Privacy Policy

This Privacy Policy explains how Youzse Ltd collects, uses and protects your personal data when you use the Youzse mobile application (the App).

Youzse Ltd is the data controller for the personal data described in this Policy. We handle your data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

The website and the mobile apps are not the same on this point. The website carries advertising measurement technology; the apps do not. The App performs no tracking as Apple defines it, contains no advertising or attribution software, does not use the device advertising identifier, and shares nothing with any advertising network. It therefore does not ask for App Tracking Transparency permission, because it has nothing to ask about.

Youzse is used by businesses and their customers in the United Kingdom, Ireland, Gibraltar, the United States, Canada, Australia, New Zealand and Singapore. This Policy is one notice for all of them. If you are outside the UK, the regional addendum for your country at the end of this Policy also applies to you. It adds to this Policy and never reduces the rights it describes, and where the law where you live gives you more rights, you have those too.

We want to be completely straight with you.

Youzse Ltd has zero interest in the contents of your data, and we do not sell, rent or exploit it. We are not in the business of monitoring or mining your personal information. We have exactly two priorities when it comes to data:

• keeping it secure, by running on robust and well protected infrastructure
• using it only to give you a smooth and frictionless experience in the App

We collect the minimum we need to make Youzse work well for you, and nothing more.

• Data controller: Youzse Ltd, company number 17254677
• Registered office: 66 Paul Street, London, England, EC2A 4NA
• Privacy contact: [email protected]
• Privacy Lead: our Privacy Lead is responsible for privacy in every country we operate in, and can be reached at [email protected]
• ICO registration number: ZC243713

If you have any question about this Policy or how we handle your data, please contact us using the details above.

Youzse provides software to businesses such as salons, garages and beauty professionals, who use it to manage their bookings and their own customers. Our role under data protection law depends on whose data it is.

• When you use the App to manage your own Youzse account, Youzse Ltd is the data controller for that account information.
• For the personal data a business records about its own customers through Youzse, that business is the data controller and Youzse Ltd acts as its data processor.

Our work as a processor is governed by a Data Processing Agreement (DPA) that every business accepts before using Youzse. We only process customer data on the business's documented instructions, and we keep records of our processing activities as required by Article 30 of the UK GDPR.

Information you give us:

• Account details: your name, email address and password, or the identifier returned by Apple Sign In or Google Sign In.
• Profile information: any details you choose to add to your profile.
• Appointment information: details connected to a booking, and where a business has enabled it and the customer has agreed, images captured or uploaded in connection with an appointment.
• Content you submit: information you enter when using App features.

Information collected automatically:

• Device and technical data: device type, operating system, app version, language settings and similar technical identifiers.
• Usage data: how you interact with the App, which features you use and general performance and diagnostic information.
• Location data: approximate or precise location, only where you grant permission.

Information from third parties:

• Apple and Google: when you use Apple Sign In or Google Sign In, we receive basic account information, such as your name and email address or a private relay email if you choose to hide it, to create and secure your account.
• Stripe: confirmation and status of payments. We never receive your full card number.

Some services may involve special category data, for example health information or appointment images that could reveal it. We only handle special category data on the basis of explicit consent, as explained in section 5. Your biometric login data never leaves your device, as explained in section 7.

The App asks for certain device permissions so it can work properly. You are always in control and can change these at any time in your device settings.

• Location: to power discovery, address look up and showing relevant services to you on a map.
• Camera: to scan QR codes and, where a business has enabled it and the customer has agreed, to capture images in connection with an appointment. We do not use the camera for any other purpose, and we never capture images in the background.
• Push notifications: to send you app alerts, updates and important account messages.
• Face ID and biometrics: for secure sign in. Matching happens on your device only.

If you decline or later withdraw a permission, the related feature may stop working, but you can continue to use the rest of the App.

Some bookings involve information that the UK GDPR treats as special category data, for example health details, or appointment images that may reveal a health condition.

• We only process special category data where explicit consent has been given, separately and not bundled into agreeing to these terms.
• We record what was shown and when consent was given.
• The data is encrypted while stored, access to it is restricted and logged, and it is kept for a strict and limited period.
• Consent can be withdrawn at any time, and you can ask us or the relevant business to delete the data.

We never use special category data for marketing or profiling.

Under UK GDPR we must have a lawful basis for using your data. Here is how we rely on each.

• Create and manage your account, to provide the Service you asked for. Lawful basis: contract.
• Authenticate you, including social and biometric login, to keep your account secure. Lawful basis: contract.
• Process payments via Stripe, to complete transactions you start. Lawful basis: contract.
• Let a business you have allowed charge your saved cards, for deposits, balances, extras you agree to and fees under its cancellation and no show policy. We share a secure reference to your card with that business's Stripe account, and the business never sees your full card number. You can stop any business charging your cards at any time under Account, Payment methods. Lawful basis: contract, with your permission recorded for each business you allow.
• Manage bookings and appointment information, to deliver the service you or a business asked for. Lawful basis: contract.
• Handle special category data, such as health information or appointment images, only where explicit consent has been given. Lawful basis: explicit consent under Article 9.
• Show location based services and maps, to deliver features you turn on. Lawful basis: consent, given through your device permission.
• Send service and account push notifications, to keep you informed. Lawful basis: contract or legitimate interests.
• Keep the App secure and prevent fraud and abuse, to protect you and the Service. Lawful basis: legitimate interests.
• Diagnose problems and improve the App, to keep the App working well. Lawful basis: legitimate interests.
• Understand how the Service is used, so we can improve it, using Google Analytics 4. This is our own product measurement and is not used for advertising. Lawful basis: consent.
• Measure our own advertising on the website only, using the Meta Pixel. This is not present in the App. Lawful basis: consent.
• Email you once when businesses in your country can sign up to Youzse, if you joined our launch waitlist. Lawful basis: consent.
• Comply with legal and regulatory duties, because the law requires it. Lawful basis: legal obligation.

Where we rely on consent, you can withdraw it at any time, for example by changing your in app privacy preferences or your device permissions. Withdrawing consent does not affect any processing we carried out before you withdrew it.

If you enable Face ID, Touch ID or fingerprint login, the matching is performed entirely by your device secure hardware.

Youzse Ltd does not collect, receive, store or have any access to your biometric data. We receive only a simple success or failure signal from your device.

To run the App we rely on a small number of trusted providers who act as our data processors or operate their own services. Each is bound by its own data protection obligations.

• Stripe: payment processing. Stripe handles your card details directly and we do not store them.
• Apple Sign In and Google Sign In: account creation and authentication.
• Cloudflare: infrastructure, routing, security and content delivery. The App is fully integrated with Cloudflare to keep it fast and protected.
• Google Analytics 4: usage analytics for the App and the website, used only with your consent. The property is not linked to Google Ads and the data is not used for advertising.
• Meta Pixel: advertising measurement and attribution for our own adverts. Website only, used only with your consent. The App sends nothing to Meta.

We also use Cloudflare AI Workers on our backend for operational tasks such as generating logos. This is standard automated processing carried out on our own infrastructure to deliver a feature. It does not involve any user facing AI assistant, and we do not use your personal data to train any third party AI model.

Text messages. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

Some of our providers, such as Stripe, Google, Meta and Cloudflare, may process data outside the UK. Where data is transferred outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK data protection law, such as:

• the UK's recognition of a country as providing an adequate level of protection
• a UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses

You can ask us for more detail about these safeguards using the contact details above.

We keep your personal data only for as long as we need it.

• Account data: for as long as your account is active, and for a reasonable period afterwards in case you return.
• Appointment information and images: kept for the limited period set by the business you dealt with, and deleted sooner if you withdraw consent.
• Special category data: kept for a strict and limited period and deleted when it is no longer needed.
• Transaction and payment records: kept for as long as required to meet legal, accounting and tax obligations.
• Diagnostic and usage data: kept for a limited period and then deleted or anonymised.

When we no longer need your data, we securely delete or anonymise it.

Security is our top priority. We use measures appropriate to the risk, including:

• encryption of data in transit and encryption of sensitive data at rest
• protection through our Cloudflare security layer
• access controls so that only authorised people can reach our systems, with access to sensitive data restricted and logged
• biometric authentication that keeps your biometrics on your device and off our servers

No system is ever completely secure, but we work continuously to protect your data, and we have processes to detect, manage and, where required, report any personal data breach to the Information Commissioner's Office within 72 hours.

Under UK data protection law you have the right to:

• be informed about how we use your data, which this Policy explains
• access the personal data we hold about you
• rectification, to ask us to correct inaccurate or incomplete data
• erasure, to ask us to delete your data, also known as the right to be forgotten
• restrict processing in certain circumstances
• data portability, to receive your data in a portable and machine readable format
• object to processing based on legitimate interests, or to direct marketing
• withdraw consent at any time where we rely on consent

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month, and there is normally no charge. Where the data is held by Youzse on behalf of a business as its processor, that business is the controller, so we will pass your request to them and support them in responding.

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

The App is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

If you visit the Website from a country where businesses cannot sign up to Youzse yet, we may offer to email you when they can. This section explains what happens if you join that launch waitlist.

What we keep:

• your email address
• the type of business you run, if you choose to tell us
• the country you chose and the country our infrastructure provider Cloudflare detected from your connection. We use your IP address only to work out the country, and we do not store it with your signup
• the address of the page you signed up on, with anything after a question mark removed
• a record of your consent: when you gave it, which version of the wording you saw and which form you used

What we use it for: to send you one email telling you that businesses in your country can sign up to Youzse. We send nothing else from the waitlist, we do not add you to any other mailing list and we do not sell your details or share them with anyone for their own use. The email is sent through our email provider, listed on our Subprocessors page. Lawful basis: consent, which you give by ticking the box on the form. The box is never ticked for you.

How long we keep it:

• 30 days after we send the launch email, and then we delete it
• if we never send a launch email for your country, 24 months after you signed up, and then we delete it

Leaving the waitlist: the launch email has a one click unsubscribe link. Using it deletes your signup straight away, rather than keeping your address on a list. You can withdraw your consent at any time, and doing so does not affect anything we did before you withdrew it.

You can also ask us to delete your signup by emailing [email protected].

Protecting the form: to stop automated abuse, the form has a hidden field that people do not see, and it uses Cloudflare Turnstile, a security check run by Cloudflare that looks at technical information about your browser and connection to tell people from bots. Only authorised Youzse staff can see the waitlist.

We may update this Policy from time to time. We will change the effective date and, where changes are significant, we will take reasonable steps to notify you in the App.

Contact Youzse Ltd: [email protected].

The addenda below apply if you live in, or your business is based in, one of these countries. Each adds to the rest of this Policy. Where an addendum and the rest of this Policy differ, the addendum applies to people in that country. Nothing in an addendum reduces the protection you have under the UK GDPR or under the law of the country where you live.

Where your data is processed. Our servers and databases are hosted in the United Kingdom. Some of our service providers process data in the European Union, the United States and other countries, as explained in section 9 and on our Subprocessors page. Cloudflare routes and protects internet traffic through data centres in many countries, normally one close to the person using the Service.

Our Privacy Lead. One role at Youzse Ltd is responsible for privacy in every country we operate in. Its title is Privacy Lead, Youzse Ltd. The Privacy Lead is our privacy officer in New Zealand and our data protection officer in Singapore, and is accountable for our compliance with Canadian privacy law. You can contact the Privacy Lead:

• by email at [email protected]
• by post at Privacy Lead, Youzse Ltd, 66 Paul Street, London, England, EC2A 4NA

Businesses that use Youzse. When a business uses Youzse to manage its own customers, the business decides how its customers' data is used, and Youzse acts only on its instructions as its service provider or processor. If you are a customer of a business, please send requests about the data that business holds to the business first. We will help it respond, and if you contact us instead we will pass your request on.

This addendum applies to residents of the United States.

Our role. Most of the personal data we handle about people in the United States is handled for the businesses that use Youzse. For that data we are a service provider, also called a processor, to the business. A written contract limits us to using the data to provide our services to that business, and forbids us from selling it, sharing it for advertising or using it for any purpose of our own. Requests about that data should go to the business, and we will help it respond.

State privacy laws. California, Colorado, Connecticut, Texas, Virginia and a growing number of other states give their residents rights over their personal data. Several of these laws apply only to companies above a size we do not currently reach. Whether or not a particular law applies to us, for the personal data we control we will honour a request from any US resident to:

• know what personal data we hold about you, how we use it and who we disclose it to, and get a copy in a portable format
• correct inaccurate personal data
• delete your personal data, subject to the exceptions the law allows, for example records we must keep for tax purposes
• opt out of the sale of your personal data, targeted advertising and profiling

We do not sell personal data, and we do not use it for profiling that produces legal or similarly significant effects.

On the website only, and only if you accept marketing cookies, the Meta Pixel measures how well our own adverts work. Some state laws treat this as targeted advertising or sharing. You can opt out at any time by changing your cookie preferences on the website. The App sends nothing to Meta.

Sensitive data. Health information a business records, such as allergies noted before a treatment, is sensitive data. It is handled only for that business, on its instructions, and only after explicit consent, as explained in section 5. Addendum B explains how we handle consumer health data.

Making a request. Email us at the address below. We will ask for information to confirm your identity and reply within 45 days. You can use an authorised agent, and we may ask the agent for proof that you authorised them. We will not treat you differently for exercising your rights.

• Email: [email protected]

Appeals. If we decline your request, you can appeal by replying to our decision. We will reply to your appeal within 45 days and explain our reasons. If you are unhappy with the result, you can contact the Attorney General of your state.

This is our consumer health data privacy policy for the purposes of Washington's My Health My Data Act and Nevada's consumer health data law. It applies to consumer health data about residents of those states and to data collected there. We take the same approach in Connecticut and in any other state with a similar law.

What consumer health data is involved. Some businesses on Youzse, such as beauty, aesthetics and wellbeing businesses, ask their customers for health information before an appointment. This can include allergies, skin conditions, medications, pregnancy status, treatment notes and appointment images that may reveal a health condition. The kind of treatment someone books may also say something about their health.

Where it comes from. From you, when you fill in a form or make a booking, and from the business you book with, which records it.

Why it is collected and used. Only to provide the service you booked, for example so the business can carry out a treatment safely. It is never used for advertising, marketing or profiling.

Who it is shared with. With the business you book with, and with the service providers that host, secure and back up the Service, listed on our Subprocessors page, which may use it only to provide their service to us. We do not sell consumer health data, and we do not share it with anyone else unless the law requires it.

Consent. A business must have your consent before it collects consumer health data, and separate consent before it shares it for any purpose other than providing the service you asked for.

Your rights. You can:

• confirm whether consumer health data about you is being collected, shared or sold, and get a copy of it, with a list of every third party and affiliate it has been shared with or sold to and how to contact them
• withdraw your consent
• have your consumer health data deleted, including from our backups within six months

Where we hold the data for a business, that business answers your request and we help it. Where we hold it ourselves, email us at the address below. We will reply within 45 days. If we decline, you can appeal by replying to our decision, and if your appeal is refused you can contact your state Attorney General.

• Email: [email protected]

This addendum applies to individuals in Canada. It reflects the Personal Information Protection and Electronic Documents Act (PIPEDA) and the provincial laws that apply to the private sector. Youzse is not yet available to businesses in Quebec.

Accountability. Our Privacy Lead is accountable for our compliance with Canadian privacy law and can be contacted using the details in the Regional addenda section. If you live in Quebec and book with a business elsewhere in Canada, the Privacy Lead, Youzse Ltd is also our person in charge of the protection of personal information under Quebec's Act respecting the protection of personal information in the private sector.

Consent. We collect, use and disclose your personal information with your consent, which may be express or implied depending on how sensitive the information is and what you would reasonably expect, or where the law otherwise allows. You can withdraw consent at any time, subject to legal or contractual restrictions, and we will tell you what that means for the service we can provide.

Processing outside Canada. Your personal information is stored and processed outside Canada, mainly in the United Kingdom and the European Union, and some of our service providers process it in the United States. While it is outside Canada it is subject to the laws of those countries and may be accessed by their courts, law enforcement and national security authorities. We protect it with contracts and security measures that give it a level of protection comparable to the one it would have in Canada.

Location and tracking. The App uses your location only after you turn on location access in your device settings. Analytics in the App and on the website, and the Meta Pixel on the website only, stay off unless you turn them on in your privacy or cookie preferences.

Access and correction. You can ask for access to the personal information we hold about you and ask us to correct it. We will reply within 30 days.

Breaches. If a breach of our security safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible. We keep a record of every breach of security safeguards for at least 24 months.

Complaints. Contact the Privacy Lead first. You can also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the Information and Privacy Commissioner of Alberta or of British Columbia where their laws apply.

This addendum is our privacy policy for the purposes of the Privacy Act 1988 (Cth). We follow the Australian Privacy Principles (APPs) whether or not the Act strictly applies to us.

What we collect and why. The kinds of personal information we collect and hold, and why, are set out in sections 3 to 6. We collect it directly from you, from the businesses you deal with through Youzse and from Apple, Google and Stripe as described in section 3. We hold it electronically on secured systems, as described in section 11.

Dealing with us anonymously. You can browse the website without telling us who you are. To book an appointment or use an account we need your name and contact details, because the service cannot work without them.

Direct marketing. We only send you marketing with your consent, and every marketing message tells you how to opt out. A business you book with may send you its own marketing, and it is responsible for doing so lawfully.

Overseas disclosure. We are based in the United Kingdom, and your personal information is held mainly in the United Kingdom. Some of our service providers process it in the European Union, the United States and other countries where Cloudflare operates data centres. Before your information leaves Australia we take reasonable steps, including binding contracts, to make sure it is handled consistently with the APPs.

Access and correction. You can ask for access to the personal information we hold about you, or ask us to correct it. We will respond within 30 days, and there is no charge for making a request. If we refuse, we will tell you why in writing and how you can complain.

Complaints. Contact the Privacy Lead first, using the details in the Regional addenda section. We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Data breaches. If we have a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

This addendum applies to individuals in New Zealand and reflects the Privacy Act 2020 and its Information Privacy Principles.

Privacy officer. Our privacy officer is the Privacy Lead, Youzse Ltd, who can be contacted using the details in the Regional addenda section.

Sending information overseas. Your personal information is held mainly in the United Kingdom, and some of our service providers process it in the European Union, the United States and other countries. We disclose personal information to someone outside New Zealand only where Information Privacy Principle 12 allows it. In practice the recipient is either subject to privacy laws that, overall, provide safeguards comparable to the Privacy Act 2020, as the United Kingdom and the European Union are, or bound by a contract to protect the information in a way that, overall, provides comparable safeguards.

Information we hold for businesses. When a New Zealand business uses Youzse, we hold its customers' information only to store and process it on the business's behalf. We do not use or disclose it for our own purposes, so under section 11 of the Privacy Act 2020 the business, not Youzse, is treated as holding it.

Access and correction. You can ask for access to your personal information, or ask us to correct it. We will respond as soon as we reasonably can, and within 20 working days.

Breaches. If a privacy breach causes, or is likely to cause, you serious harm, we will notify you and the Privacy Commissioner as soon as practicable.

Complaints. Contact our privacy officer first. If you are not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

This addendum applies to individuals in Singapore and reflects the Personal Data Protection Act 2012 (PDPA).

Data protection officer. Our data protection officer is the Privacy Lead, Youzse Ltd. You can contact them using the details in the Regional addenda section, or by email:

• [email protected]

Consent and purposes. We collect, use and disclose your personal data for the purposes set out in section 6, with your consent or where the PDPA otherwise allows. You can withdraw consent at any time by contacting our data protection officer, and we will tell you the likely consequences before we act on it.

Transfers outside Singapore. Your personal data is held mainly in the United Kingdom, and some of our service providers process it in the European Union, the United States and other countries. Before we transfer it, we make sure the recipient is bound by legally enforceable obligations, such as a contract, to give it a standard of protection comparable to the PDPA.

Access and correction. You can ask for access to your personal data and for information about how it has been used or disclosed in the past year, or ask us to correct it. We will respond within 30 days, or tell you within that time when we will be able to.

Data breaches. If a data breach is notifiable under the PDPA, we will notify the Personal Data Protection Commission within 3 calendar days of assessing it as notifiable, and we will notify you where it is likely to cause you significant harm.

Complaints. Contact our data protection officer first. If you are not satisfied, you can contact the Personal Data Protection Commission at pdpc.gov.sg.

This addendum applies to individuals in Ireland and elsewhere in the European Union.

The law that applies. When we offer the Service to people in the European Union, the EU General Data Protection Regulation (EU GDPR) applies to our processing of their personal data, alongside local laws such as Ireland's Data Protection Act 2018. The EU GDPR gives you the same rights described in section 12, and we rely on the same lawful bases described in section 6.

Our representative in the European Union. Youzse Ltd is not established in the European Union, so we name a representative there under Article 27 of the EU GDPR. You and the supervisory authorities can contact our representative about anything to do with our processing of your personal data.

We are appointing our representative and will name them here before we start offering the Service in the European Union. Until then, please contact us directly at [email protected].

Transfers. Personal data sent from the European Union to the United Kingdom is protected by the European Commission's adequacy decision for the United Kingdom. Where our service providers process it in other countries, we use the European Commission's standard contractual clauses or another safeguard the EU GDPR recognises.

Complaints. You can complain to the Data Protection Commission in Ireland at dataprotection.ie, or to the supervisory authority in the country where you live or work or where you think the problem happened.

This addendum applies to individuals in Gibraltar.

The law that applies. The Gibraltar General Data Protection Regulation (Gibraltar GDPR) and the Data Protection Act 2004 apply to our processing of personal data about people in Gibraltar when we offer them the Service. They give you the same rights described in section 12. Payments, deposits and gift cards are not yet available through Youzse in Gibraltar.

Our representative in Gibraltar. Gibraltar law requires a company outside Gibraltar, including one in the United Kingdom, to name a representative in Gibraltar under Article 27 of the Gibraltar GDPR.

We are appointing our representative and will name them here before we start offering the Service in Gibraltar. Until then, please contact us directly at [email protected].

Transfers. Gibraltar law allows personal data to be transferred to the United Kingdom. For other countries we use the safeguards described in section 9.

Complaints. You can complain to the Gibraltar Regulatory Authority at gra.gi.