1. Who We Are

GlowBook ("GlowBook", "we", "us", "our") is a pre-launch beauty and wellness marketplace platform targeting the London market. It is operated by Aleksander Kulyk, trading as GlowBook, based in the United Kingdom.

For the purposes of UK data protection law, Aleksander Kulyk / GlowBook is the data controller in respect of personal data collected through this website (glowbook-landing.vercel.app) and any associated pre-launch services.

You can contact our data controller at any time:

• Email: oleksandrkulyk61@gmail.com
• WhatsApp: +44 7350 175 441

2. Data We Collect

We collect the following categories of personal data:

2.1 Data you provide directly

Data	When collected	Why
Full name	Waitlist sign-up form	To personalise your waitlist experience and communications
Email address	Waitlist sign-up form	To contact you about the launch and manage your waitlist position
Role preference	Waitlist sign-up form	Client, professional, or salon owner — to tailor launch updates
Referral code	When you share your referral link	To track referrals and award priority positions
Partner enquiry details	Partner inquiry form (optional)	Name, email, organisation type, message — to process partnership requests

2.2 Data collected automatically

Data	Source	Why
UTM parameters	URL query string	To understand which marketing channel referred you
Referring URL / source	URL query string	Referral attribution
IP address	Supabase (database host)	Security, fraud prevention, geographic analytics — processed by Supabase, not stored separately by us
Browser / device type	Supabase logs / Vercel logs	Security and analytics — not linked to your identity
Timestamp	Sign-up event	To establish your waitlist position

We do not collect payment card details, government-issued ID, or any special category data (as defined under Article 9 UK GDPR) through this website.

3. How We Use Your Data

We use your personal data only for the following purposes:

• Waitlist management — maintaining your position in the launch queue, calculating referral counts, and displaying the public leaderboard (first name + referral count only).
• Launch communications — sending you updates about GlowBook's progress, early-access invitations, and launch announcements to the email address you provided.
• Referral programme — crediting you with referred sign-ups and awarding priority access.
• Partnership enquiries — responding to business partnership or collaboration requests you submit via our partner form.
• Analytics and improvement — understanding aggregate demand by user type and geography (borough) to guide product development. This is done on an anonymised or pseudonymised basis.
• Security and fraud prevention — preventing abuse of the waitlist (e.g., duplicate or fraudulent sign-ups).

We will not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis to process your personal data. We rely on the following:

Processing activity	Legal basis
Managing your waitlist entry and position	Legitimate interests (Article 6(1)(f)) — our legitimate interest in running a pre-launch waitlist service, balanced against your interest in fair and transparent data use
Sending you launch updates and communications	Consent (Article 6(1)(a)) — you provide consent by voluntarily submitting your email via the sign-up form, which clearly states its purpose. You may withdraw consent at any time.
Referral attribution and leaderboard	Legitimate interests — operating the referral programme as part of the pre-launch service
Partner enquiry processing	Legitimate interests — responding to business enquiries you initiate
Security and fraud prevention	Legitimate interests — maintaining the integrity and security of the service

Where we rely on legitimate interests, we have conducted a Legitimate Interests Assessment (LIA) and concluded that our interests are not overridden by your rights and freedoms, given the nature of the data (non-sensitive, limited scope), the limited processing, and the reasonable expectations of someone joining a pre-launch waitlist.

5. How Long We Keep Your Data

We retain personal data only for as long as necessary:

• Waitlist data — retained until GlowBook launches and you are offered access, or for a maximum of 24 months from the date of sign-up, whichever is earlier. If GlowBook does not launch within 24 months, waitlist data will be securely deleted.
• Partner enquiry data — retained for 12 months following the conclusion of our response, unless an ongoing commercial relationship is established.
• Deletion on request — you may request deletion of your data at any time (see Section 7). We will action verified deletion requests within 30 days.

When data is no longer needed, it is securely deleted from our database and any backups within a reasonable timeframe (typically 30 days from scheduled deletion).

6. Third Parties & International Transfers

We share data with the following third-party processors who act on our behalf:

Processor	Role	Data shared	Safeguards
Supabase, Inc.	Database and backend hosting	All waitlist data (name, email, role, referral count, timestamps)	UK/EU Standard Contractual Clauses (SCCs); Supabase data hosted in EU (West) region. See Supabase Privacy Policy.
Vercel, Inc.	Web hosting and content delivery	Server access logs (IP, user agent, timestamp) — not stored by us	UK/EU SCCs. See Vercel Privacy Policy.
Google Fonts	Font delivery	Your IP address (sent to Google's CDN on page load)	Google LLC — UK Adequacy decision / SCCs. See Google Privacy Policy.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We do not share data with social media platforms for advertising purposes.

International transfers: Some processors are based in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place under Article 46 UK GDPR (typically the International Data Transfer Agreement (IDTA) or SCCs adopted by the UK ICO).

7. Your Rights Under UK GDPR

As a data subject under UK GDPR and the Data Protection Act 2018, you have the following rights:

Right	What it means
Right of access (Art. 15)	Request a copy of all personal data we hold about you (Subject Access Request / SAR).
Right to rectification (Art. 16)	Ask us to correct inaccurate or incomplete data.
Right to erasure (Art. 17)	"Right to be forgotten" — request deletion of your data. We will comply unless we have an overriding legal obligation.
Right to restriction (Art. 18)	Ask us to pause processing while a dispute about accuracy or legal basis is resolved.
Right to data portability (Art. 20)	Receive your data in a structured, machine-readable format (JSON / CSV).
Right to object (Art. 21)	Object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent (Art. 7(3))	Withdraw consent for email communications at any time, without affecting prior lawful processing.
Right not to be subject to automated decisions (Art. 22)	We do not make automated decisions with legal or significant effects — this right is preserved but not currently applicable.

To exercise any of these rights, contact us at oleksandrkulyk61@gmail.com with "Data Rights Request" in the subject line. We will respond within one calendar month of receiving a verified request (we may ask you to verify your identity).

You also have the right to lodge a complaint with the UK supervisory authority:

We encourage you to contact us first so we can attempt to resolve your concern directly.

8. Cookies & Local Storage

We do not use tracking cookies or third-party advertising cookies on this website.

We use browser localStorage (not cookies) to store your preferences locally on your device:

Key	What it stores	Expires
gb-theme	Your colour-theme preference (light or dark)	Until cleared by you
gb-lang	Your language preference	Until cleared by you
glowbook_user_v3	Your waitlist entry (email, referral code) to restore your dashboard on return visits	Until cleared by you

localStorage data never leaves your browser and is not transmitted to our servers. You can clear it at any time via your browser settings.

Google Fonts may set performance cookies as part of its CDN delivery. These are covered by Google's Privacy Policy and are considered strictly necessary for rendering the page typography.

In accordance with the Privacy and Electronic Communications Regulations 2003 (PECR), we rely on the "strictly necessary" exemption for the localStorage items above, as they are essential for the service to function as requested by you.

9. Children's Privacy

This website and the GlowBook waitlist are not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has submitted data to us, please contact us immediately at oleksandrkulyk61@gmail.com and we will delete the data promptly.

If you are aged 13–17, please ensure you have parental or guardian consent before submitting any personal data.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, legal requirements, or the scope of our service. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Where practicable, notify existing waitlist members by email at least 14 days before the change takes effect.
• For significant changes affecting your rights, seek fresh consent where required.

Your continued use of the website after the effective date constitutes acceptance of the updated policy, to the extent permitted by law.

11. How to Contact Us

For any questions, concerns, or data rights requests relating to this Privacy Policy or our data processing activities, please contact: