Privacy Notice
Beautrix Last updated: 10 September 2026
In one paragraph
Beautrix is a subscription tool for self-employed artists who travel to their clients. Two different sets of people appear in this notice and the law treats them differently. Artists are our customers — we decide how their account data is used, so we are the controller for it. Clients who book an appointment give their details to the artist, not to us; the artist decides what to collect and why, so the artist is the controller and we are the processor acting on her instructions. If you are a client and you want your details changed or deleted, ask the artist you booked with — she can do it in the app, and we will help her if she asks.
Who we are
Yasin Bokhari trading as Beautrix is the data controller for the personal data described in Part A.
- Address: 7 Bramber Road, London W14 9PA
- Email: privacy@beautrix.app
We have not appointed a Data Protection Officer. We are not required to, and privacy@beautrix.app reaches the person accountable for this.
Part A — if you are an artist
What we hold, and why
| What | Why we have it | Our lawful basis |
|---|---|---|
| Name, email, mobile, password | To give you an account and let you sign in | Performance of a contract |
| Your public page: display name, tagline, photo, services, prices | It is the product — this is what your clients see | Performance of a contract |
| Base postcode, travel radius, travel bands, vehicle registration | To work out drive times, travel fees and which appointment slots to offer | Performance of a contract |
| Working hours, calendar links | To know when you can be booked | Performance of a contract |
| Subscription and payment status | To take £9 a month and to know whether your account is live | Performance of a contract; legal obligation for tax records |
| Safety contact name and mobile | To send one text if you miss a check-out | Legitimate interests — your physical safety. See "The safety check-in" |
| Device notification tokens | To send push notifications to phones you have turned them on for | Consent — you turn this on per device and can turn it off |
| Instagram account details and recent posts | To show your work on your public page | Consent — you connect it and can disconnect it |
| Emails you send us | To answer you. They sit in our mailbox, not in the product | Legitimate interests — running a business people can get help from |
| Errors and security logs | To keep it working and keep it safe. We collect no analytics and build no profile of how you use it | Legitimate interests — security and keeping the service running |
We do not sell your data. We do not share it with advertisers. We do not build profiles of you for anyone else's purposes.
The safety check-in
If you turn it on, Beautrix expects you to check out at the end of an appointment. If you do not, we send one text message to the safety contact you nominated, telling them you have not checked out and where you were due to be.
Two things follow from that, and we want them said plainly:
- We hold a name and mobile number for somebody who is not our customer. We got it from you, not from them. Please tell them their details are here and why. If they contact us we will tell them what we hold and delete it on request — but the feature stops working for you if we do.
- We hold appointment addresses and rough route information so the message can say something useful. This is the only reason we hold it for this purpose.
This is the one and only thing Beautrix sends by text message. Everything else reaches you as a notification or an email.
This section describes exactly what we receive from Meta and what we do with it.
When you choose to connect your Instagram professional account, you are sent to Instagram to sign in and approve the connection. We ask for a single permission, `instagram_business_basic`. We do not ask for access to your messages, your comments, your insights, or the ability to publish on your behalf, and we could not use them if we had them.
Through that permission we receive:
- your Instagram user ID, username and account type;
- your recent media — for each post, its ID, media type, image or video URL, caption, permalink and timestamp.
We use it for one purpose: to show a gallery of your recent posts on your public booking page, with each image linking back to the original post on Instagram. We do not analyse it, do not use it for advertising, do not share it, and do not sell it.
We keep it for as long as the connection is live. Disconnecting Instagram in Set-up deletes everything we received from it within 24 hours. Deleting your Beautrix account does the same. You can also remove our access from Instagram's own settings, under Apps and websites, and we will delete it when Instagram tells us you have.
Instagram and Facebook are products of Meta Platforms, Inc. Their handling of your data is governed by Meta's own privacy policy, not this one.
How long we keep it
- While you have an account, and 90 days after you close it — your account, page and settings. Your public page comes down the moment you close it; the 90 days is so you can change your mind about the rest.
- Six years — invoices, subscription payments and anything else we need to keep for tax. This is a legal obligation and we cannot delete it on request.
- 12 months — security and error logs. There is nothing else: no analytics, no usage profile.
- 24 hours after disconnection — Instagram data.
- Until you remove them — safety contact details.
The full schedule is in our retention policy, which we will send you if you ask.
Part B — if you are a client who booked an appointment
The artist you booked with is the controller of your data. We are her processor. In plain terms: she decided to collect it, she decides what it is used for, and we hold it for her under a written contract that says we may only act on her instructions.
What that means for you:
- To see, correct, or delete what is held about you, or to object to it being held, contact the artist. Her contact details are on her booking page and on every email she sends you through us. If she asks us for help, we help her.
- If you contact us directly we will not act on it ourselves — we will pass it to her and tell you we have, because acting on it without her instruction would put us in breach of our contract with her and of data protection law.
What we hold for her: your name, email, phone number, the address of the appointment, what you booked, when, what you paid, and any note you added. We hold it in the UK and the EU, we do not use it for our own purposes, we never market to you, and we delete it when she tells us to or when her account closes.
Payments. Card payments go directly to the artist through Stripe. We never see or hold your card number.
Everyone: your rights
Whoever holds your data, you have the right to ask for a copy of it, to have it corrected, to have it deleted, to restrict or object to what is being done with it, to receive it in a portable format, and to withdraw consent where consent is what we relied on.
Where we are the controller, ask us at privacy@beautrix.app. We will respond within one month. If your request is genuinely complex we may extend that by up to two further months, and we will tell you within the first month if we do. If we need to ask you what you are looking for, the clock pauses while we wait for your answer — but we will not make you narrow your request, and we cannot require you to.
Complaining
If you think we have got this wrong, tell us first — there is a complaints form at https://beautrix.app/complaints. We will acknowledge it within 30 days, look into it properly, and tell you what we found.
You can also complain to the Information Commissioner's Office at any time, whether or not you have come to us first. ico.org.uk/make-a-complaint, or 0303 123 1113.
Cookies
We use very few. There is a separate cookie notice at https://beautrix.app/cookies.
Where your data is
Your data is stored in the United Kingdom and the European Economic Area.
Some of the companies we rely on to run Beautrix are based in the United States. Where data reaches them, we rely on the UK's adequacy regulations for the US (the UK Extension to the EU–US Data Privacy Framework) where the company is certified under it, and on the ICO's International Data Transfer Addendum where it is not. We check certification status rather than assume it. Our current list of suppliers, what each one does and where it is, is published at https://beautrix.app/sub-processors and we keep it current.
Automated decisions
We do not make decisions about you by automated means that have a legal or similarly significant effect. Drive times and suggested slots are calculated automatically, but they are suggestions to you, not decisions about you.
Changes
If we change this notice we will update the date at the top. If the change is significant — a new purpose, a new category of data, a new supplier handling something sensitive — we will tell you by email before it takes effect.