Privacy policy

Your data: the email you sign in with, your name, phone number and country, what you write about your studio, and what you upload. You give it to us and we hold it for you.

Your clients' data: names, phone numbers, email addresses and visits, and, if you use 12Looks Pay, their payments. For this data you are the controller and we are the processor. We store client payments in 12Looks: the amount, what it was for and the status. For a card left at booking: the type and the last 4 digits. For a gift card: the buyer's name and email, the recipient's name and the message. We store and show it only on your instructions. For Improving Lora we do not use your clients' data, only overall numbers that cannot identify anyone.

Notes, before and after photos and health questionnaires in the Clients section: here too you are the controller and we are the processor. Photos go to private file storage with Supabase in Frankfurt (EU). They are not published and do not appear in the Library. A client fills in the questionnaire themselves and only after giving explicit consent (art. 9(2)(a) GDPR). The answers are encrypted, and in the app only your business sees them. When you delete a client, their notes, photos and questionnaires are deleted, and their visits stay in the Calendar without name, phone number and email address.

Supabase in Frankfurt (Germany, EU): the database, sign-in codes, and the photos and logo on your page.

Cloudflare R2 in Europe: the photos, clips and voice recordings you upload, finished videos with cover and voiceover, and copies for publishing.

A Hetzner server in Germany: our mailing list and working copies for editing. The working copies are deleted automatically after a few days.

One account cannot see another's data.

Supabase, Cloudflare and Hetzner: store the data as described above. 12Looks runs and videos are made on the Hetzner server, and all 12Looks traffic passes through the Cloudflare network.

Cloudflare Turnstile: checks, invisibly, that the sign-in and booking forms are filled in by a person and not a bot. Details are in the Turnstile Privacy Addendum at cloudflare.com/turnstile-privacy-policy.

Amazon Web Services (Amazon SES, Stockholm, EU): sends our emails, such as sign-in codes and appointment notifications.

OpenAI: provides the models Lora runs on. It receives chat messages, texts, plans, uploaded photos and video frames.

From your calendar, OpenAI gets your clients' names, services and appointment times. It does not get their phone numbers or email addresses unless you share them with Lora.

When Lora drafts a reply in Inbox, OpenAI also gets the text of that Instagram or Facebook comment or message. OpenAI does not train its models on this data.

ElevenLabs (US): turns the text of your video into a voiceover. It receives only the text to be read.

Stripe: handles the Pro subscription and, with 12Looks Pay, your clients' payments to your account. Only Stripe sees the card number.

Twilio (US): sends appointment reminder texts to your clients. It receives the phone number and the message.

Meta (Instagram and Facebook): receives the posts you publish through 12Looks.

Post statistics: if you allow access to them when you connect your account, Instagram sends us the figures once a day: views, likes, comments, shares, saves, average reel watch time, and the reach of each post and of your profile. We show them in Results.

Comments and messages: if you allow access to them, Instagram sends us new comments under your posts and the direct messages people send to your account, with their Instagram username. We show them in Inbox, where Lora drafts a reply.

If you connect a Facebook Page and allow the same access, Facebook sends us new comments on its posts and the messages people send to it on Messenger, with the sender's name. We show them in Inbox just like the Instagram ones.

A reply goes out only when you press Send. We never write to anyone first. These comments and messages are deleted together with your account.

TikTok: receives the videos you publish through 12Looks if you connect a TikTok account.

Google: if you sign in with Google, it gives us your email address and name. Google also shows the map on your page.

OpenStreetMap (Nominatim): suggests your district from the studio address. It receives only the address you enter.

OpenAI, ElevenLabs, Twilio, Cloudflare, Meta, Stripe and Google are US companies: data reaches them under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

We do not sell data and we do not share it for advertising.

What you put there: your studio name, what you do, your services, your photos and your contact details. Your street address is shown only if you switch it on.

It also shows free slots from your calendar. Nobody can see who booked or for what. Clients write reviews through your link and sign them with a name, initials or not at all. Each review shows the service and the month of the visit. You can't delete or hide reviews. If one breaks the rules, for example insults someone, shares personal data, is spam or isn't about the visit, tap Report next to it. We'll check it and take it down if the report holds up.

To improve Lora, we use two kinds of information. The first is how you work with Lora: which answers and drafts you keep, edit or reject. The second is overall numbers with no people in them, such as how many appointments there were in weeks with and without a post. We may also use this information to train 12Looks' own models.

We do not use your clients' data for this: no names, phone numbers, email addresses, notes or health information. The overall numbers are made without them and cannot identify anyone. If names or contact details appear in your texts, we remove them before any model training.

The legal basis for this processing is our legitimate interest in improving the product (Article 6(1)(f) GDPR). We only use information collected since September 29, 2026. You can object at any time: turn off Improving Lora in Settings, and we will stop using your data for this straight away.

We email you tips on marketing and bookings, plus 12Looks news, only with your consent (Article 6(1)(a) GDPR, Article 398 of the Polish Electronic Communications Law). You can withdraw it at any time: in Settings or through the link in every newsletter.

We keep your email address in our contact database, on our server in Germany, even after you delete your account. After that, the link in the newsletter is the only way to unsubscribe. Once you unsubscribe, the address stays in the database marked “do not send”.

We keep your account data for as long as your account exists. Delete it in Settings and everything in it goes: clients, appointments, files, finished videos and drafts. If you have Pro, we cancel the subscription at once.

Your email address and name then stay on our contact list. We send the newsletter to that address only if you have agreed to it, and you can unsubscribe through the link in any newsletter.

Every night we back up the database (Cloudflare R2 in Europe) and keep each backup for 14 days. Deleted data therefore leaves the backups within 14 days at most.

Under the GDPR, you have the right to see your data, correct it, have it deleted and take it with you. You can also ask us to restrict how we use it.

You can object to what we do on the basis of legitimate interest, such as Improving Lora.

You can withdraw your consent, for example to the newsletter, at any time. Anything we did before you withdrew it stays lawful.

To delete your account, go to Settings → Delete account. For anything else, write to support@12looks.com and we will answer.

You can also lodge a complaint with a data protection authority. In Poland, this is the President of the Personal Data Protection Office (UODO).