Privacy Policy

Introduction

Lutily ("we", "our", "us") operates the lutily.com website and the Lutily booking platform. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your information.

This policy covers website and blog visitors, salon owners and staff, and clients using Lutily-powered booking pages. Salons also handle information for their own appointment and customer management; contact your salon about its own privacy practices.

Information We Collect

Information you provide

• Account information: Name, email address, phone number, and business details (salon name, address) when you create an account.
• Social login: If you sign in using Google or Facebook, we receive your name and email address from the provider. We do not access your contacts, posts, photos, or any other social media data. We only use this information to create or authenticate your Lutily account.
• Booking and client information: Client names, phone numbers or email addresses, selected services, appointment dates, booking history, and appointment or customer notes. Salons may enter this information on their clients' behalf.
• Staff and service information: Staff profiles, schedules, service descriptions, prices, durations, and notes entered to manage the salon.
• Images and reviews: Uploaded profile, salon, and service images, review ratings, and review comments. Published reviews may show a reviewer display name. Content published on salon or staff booking pages can be viewed by other visitors. Avoid including private information in public images or reviews.
• Waitlist information: Email address, preferred days and times when clients join a waitlist.
• Beta invite requests: Your email address, the free tool you requested access from, and any business name and preferred Lutily booking address you choose to include. We use these details to manage your invite request.

Information collected automatically

• Operational and security information: IP addresses, request times, browser and device information, and technical error reports, which may include the page URL and error context. We use this information to operate the service, investigate failures, and prevent abuse.
• Booking operations: Availability recommendations and their relationship to booking activity, used to provide and improve scheduling features.
• Communication records: Verification and notification records, delivery status, and opt-out information needed to send service messages and respect communication preferences. Permission records can include a phone number, the disclosure version, time, purpose, related appointment or verification request, and the staff member who recorded permission. We also record the Terms version and acceptance time when a salon account is activated.
• Optional website measurement: Marketing-site visits and interactions measured only with your permission, as explained in Cookies and Website Tracking.

How We Use Your Information

We use the collected information to operate and improve the Lutily platform and, with your permission on our marketing website, measure visits and advertising:

• Appointment management: Processing bookings, sending confirmation and reminder notifications via SMS.
• Phone verification: Sending one-time verification codes via SMS to confirm client phone numbers during the booking process.
• Appointment notifications: Sending SMS messages for booking confirmations, reminders (24 hours and 2 hours before appointments), cancellation notices, and reschedule updates.
• Waitlist notifications: Sending email notifications when a matching time slot becomes available.
• Platform operation: Account management, customer support, and service improvements.

SMS Communications

Requesting an SMS code authorizes a verification text. Appointment texts are a separate optional choice when booking, or may be authorized directly with the salon. Depending on that permission, transactional SMS messages may include:

• Phone verification codes (one-time passcodes)
• Booking confirmation messages
• Appointment reminders (24 hours and 2 hours before the appointment)
• Cancellation notifications
• Reschedule notifications

Message frequency varies based on booking activity. Message and data rates may apply. Consent to receive text messages is not a condition of purchasing any goods or services.

Clients can opt out of SMS messages at any time by replying STOP to any message. A final opt-out confirmation may be sent. An opt-out can stop verification and appointment texts across Lutily salons using the shared messaging program. You can also request an opt-out or get help by contacting us at [email protected].

We will not share your mobile phone number or SMS opt-in consent data with any third parties or affiliates for marketing or promotional purposes.

Social Login Data

When you use Google or Facebook to sign in, we receive only your basic profile information (name and email address) needed to create or authenticate your account. We do not:

• Post to your social media accounts
• Access your friends list, photos, or other social data
• Use social login data for advertising or profiling

Using social sign-in connects your browser or app to the chosen provider, which processes sign-in information under its own privacy policy. You can revoke Lutily's access through your Google or Facebook account settings. Revoking access will not delete your Lutily account — contact us to request account deletion.

Data Sharing

We do not provide booking contact information to third parties for their marketing or promotional purposes. Specifically, we will not share your mobile phone number or any SMS opt-in/opt-out consent data with third parties or affiliates for marketing purposes under any circumstances. Optional website measurement involves sharing data with Google as described below. We share data with:

• Messaging providers: Telnyx processes phone numbers and SMS message content for verification and appointment communications. Resend processes email addresses and email content for sign-in and service communications.
• Hosting and image storage: Hosting providers process application data to run the service. Cloudflare R2 stores uploaded images.
• AI service providers: When an eligible salon uses service auto-fill, OpenRouter and the AI providers serving the request process the service information described below.
• Business owners: Salon owners using Lutily can see their own clients' booking information and contact details as needed to manage their business.
• Legal requirements: When required by law, regulation, or legal process.

Optional AI Service Auto-Fill

On eligible plans, salon administrators can choose Auto-Fill when creating or editing a service. Selecting it sends the service name, description, price, and duration, together with existing service names, categories, prices, and durations, to OpenRouter and the AI provider serving the request. This information is used to suggest service details, categories, prices, and durations.

This feature does not automatically include client contact records or appointment notes. Any personal information you type into service names or descriptions would be included, so leave those details out. You can enter all service details manually instead. AI suggestions can be inaccurate; review them before saving.

Processing locations, retention, and any use of inputs to improve models depend on the provider and applicable settings. Data may be processed outside the United States. See OpenRouter's Privacy Policy and its provider data-handling information.

Cookies and Website Tracking

On lutily.com and www.lutily.com, including our blog, optional Google tracking loads only after you opt in. You can reject all nonessential tracking or choose these categories separately:

• Essential storage: We store your cookie preferences in your browser's local storage for up to 180 days. This storage does not require optional tracking consent.
• Analytics: With your permission, Google Analytics measures website visits and interactions using browser and device information and identifiers such as cookies beginning with _ga.
• Advertising measurement: With your permission, Google Ads measures advertising activity and may use identifiers such as cookies beginning with _gcl_. We keep personalized advertising disabled in our website tag configuration.

When enabled, these Google services receive technical information, including your IP address when your browser connects to Google. See Google's information about its advertising and measurement services for details about its processing.

Use Cookie settings on this website to change or withdraw your permission. Withdrawing permission stops the selected tracking and removes accessible cookies used by those trackers; the marketing page may reload to apply the change. It does not delete data already received by Google. Preferences apply to the browser and website origin where you saved them. A Global Privacy Control browser signal keeps advertising measurement off.

The admin and client booking applications do not load these analytics or advertising tags and do not display this banner. Storage and requests needed for sign-in, booking, security, and operating the service continue to work.

Essential cookies, local storage, and session storage also support sign-in, booking progress, and account preferences. The marketing website loads fonts from Google Fonts, which receives technical connection information such as your IP address when your browser requests them. This is separate from the optional Analytics and Ads tags. The older Do Not Track browser setting does not change our handling; the cookie controls and Global Privacy Control behavior described above apply.

Data Security

We use HTTPS to encrypt connections and access controls to restrict access to accounts and salon records. Contact details, including phone numbers, are stored in a form the service can use for bookings and communications. No method of storage or transmission is completely secure.

Data Retention

Account, staff, service, booking, and client records are generally kept while the associated salon account is active and the records are needed to provide the service. Retention also depends on outstanding appointments, support requests, security needs, legal obligations, and the resolution of disputes.

Operational logs and notification records have separate retention and cleanup processes. Message bodies and short-lived verification records are separate from permission and Terms acceptance records, which may be needed to demonstrate what was agreed or resolve a dispute. We may retain limited opt-out records so that deleting other information does not cause unwanted messages to resume. Deleting a record from active systems may not immediately remove copies in backups or records held by service providers; their retention and any applicable deletion requirements also need to be considered. Contact us for information about a particular record or a deletion request.

Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Opt out of SMS communications by replying STOP

Data Deletion

To request access, correction, or deletion, email [email protected] and identify the account or salon involved. We may need to verify your identity and coordinate with the salon responsible for the records. We will respond within the deadlines required by applicable law and explain any applicable exception or extension.

A deletion request is reviewed separately from an appointment cancellation. Outstanding appointments may need to be addressed with the salon. Where retention is required or permitted by applicable law, some records may remain for security, legal obligations, dispute resolution, or communication opt-outs. Closing a login does not necessarily remove every record the salon holds about your appointments.

Children's Privacy

Lutily is not intended for use by individuals under the age of 13. We do not knowingly collect information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a revised "Last updated" date.

Contact Us

If you have questions about this Privacy Policy, contact us at [email protected].