use third-party advertising cookies or sell data to ad networks.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Data portability: Receive your data in a structured, machine-readable format.
• Opt-out of marketing: Unsubscribe from promotional emails at any time via the link in each email or through your account settings.
• Withdraw consent: Where processing is based on consent, withdraw it at any time (without affecting prior processing).
• Object to processing: Object to processing based on legitimate interests.

How to exercise your rights:

• Most actions (update profile, delete account, manage preferences) can be performed directly in your account settings.
• For formal requests: email [PLACEHOLDER — Privacy Email, e.g., privacy@krowned.app] with the subject line “Privacy Rights Request.”
• We will respond within 30 days (or sooner if required by applicable law).
• We may need to verify your identity before processing requests.

California (CCPA/CPRA):

• We do not sell or share personal information for cross-context behavioral advertising.
• California residents have the right to know what personal information is collected, request deletion, and opt out of sale/sharing.
• We do not discriminate against users who exercise their privacy rights.
• To submit a request: email [PLACEHOLDER — Privacy Email] or use your account settings.

Virginia (VCDPA):

• Virginia residents have rights to access, correct, delete, and obtain a portable copy of their data.
• You may opt out of processing for targeted advertising, sale of personal data, or profiling with legal or significant effects.
• To appeal a denied request, contact [PLACEHOLDER — Privacy Email] with “VCDPA Appeal” in the subject line.

Maryland & DC: We comply with applicable consumer protection laws in all jurisdictions where we operate. If you believe your rights have been violated, contact us or file a complaint with your state attorney general.

We retain personal data only as long as necessary to fulfill the purposes described in this policy:

• Active accounts: Data is retained for the duration of your account plus a reasonable wind-down period.
• After account deletion: Most personal data is deleted within 30 days. Some data may be retained longer to comply with legal obligations (e.g., tax records for 7 years), resolve disputes, or enforce our agreements.
• Booking records: Retained for [PLACEHOLDER — retention period, e.g., “3 years”] after the booking date for dispute resolution and legal compliance.
• Payment records: Retained as required by tax and financial regulations.
• Anonymized/aggregated data: May be retained indefinitely for analytics and improvement purposes.

We implement reasonable technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest.
• Row-level security policies on our database ensuring users can only access their own data.
• Secure authentication with hashed passwords (via Supabase Auth).
• Regular security updates and dependency audits.
• Access controls limiting employee access to personal data on a need-to-know basis.

No system is 100% secure. If we discover a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant authorities within 72 hours (or as required by applicable law).

Krowned is not directed at children under 13 and we do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13 without verifiable parental consent, we will delete it promptly.

Parents or guardians who believe their child under 13 has provided information to Krowned should contact us at [PLACEHOLDER — Privacy Email].

Service Providers may create contact records for clients who do not have a Krowned account (e.g., walk-in clients, phone bookings). These records contain the client’s name and phone number or email address, and are used solely for booking management by that Service Provider.

Data controller. For non-account contact records, the Service Provider who created the record is the data controller. Krowned acts as a data processor, storing the data on their behalf.

Your rights.If a Service Provider has created a contact record for you and you wish to access, correct, or delete it, you may: (a) contact the Service Provider directly; or (b) email Krowned at [PLACEHOLDER — Privacy Email] and we will facilitate the request.

Non-account contacts do not receive marketing communications from Krowned. They may receive booking-related transactional messages (confirmations, reminders) initiated by the Service Provider.

Krowned primarily operates in the United States. Your data is stored on servers located in the United States. If you access the platform from outside the US, your data will be transferred to and processed in the US. By using Krowned, you consent to this transfer.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the platform at least 30 days in advance. The “Last updated” date at the top reflects the most recent revision.

For privacy questions or to exercise your rights: