Privacy Policy

CuroByte Ltd ("CuroByte", "we", "us", or "our"), registered in England and Wales, operates the Amore London mobile application (Android App ID: com.curobyte.curobook) and the booking platform services accessible via curobyte.com (collectively, the "Services").

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU GDPR.

1. Information We Collect

We collect personal information necessary to deliver, maintain, and secure our salon booking and management application:

• Account & Identity Data: Full name, email address, phone number, and encrypted password created when registering or booking an appointment.
• Booking Details: Appointment history, selected salon treatments, dates, times, and client preferences.
• Payment Information: Payment details processed for salon bookings and subscriptions. All payment card transactions (card number, CVV, expiry date) are collected and processed directly by Stripe. CuroByte does not store or process raw payment card data on its servers.
• Device & Usage Data: Mobile device model, operating system version, push notification tokens, IP address, and app usage activity.
• Analytics Data: Website and app interaction data collected via Google Analytics (anonymised and enabled only after cookie/consent approval).

2. How We Use Your Information

We process your personal data under the following lawful bases under UK GDPR:

• Contractual Necessity: To manage appointment bookings, send SMS/email confirmations and receipts, and process payments via Stripe.
• Legitimate Interests: To maintain security, troubleshoot app errors, prevent fraud, and optimize our platform performance.
• Consent: To send marketing updates or set analytics cookies where explicitly permitted by you.

3. Third-Party Service Providers

We do not sell, rent, or trade your personal data. We only share information with trusted third-party data processors strictly necessary to run our platform:

• Stripe: Payment processing and subscription management.
• AWS (Amazon Web Services / SES): Cloud infrastructure and transactional email delivery.
• Google Analytics: Anonymised website performance analytics.
• Firebase (Google Cloud): Push notification delivery and system alerts.

4. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or to comply with legal, statutory, or tax obligations. Inactive user accounts and associated booking logs are securely archived or deleted after 6 years in accordance with UK accounting regulations.

5. Account & Data Deletion Requests

In compliance with UK GDPR and Google Play Store policies, users have the right to request the deletion of their account and associated personal data at any time.

Request deletion by emailing hello@curobyte.com with the subject line "Account Deletion Request", or by asking the salon, who will raise it for you. We confirm the request against the email address or mobile number on the account before anything is removed. The account and its personal data are then deleted — within 7 days of confirmation, and always within 30 days. The step-by-step process, what is deleted, and the records we must keep for tax and accounting, are on Delete your account.

6. Your UK GDPR Rights

Under UK data protection laws, you have the following rights regarding your personal data:

• The right to access the personal information we hold about you.
• The right to request correction of inaccurate or incomplete data.
• The right to request erasure ("right to be forgotten").
• The right to restrict or object to data processing.
• The right to data portability.

7. Contact Us

If you have any questions regarding this Privacy Policy or wish to exercise your data rights, please contact our Data Controller: