Privacy Notice

Who this notice covers

This notice explains how BeLuMae handles personal information through the BeLuMae mobile application, this website, our early-access programme, and support. BeLuMae is operated from South Africa and this notice is written to support the Protection of Personal Information Act (POPIA) and, where applicable, privacy laws such as the EU and UK GDPR and similar international laws.

Our role and the studio’s role

For account, subscription, security, support, and product-operation information, BeLuMae acts as the responsible party or controller. Lash professionals and studios decide why and how their clients’ contact details, appointment notes, result photos, and lash maps are collected. For that client-record information, the studio is generally the responsible party or controller and BeLuMae acts as its service provider or operator when cloud features are used.

If you are a client of a lash professional using BeLuMae, contact that professional first about your appointment record. They are best placed to identify and action your request.

Information we process

Depending on how you use BeLuMae, information may include studio and account details; client names and contact details; appointment dates, services, notes, lash maps, and result photos; subscription and entitlement status; support messages; security and diagnostic information; and early-access application details such as technician name, salon name, contact details, weekly client volume, and social profile links.

BeLuMae is not designed for medical records, health histories, allergy records, identity documents, payment-card numbers, or other unnecessary sensitive information. Please do not enter that information in client notes.

Free local use

The Free app can be used without a BeLuMae account. Studio settings, client details, appointment notes, lash maps, and photos are stored in app-controlled storage on the device. Free client content is not uploaded to BeLuMae cloud storage. It remains on the device until the user deletes it, clears the app’s data, or removes the app in a way that deletes local storage.

Pro accounts and cloud features

If a user chooses Pro, Clerk processes authentication, RevenueCat helps verify subscription entitlements, Apple or Google processes the store purchase, and Cloudflare provides the application programming interface, database, private object storage, security, and delivery services used for cloud backup and restoration.

BeLuMae does not receive or store full payment-card details. Apple or Google controls payment processing, receipts, refunds, and the payment information associated with the user’s store account.

Why and how we use information

We use information to provide local records and optional cloud backup; authenticate Pro users; verify subscriptions; protect the service; respond to support and privacy requests; operate the early-access programme; prevent abuse; improve reliability; and comply with law. Private client content is not sold, used for advertising, or sent to advertising analytics.

Where a legal basis is required, we rely on performing our agreement with the user, legitimate interests in operating and securing BeLuMae, consent where requested, and compliance with legal obligations. A studio remains responsible for establishing its own lawful basis for client records and photographs.

Service providers and disclosures

We disclose information only as needed to vetted providers supporting BeLuMae, including Cloudflare, Clerk, RevenueCat, Apple, Google, and Brevo for early-access forms and related communications. Each provider processes information under its own terms and privacy commitments. We may also disclose information where legally required, to protect rights or safety, or in connection with a genuine business reorganisation subject to appropriate safeguards.

We do not sell personal information and do not share private client records for cross-context behavioural advertising.

International processing

BeLuMae and its providers may process information outside the user’s country. Where required, we rely on appropriate contractual, organisational, and technical safeguards for international transfers, including provider data-protection terms and recognised transfer mechanisms. Mandatory local privacy rights are not waived by this notice.

Retention, export, and deletion

Local records remain until the user deletes them or the device’s app data is removed. The app provides controls to export structured records and delete appointments, clients, photos, and all BeLuMae data. Pro account deletion removes account-scoped BeLuMae cloud records and private photos, subject to limited records retained where necessary for security, fraud prevention, dispute resolution, or law.

Early-access submissions are kept while the testing programme is active and for a reasonable follow-up period, unless the applicant asks us to delete them sooner. Provider transaction and tax records may be retained by Apple, Google, or other providers under their own legal obligations.

Your rights and choices

Depending on location, a person may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal information, withdraw consent, and complain to a privacy regulator. In South Africa, complaints may be made to the Information Regulator. EU and UK residents may contact their relevant supervisory authority.

A user can unsubscribe from early-access marketing messages using the link in an email or by contacting us. Withdrawing marketing consent does not affect essential service or legal communications.

Security and children

We use device-controlled storage, encrypted network connections, private object storage, verified authentication, account-scoped authorisation, data minimisation, and other reasonable technical and organisational safeguards. No system can guarantee absolute security, so users should protect their device and account and report suspected misuse promptly.

BeLuMae is a professional business tool and is not directed to children. A studio must not record a minor unless it has a lawful basis and any consent required from a parent or guardian.

Changes to this notice

We may update this notice when the product, providers, or legal obligations change. The revised version will be posted at this address with a new effective date. We will provide additional notice when a material change requires it.