Privacy policy

The controller of your data is the studio you book with. It decides what it uses your data for and how long it keeps it.

12Looks (Ankaa PMU Inc., 214 Duffield Street, Brooklyn, NY 11201, USA) is the processor (Article 28 GDPR). It provides the software and stores the data on the studio's instructions. Contact: support@12looks.com.

You give your name, phone number and email and choose a service and a time. You can also pick a specialist and add a note for the studio.

The form does not ask about health. Do not put illnesses, allergies or medication in the note: this is an appointment calendar, not a medical record. If they matter for the service, tell the studio directly.

The studio may also ask you to fill in a separate health questionnaire. You fill it in only after giving your consent, which you can withdraw at any time. The questionnaire itself explains what happens to your answers.

You leave a review through a link the studio sends after your visit.

Your name from the booking is already filled in as the signature. You can change it, for example to initials. If you delete it, the page shows “Anonymous”.

Along with the review, the page shows your rating, the service and the month of your visit.

The studio can hide or delete a review, including at your request.

To arrange and confirm your visit and to contact you about it. Basis: the contract and the steps before it, Article 6(1)(b) GDPR.

To remind you of your appointment. Basis: the studio's legitimate interest in fewer missed visits, Article 6(1)(f) GDPR.

To ask for your review after the visit. Basis: the studio's legitimate interest in reviews from real clients, Article 6(1)(f) GDPR.

To show your review on the studio's page. Basis: your consent, which you give by sending the review, Article 6(1)(a) GDPR.

Supabase (Frankfurt, Germany): stores visit details and reviews.

Hetzner (Germany): the server 12Looks runs on.

Cloudflare: every connection to the page passes through its network.

Cloudflare Turnstile: checks, invisibly, that the booking form is filled in by a person and not a bot.

Amazon SES (Stockholm, Sweden): sends emails. The studio gets a notice of each new booking request, and you get a confirmation and a reminder if you leave your email.

OpenAI: sees your name, the service and the time of your visit when the studio uses the AI agent in 12Looks. It does not get your phone number or note unless the studio itself passes them to the agent. It does not use this data to train its models.

WhatsApp: the studio sends confirmations, reminders and review requests through it. 12Looks only writes the message and opens the chat.

Twilio (US): sends appointment reminder texts if the studio uses them. It receives your phone number and the message.

Google: shows the map on the studio's page. When the map loads, Google receives your device's IP address.

Cloudflare, OpenAI, Twilio and Google are US companies. Data goes to them under the EU standard contractual clauses or the EU-US Data Privacy Framework.

Your details stay in the studio's calendar for as long as it needs them. You can ask the studio to delete them.

When the studio deletes its 12Looks account, all of its data is deleted, yours included.

A declined booking request is deleted straight away. It leaves no entry in the calendar.

Database backups are kept for 14 days, so deleted data leaves them within 14 days at most.

You can ask to see your data and have it corrected. You also have the right to have it erased, restricted or moved elsewhere.

You can object to what the studio does on the basis of legitimate interest, such as reminders.

You can withdraw your consent at any time. Anything done before you withdraw it stays lawful.

Take these requests to the studio first. You can also write to 12Looks: support@12looks.com.

You may lodge a complaint with your national data protection authority.

The studio's page uses only the cookies it needs to work, with no analytics or advertising.

When the map on the page loads, Google receives your device's IP address and may set its own cookies.