1. Who we are and our role

The controller for the processing described in this policy is Glanevo SRL (Romania, CUI 40041255). Our registered office and registry details are on the Legal Notice page. You can write to us at gdpr@glanevo.com or by post to our registered office. We have not appointed a data protection officer.

Glanevo SRL is the controller for the data of salon accounts (owners and staff with access to the panel), of visitors to glanevo.com, of reviews and of reports about illegal content. For the data that a salon enters about its own clients and staff — appointments, client records and, if the salon records them, allergies or other health notes — the controller is the salon. Glanevo SRL processes those data on the salon's behalf, as its processor, under the Data Processing Agreement. For those data, please contact the salon first; we help the salon to answer you.

2. Data we collect

Account data: name, e-mail address, phone number, salon name, role
Billing data: billing name and address, VAT number, invoices, payment status and a card token (card numbers are processed only by the payment provider)
Usage and security data: access logs, IP address, browser and device data
Messages you send to support or to the chat assistant
Cookies and similar technologies (see the Cookie Policy)
Reviews and reports of illegal content (section 8)

We receive these data from you (sign-up, forms, payment, support), automatically from your browser or device when you use the site or the panel, and from the salon when you book an appointment with a salon that uses Glanevo.

3. Purposes and legal bases

Opening and managing your account, providing the service and invoicing — performance of the contract (Art. 6(1)(b) GDPR).
Accounting and tax records, including electronic invoicing — legal obligation (Art. 6(1)(c) GDPR; Romanian Accounting Law No. 82/1991 and the Romanian Fiscal Code).
Security of the service, fraud prevention and access logs — our legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).
Answering your questions, including through the chat assistant, and improving the service — our legitimate interest in replying to you and improving our product (Art. 6(1)(f) GDPR).
Checking and publishing reviews and handling reports about illegal content — legal obligations under Regulation (EU) 2022/2065 (Art. 6(1)(c) GDPR) and our legitimate interest in publishing genuine reviews (Art. 6(1)(f) GDPR).
Marketing e-mails and non-essential cookies — your consent (Art. 6(1)(a) GDPR; Art. 4(5) of Romanian Law No. 506/2004).

Account and billing data is needed to conclude and perform the contract, and billing data is also required by law; without it we cannot open your account. All other data you give us voluntarily.

4. How long we keep data

Accounting and supporting documents, including invoices: 5 years from 1 July of the year following the end of the financial year (Art. 25 of Accounting Law No. 82/1991); annual financial statements: 10 years (Art. 35(3) of the same law).
Account and contract data: for the duration of the contract and 3 years after it ends (the general limitation period, Art. 2517 of the Romanian Civil Code).
Access and security logs: 1 year as a rule. A salon can set a longer retention for the audit log of its own panel (minimum 1 year, maximum 10 years). The internal audit chain that records administrator actions is kept for 5 years.
Proof of marketing consent: while the consent lasts and for 3 years after it is withdrawn.
Salon data after the contract ends: available for export as described in section 12 of the Terms of Use, then deleted or anonymised, except data we must keep by law.
Chat assistant conversations: kept until you ask us to delete them; automatic deletion after 90 days is prepared and is being switched on, and we will update this policy when it takes effect.

5. Who receives the data

We use service providers (processors) for hosting, the database, payments, e-mail and SMS delivery, AI features, notifications, analytics and error monitoring. The full list, with the location of each provider and the data it processes, is on the Sub-processors page; we announce new sub-processors at least 30 days in advance. We disclose data to public authorities only where the law requires it. If you reached us through a partner link, that partner sees in its own dashboard only the masked form of your sign-up e-mail address (the domain is kept, for example ay****@example.com) and the stage of the conversion, solely in order to check its commission; it never sees your salon’s client data.

6. Transfers outside the European Economic Area

Some of our providers process data outside the European Economic Area, mainly in the United States. We transfer data there only on one of the following bases: the European Commission's adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), for providers certified under it; or the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR).

The Sub-processors page shows where each provider processes data. To find out which safeguard applies to a given provider, or to receive a copy of the standard contractual clauses, write to gdpr@glanevo.com.

7. Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20), and the right not to be subject to a decision based solely on automated processing (Art. 22). You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, and you can object to direct marketing at any time without giving reasons (Art. 21). Where processing is based on your consent, you can withdraw it at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

Send your request to gdpr@glanevo.com. We reply without undue delay and within one month of receiving it; where necessary, this period can be extended by two further months, and we tell you if it is (Art. 12(3) GDPR).

You have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, sector 1, 010336 Bucharest, www.dataprotection.ro, or with the supervisory authority of the EU Member State where you live or work.

8. Reviews and reports of illegal content

If you write a review, we process your display name, the text and rating, the date of your appointment and the e-mail address to which we sent the invitation, so that we can check that you had an appointment and publish the review on the salon's page. Reviews are public.

If you report content that you consider illegal, we process your name, e-mail address and the content of your report in order to handle it (Art. 16 of Regulation (EU) 2022/2065). We do not reveal your identity to the author of the content unless this is strictly necessary (Art. 17(3)(b)).

9. Cookies

We use strictly necessary cookies and, only with your consent, functional, analytics and marketing cookies. The list of cookies, with what each one does and how long it is kept, is in the Cookie Policy.

10. Chat assistant (Glanevo AI)

The chat window in the lower right corner of the site is answered by an AI assistant, "Glanevo AI". To generate a reply, your messages and the conversation history are sent to Anthropic (Claude); if that model is unavailable, a fallback model from Groq or Google (Gemini) is used. We keep the conversations until you ask us to delete them, and we do not share them with third parties for marketing. Automatic deletion after 90 days is prepared and is being switched on; until it takes effect, conversations are not deleted automatically. Legal basis: our legitimate interest in answering your questions (Art. 6(1)(f) GDPR).

Please do not enter passwords, card numbers or identity numbers in the chat. To have your conversations deleted, write to gdpr@glanevo.com.

11. Contact

For any question about this policy or your data: gdpr@glanevo.com, or by post to Glanevo SRL at the address on the Legal Notice page.