Privacy policy

Data controller

My Bubble Beauty (Souade El Fellaoui, company no. 0723.549.229), Palokestraat 146, 1700 Dilbeek, Belgium - mybubble9600@gmail.com - 0484.118.395.

Visiting the site and hosting

To display the pages and protect the service, our server processes visitors' IP addresses. The site and the database, which holds your account and appointments, are hosted on a server we rent from OVHcloud, in its Beauharnois data centre (Quebec, Canada). We administer this server ourselves. This technical data is not used to identify you, and the web server keeps no log of the pages visited.

Canada benefits from an adequacy decision of the European Commission (Decision 2002/2/EC): your data enjoys a level of protection recognised as equivalent to that of the European Union.

Cookies and local storage

The site sets three cookies, only if you log in to your account. They are strictly necessary for the service you request and therefore do not require consent: no cookie banner is shown.

• __Host-mb_session keeps you logged in during your visit. It holds a random code of which we only keep a fingerprint. It disappears when you close your browser or log out, and the session expires anyway after 30 minutes of inactivity and at the latest 12 hours after logging in. If you tick “Remember me”, it stays on the device for 30 days, even with the browser closed, and the session also lasts 30 days.
• __Host-mb_device remembers for one year that a login has already succeeded from this browser. It is used for security only: if someone else tries passwords in series on your address, your own device is not locked out. It does not contain your email address in readable form and serves no other purpose.
• __Host-mb_oauth only exists while you log in with Google or Microsoft, for 10 minutes at most. It checks that the return really matches the request made from this browser, then it is deleted.

These cookies can only be read by this site, never by a script, and are not used for advertising or to track your browsing.

Two settings you choose are also stored in your browser (local storage): pausing animations, under the name mb-motion, and the light or dark theme, under the name mb-theme. They are only created when you use these buttons. They only remember your settings, are never sent anywhere and can be cleared at any time in your browser settings. They therefore do not require consent.

Between logging in and signing up, an auth-swap marker is kept for a few seconds in the browser's session storage so the animation can continue. It is deleted as soon as the next page opens.

If you refuse below to have your visits counted, one last cookie, mb_nostats, keeps that choice for one year. It contains nothing else.

Login cookies cannot be refused: without them, logging in is impossible. They are deleted when you log out. You can also delete all cookies from this site at any time in your browser settings.

Audience measurement

We count site visits ourselves, without cookies and without any third-party tool. When you open a public page, our server computes a fingerprint from your IP address, your browser and a random key that changes every day and is never stored. Only the fingerprint, the date and the number of pages viewed that day are kept. Your IP address is not stored and, once the day's key is erased, the fingerprint can no longer recognise you or follow your browsing from one day to the next. Account and booking pages are not counted. These statistics are kept for 13 months in our database, on our OVHcloud server in Canada.

Legal basis: our legitimate interest in knowing how the site is visited (Art. 6(1)(f) GDPR). The counting itself stores nothing on and reads nothing from your device.

You can refuse this counting at any time in the Cookies and local storage section. It is also switched off automatically if your browser sends the Global Privacy Control signal.

Client account

To book online, you create an account with your email address, your name and a password. You may add your phone number, if you wish, so the salon can reach you about an appointment. Your name, email address and phone number appear next to your appointments in the salon's diary. You can change your name and phone number in your account. We also store the site language you sign up in, to write to you in that language. Your password is never stored: only an irreversible fingerprint is kept. When you choose a password, it is compared anonymously with the public list of leaked passwords (Have I Been Pwned): only the first 5 characters of its fingerprint are sent, never the password itself.

Legal basis: performance of the contract and pre-contractual measures (Art. 6(1)(b) GDPR).

An account whose address has not been confirmed is deleted after 7 days. An account is deleted automatically 3 years after your last appointment, or 3 years after it was created if you never booked. You can delete your account at any time from your client area: your upcoming appointments are cancelled, you have 30 days to reactivate it by logging in again, then it is erased. You can also erase it immediately, or write to us at mybubble9600@gmail.com (deleted within one month). You can download your data at any time from your account (JSON file). Changing the account's email address is also done on request.

Online booking

When you book, we store the chosen treatment, the date and time, the price, any discount (promo code) and the booking status (confirmed or cancelled). No payment is asked online: the treatment is paid at the salon. Online booking asks for no health data. We send you an email when the appointment is confirmed, and another if it is cancelled.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for accounting records, our legal obligations (Art. 6(1)(c) GDPR).

Appointments by phone and client file

When you contact us by phone, email, WhatsApp or social media, we use your details and appointment history only to organise your treatments (legal basis: performance of the contract and pre-contractual measures, Art. 6(1)(b) GDPR). If you have no account, the salon may enter your appointment in its online diary with your name and, if you give it, your phone number. They are kept for up to 3 years after your last appointment, unless the law requires longer retention (accounting).

WhatsApp, Facebook, Instagram and Snapchat are third-party services with their own privacy policies.

Service emails

Emails about your account and bookings (address confirmation, notice of a sign-up with an address already registered, forgotten password, notice of a password change, appointment confirmation and cancellation) are sent through Resend, our email delivery provider. Resend receives your email address and the content of the message. It is based in the United States: the transfer relies on its certification under the Data Privacy Framework and on the European Commission's standard contractual clauses. We send no marketing emails.

Security and logs

To protect accounts against fraud and password guessing, we record important events in a security log: successful or refused logins, sign-ups, password resets and changes, payments and refunds, administrator actions. Depending on the event, these lines contain the IP address and the internal account number, never your password. The number of attempts per IP address and per email address is also counted in memory, for 15 minutes to 1 hour. The list of your open sessions (browser and system, login date, last activity) is shown in your account, where you can log out your other devices.

Legal basis: our legitimate interest in securing the site and your data (Art. 6(1)(f) GDPR). The salon's security log, stored in our database, also records account deletions and reactivations, data downloads and consents for health data; it is kept for 12 months. Our server's technical logs are kept for 14 days, then deleted.

Health data

Before some treatments, we ask you to fill in a health form or questionnaire (allergies, pregnancy, treatments, contraindications). This is sensitive data. It is collected only with your explicit consent (Art. 6(1)(a) and 9(2)(a) GDPR), used only to perform the treatment safely, accessible only to the people treating you and kept for 3 years after your last treatment. You can withdraw your consent at any time; some treatments can then no longer be performed. Providing this information is optional, but necessary for some treatments.

If you give your consent (optional box when booking, or in your account), the salon may note this information in your client file on this site. Only the salon sees it; it never enters the security log. You can withdraw your consent from your account: the salon then erases this information from your file.

Before and after photos

Follow-up photos may be taken to assess how a treatment is progressing, only with your agreement. They are never published without your separate written consent, which you can withdraw at any time. They are kept for 3 years after follow-up ends.

Recipients

Your data is neither sold nor transferred. It is shared only with strictly necessary service providers, each for its own task: OVHcloud (hosting of the site and the database), Resend (sending emails), our accountant, or with authorities where the law requires it.

Retention periods

• Account with an unconfirmed address: 7 days.
• Login session: 30 minutes of inactivity, 12 hours at most; 30 days if you tick “Remember me”.
• Device cookie: 1 year.
• Client account: 3 years after your last appointment (or after it was created if you never booked), or until you ask for deletion.
• Name and phone number of a person without an account, entered by the salon: 3 years after the appointment.
• Account you asked to delete: 30 days to reactivate it, then erased.
• The salon's security log: 12 months. The host's technical logs: 7 to 30 days.
• Accounting records (payments and refunds): for the period required by Belgian accounting law.

Once an account is deleted, past bookings keep only the treatment, the date and the amounts, without your name or contact details.

External links

Links to YouTube, Google Maps and our social media open those services, which apply their own rules. No content from those services is loaded on this site.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent. Write to us at mybubble9600@gmail.com. You can delete your account and download your data yourself from your account. To change its email address, write to us from the account's address. You can also lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

Last updated: 8 November 2026