GlamFinder

Privacy Policy

This English version is provided for information only. The French version is the legally binding one and prevails in case of any discrepancy.

Last updated: 2 June 2026
This policy explains how GlamFinder collects, uses, protects and shares your personal data, in accordance with the GDPR and French law.

1. Data controller

The data controller is:
GlamFinder SAS
SIREN: 943 831 420
SIRET: 943 831 420 00014
Address: 15 Chemin de Halage, 95620 Parmain, France
Email: contact@glamfinder.fr

2. Data collected

  • Identification data: last name, first name, email, phone, postal address, photo, etc.
  • Professional data: status, qualifications, SIRET, description, portfolio, etc.
  • Tax data (sole-trader professionals): date of birth and tax identification number (NIF), collected under our platform operator reporting obligations (DAC7, art. 242 bis of the French Tax Code).
  • Connection data: IP address, logs, cookies, session identifiers.
  • Payment data: IBAN, bank details, transactions (via Stripe or an equivalent provider).
  • Browsing data: pages visited, actions on the platform, preferences.
  • Communication data: messages, reviews, emails exchanged through the platform.
  • Data from partners (e.g. Google, social networks, analytics tools).

3. Purposes of processing

  • Management of user accounts (pros and clients).
  • Booking, payment, invoicing and management of services.
  • Communication, notifications, reminders and customer support.
  • Personalization of the user experience (recommendations, preferences, etc.).
  • Improvement of the platform, statistics, fraud detection and security.
  • Compliance with legal and regulatory obligations (accounting, tax, anti-money laundering, etc.).
  • Sending commercial offers and newsletters (with explicit consent).

4. Legal basis for processing

  • Performance of the contract (Terms of Use, booking, payment, etc.).
  • User consent (newsletter, non-essential cookies, etc.).
  • Legal obligation (accounting, fraud prevention, etc.).
  • Legitimate interest (service improvement, security, abuse prevention).

5. Recipients of the data

  • GlamFinder team (support, technical, moderation).
  • Technical providers (hosting, payment, emailing, analytics, etc.).
  • Tax authority (French DGFiP), as part of the annual platform operator report (DAC7, art. 242 bis of the French Tax Code).
  • Administrative or judicial authorities in case of legal obligation.
  • Commercial partners (with explicit consent).

5 bis. Sub-processors and third-party providers

To provide the service, GlamFinder relies on the following sub-processors, which access your data only to the extent strictly necessary for their service and under a contract compliant with Article 28 of the GDPR:

  • Stripe / Stripe Connect (Ireland, United States): payment processing, subscriptions and identity verification (KYC). GlamFinder does not store any full banking data.
  • Mailjet (Sinch) (European Union): sending transactional emails and, subject to consent, newsletters.
  • Twilio (United States): sending SMS (verification codes, notifications).
  • Vercel (European Union, United States): hosting of the application and the API.
  • Supabase (European Union): database and file storage (photos, portfolios).
  • Google (Google Ireland Ltd.): OAuth authentication, Google Calendar integration, audience measurement (Google Analytics, Google Tag Manager). See section 8 bis.
  • Sentry (United States): technical monitoring and application error logging.
  • Mapbox / Woosmap / Google Maps: mapping, geocoding and geolocation of services.
  • Apple, Facebook (Meta): third-party (OAuth) sign-in, if you choose this login method.

Transfers to sub-processors located outside the European Union are governed by the European Commission's Standard Contractual Clauses or an equivalent protection mechanism.

6. Retention period

  • User accounts: as long as the account is active, then 3 years after deletion (unless a longer legal obligation applies).
  • Billing data: 10 years (accounting obligation).
  • Connection logs: 12 months maximum.
  • Cookies: see Cookie Policy and cookie settings.

7. Data security

  • Encryption of sensitive data (passwords, payments, etc.).
  • Restricted data access (access control, logging, regular audits).
  • Regular backups and business continuity plan.
  • Security testing, bug bounty, responsible disclosure policy.

8. Transfers outside the EU

Some data may be transferred outside the European Union (e.g. hosting, providers). GlamFinder ensures that such transfers comply with the GDPR (Standard Contractual Clauses or an equivalent protection mechanism).

8 bis. Google services and Google Calendar integration

8 bis.1. Sign-in with Google (OAuth)

When you create an account or sign in with Google, we receive from Google the profile information strictly necessary for authentication: last name, first name, email address, profile picture and Google identifier. This data is used solely to create, identify and secure your GlamFinder account.

8 bis.2. Google Calendar integration (optional)

If you choose to, you can connect your Google calendar to GlamFinder. This connection is optional, triggered by an explicit action on your part, and revocable at any time. It relies on the following Google authorizations (scopes):

  • https://www.googleapis.com/auth/calendar.events.owned

Specifically, with your authorization, GlamFinder:

  • creates, updates and deletes in your primary Google calendar the events corresponding to your GlamFinder appointments;
  • reads your events in order to display your availability and avoid double bookings;
  • securely stores an encrypted refresh token to maintain synchronization.

GlamFinder does not use your calendar content for advertising purposes, does not sell it, and does not share it with any third party that is not essential to the synchronization feature.

8 bis.3. Revoking access

You can disconnect Google Calendar at any time from your GlamFinder account settings, or directly from your Google account at myaccount.google.com/permissions. Disconnecting immediately revokes the access token and stops all synchronization. You may also request the complete deletion of your data via the data deletion page.

8 bis.4. Google Limited Use compliance

GlamFinder's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In particular, data obtained through Google APIs:

  • is only used to provide and improve user-facing features (appointment synchronization);
  • is never transferred or sold for advertising, marketing or resale purposes;
  • is not used to train generalized artificial intelligence models;
  • is accessed by humans only in permitted cases: explicit consent, security necessity, compliance with a legal obligation, or internal operations after anonymization and aggregation.

9. Your rights

  • Right of access, rectification, objection, restriction, erasure and portability of your data.
  • Right to withdraw your consent at any time (for processing based on consent).
  • Right to lodge a complaint with the CNIL (www.cnil.fr).
  • To exercise your rights, contact us at contact@glamfinder.fr.

9.1. Right to erasure (account deletion)

You may request the deletion of your account and personal data at any time. This deletion is irreversible and will result in:

  • Immediate deletion: Your personal data (name, email, avatar, conversations, messages)
  • Anonymization: Your appointments and relationships (kept for legal statistics)
  • Cleanup: Active sessions, authentication tokens

To delete your account: Click here to access the deletion page

Note: Some data may be kept for legal obligations (billing, security) but will be anonymized and will no longer allow your identification.

10. Automated decisions and profiling

Some features may rely on automated processing (recommendations, scoring, fraud detection). No major legal effect is produced without human intervention.

11. Minors' data

The platform is not intended for minors under 16 without parental authorization. Any request to delete a minor's data will be processed as a priority.

12. Changes to the policy

GlamFinder reserves the right to amend this policy at any time. Users will be informed of any major changes.

13. Contact

For any question, contact us at contact@glamfinder.fr.