Privacy policy

Version 2026-11, in force from 5 November 2026.

This policy follows the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and the Bulgarian Personal Data Protection Act. We keep it plain but precise. If anything is unclear, ask us. The Bulgarian version is the official one.

Who is responsible for your data

The controller of your personal data is Noar Nikol EOOD, UIC 207595289, registered office 17 Krastyo Rakovski St., 4002 Plovdiv, Bulgaria.

The Lacquer Nail Bar salon is at 20 Hristo G. Danov St., 4000 Plovdiv, Bulgaria, phone +359 876 137 536, website wearelacquer.com.

For personal data and anything else, write to hello@wearelacquer.com.

We are not required to have a data protection officer and have none. Your questions are answered by the company's manager, N. Karabelova.

What we collect and why

For each item we say what we keep, why, and the legal basis under Article 6 of the General Data Protection Regulation (GDPR).

Account and loyalty programme

• What: name, email, password (stored only as an encrypted hash that nobody can read), phone and date of birth if you give them, your language, your visits and the discounts you received or used.
• Why: so you can sign in, show your code at the desk and get the discounts under the programme rules.
• Basis: our contract with you under the loyalty programme rules (Art. 6(1)(b)). Phone and date of birth are optional. Without a date of birth there is simply no birthday discount.

News and emails

• Newsletter and campaigns: email, language, and when you subscribed, confirmed or unsubscribed. Subscribing is double opt-in: we add you only after you click the link in our email.
• Birthday greeting: name, email and date of birth, only if you ticked it in your account.
• "We miss you": if you have an account and agreed to receive news, the system sends you one email by itself when you have not visited for a set number of days. It looks only at the date of your last visit.
• Basis: your consent (Art. 6(1)(a)). Withdraw it any time with the "Unsubscribe" link in every email or in "My account". Withdrawing does not make what happened before unlawful.
• We keep a record of when you gave and withdrew consent, so we can show that we email you lawfully (Art. 7(1) GDPR).

Event registration

• What: name, email, optional phone, number of places and a note.
• Why: to register you, send a confirmation with a calendar invite, and tell you if the event changes or is cancelled.
• Basis: the registration is a contract with you (Art. 6(1)(b)).

Event polls and questions

• What: your vote or answer, your name if you write it, and a random number your browser keeps so you vote once. We keep that number only as a fingerprint (hash) that does not show who you are.
• Why: to learn what guests want and, if we tick a written answer, to show it on the event page.
• Basis: our legitimate interest in asking guests (Art. 6(1)(f)). Written answers appear only after we have read them. Please do not write health or other sensitive data in them.

Shop orders

• What: name, phone, optional email, note, the products and the total.
• Why: to prepare the order and call you when it is ready for pick-up at the salon. You pay in the salon.
• Basis: the purchase contract (Art. 6(1)(b)). We cannot take an order without a phone number.

Job applications

• What: name, phone, optional email, experience, a few words about you and a portfolio link.
• Why: to consider your application and contact you.
• Basis: steps before a possible employment contract, at your request (Art. 6(1)(b)).
• Please do not send health data, ID card copies or other sensitive data. They are not needed.

The AI assistant on the site

• What: the text of the chat and its language. To prevent abuse we also keep a fingerprint (hash) of your IP address and browser that cannot tell us who you are.
• Why: to answer your question and to improve the answers. The assistant knows only what the salon has published: services, prices, hours, team, events.
• Basis: our legitimate interest in answering questions quickly (Art. 6(1)(f)).
• If you ask us to call you back, we keep the name, phone or email and the message you leave in the chat and pass them to the team. Basis: your request (Art. 6(1)(b)).
• Please do not write health or other sensitive data in the chat.

Emails to hello@wearelacquer.com

• What: the sender's email and name, the subject, the text, the names of attached files, and our answer.
• Why: to answer you and keep the conversation in case you write again.
• Basis: our legitimate interest in answering emails (Art. 6(1)(f)), and steps before a contract when you ask about a service or an order (Art. 6(1)(b)).
• AI helps write the draft answer. How exactly is described below under "AI and automated decisions".

Google and Studio24 reviews

The site shows public reviews of the salon from Google and Studio24: the name the author uses there, the rating and the text. We take them from those sites, not from you. Basis: our legitimate interest in showing what clients say (Art. 6(1)(f)). If you wrote a review and do not want it on our site, tell us and we will remove it.

Technical data

When you open the site, the hosting servers log your IP address, browser and the page, for security and to keep the site running. Basis: legitimate interest (Art. 6(1)(f)). What we store in your browser is described in the "Cookie policy".

Booking appointments

Appointments are booked in Studio24 (studio24.bg). When you click "Book", you go to their site. There Studio24 is responsible for your data, under its own privacy policy.

Do you have to give us data

No law requires you to give us personal data. Some data is needed to do what you ask, though: without an email there is no account and no emails, without a phone we cannot take an order, and without a name and a way to reach you we cannot register you for an event or call you back. Anything marked "optional" you can leave out.

What legitimate interest means here

Where the basis is legitimate interest, we have weighed it and found it necessary for the normal running of the salon and not overriding your rights: answering questions, protecting the site from abuse and showing public reviews. You can object (see "Your rights").

AI and automated decisions

We use the Claude language model by Anthropic in three places:

• The assistant on the site answers by itself, straight away. Under the chat it says that an AI answers, as Art. 50 of the EU Artificial Intelligence Act (2024/1689) requires. It does not book appointments, take orders or promise discounts.
• In the hello@ mailbox the AI reads the email and writes a draft answer. At present every answer is sent only after a person from the salon reads and approves it. If we ever let simple answers (such as opening hours) go out by themselves, we will say so here.
• Staff use an AI helper in the admin panel that can see orders, applications and emails when they ask about them. The helper in Telegram sees no client data.

We never take a decision based solely on automated processing that has legal or similarly significant effects on you (Art. 22 GDPR). Loyalty discounts follow simple rules (3rd and 6th visit, birthday), and the "We miss you" email looks only at the date of your last visit. If you want a person to look at something, write to us.

Anthropic processes the text only to return an answer, under a contract with us, and does not use it to train its models.

Who receives your data

We do not sell data or give it out for advertising. We use providers who process it only on our instructions and under contract:

• Supabase: database, account sign-in and files. The servers are in the EU, in Frankfurt.
• Lovable and Cloudflare: hosting of the site and protection from attacks.
• Resend: sending our emails and receiving the emails to hello@. It sends from servers in the EU, in Ireland.
• Hostinger: the hello@ mailbox (EU).
• Anthropic: the language model behind the AI assistant, the mailbox drafts and the admin helper.
• Google: the map on "Contact" (only if you allow it), visit statistics (only if you accept them) and the Google reviews.

The team gets short notices in Telegram, such as "new order L-4821, €34". They contain no name, phone, email or text from your message. The details are visible only in the admin panel.

We give data to public authorities only when the law requires it.

Transfers outside the EU

Supabase, Cloudflare, Resend, Anthropic and Google are US companies. When data reaches them outside the European Economic Area, this happens under the safeguards of Chapter V GDPR: the EU–US Data Privacy Framework for certified companies and the standard contractual clauses approved by the European Commission. You can ask for a copy of the safeguards at hello@wearelacquer.com.

How long we keep data

After the periods below, the system deletes the data by itself every night.

• Account, visits and discounts: as long as the account exists. You delete it yourself in "My account" → "Delete my account". If you have not visited or signed in for 3 years, we delete it together with its visits.
• News by email: until you unsubscribe. After that we keep only the address marked as unsubscribed, so we do not email you again.
• A newsletter sign-up you did not confirm with the link in the email: 30 days.
• The record of consents given and withdrawn: your latest choice is kept while it stands, as proof. An older record replaced by a newer one is deleted after 5 years. If you delete your account, the record is kept 5 more years, unless your address is on the newsletter list.
• Who received which email (campaigns, birthday greeting, "We miss you"): 2 years.
• Event registrations: 12 months after the event.
• Event votes and answers: 12 months after the event.
• Shop orders: 12 months after pick-up or cancellation. The till receipt is kept under accounting rules.
• Job applications: 6 months after the decision on the application. If there is no decision, 12 months at most.
• AI assistant chats: 90 days, then deleted automatically every night.
• Call-back requests from the chat: 6 months.
• Emails to hello@: 2 years from the last email in the conversation.
• Technical logs: as long as the hosting and Supabase keep them, usually days to weeks.
• Accounting documents: 10 years, as the Bulgarian Accountancy Act requires.
• Admin change log: for every change to orders, visits and financial records we keep who changed what, for accountability and security. It is kept as long as the accounting documents, up to 10 years. Basis: legal obligation and legitimate interest (Art. 6(1)(c) and (f)).

Your rights

Under the GDPR you have the right:

• of access: to learn whether we hold data about you and get a copy (Art. 15);
• to correct wrong or incomplete data (Art. 16);
• to erasure, when we no longer have a reason to keep it (Art. 17);
• to restriction, for example while we check whether data is correct (Art. 18);
• to receive the data you gave us in a machine-readable form, or have us pass it on (Art. 20);
• to object to processing based on legitimate interest (Art. 21). You can always object to news emails, and then we stop;
• not to be subject to a solely automated decision with significant effects (Art. 22). We take no such decisions;
• to withdraw consent at any time, without affecting what was done before.

**Right to object (Art. 21 GDPR).** You can object at any time to processing based on legitimate interest: the AI assistant, emails to hello@, reviews and technical data. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data for a legal claim. You can always object to newsletters, and we stop straight away.

You can do much of this yourself: in "My account" you correct your name and phone, turn emails on and off, and delete the account. For anything else write to hello@wearelacquer.com or tell us in the salon. We may ask something to make sure it is you. We answer within one month. For many or complex requests this can extend to three months, and then we tell you why. We charge nothing, unless requests are clearly unfounded or excessive.

Complaints

If you think we are breaching your rights, you can complain to the Bulgarian Commission for Personal Data Protection (КЗЛД): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, phone +359 2 91 53 518, kzld@cpdp.bg, www.cpdp.bg. You may also complain to the authority in the EU country where you live or work. We would be glad if you wrote to us first, so we can fix it together.

Children

Accounts and subscriptions are for people aged 14 or over (Art. 25c of the Bulgarian Personal Data Protection Act). You confirm this with a tick when you sign up. If you are under 14, ask a parent to do it with you. If we learn that we received data from a child under 14 without a parent's consent, we will delete it.

Security

The connection to the site is encrypted (HTTPS). Passwords are stored only as an encrypted hash. Only salon staff can enter the admin panel, with two-factor sign-in, and each person sees what they need for their work. The database keeps each kind of data behind its own access rules. If a breach ever puts your rights at risk, we will notify the Commission within 72 hours and you without undue delay, as the law requires.

Changes

When we change this policy, we publish the new version here with its date. If we change something important, such as a new purpose or a new provider outside the EU, we will also tell you by email or on the site. When a change affects consent, we will ask you again.