Skip to content
EN
Get the app

Legal

Privacy Policy

Last updated · version 1.26

The English text is a translation of the Lithuanian original; in case of conflict the Lithuanian version prevails.

1.Who processes your data

Your personal data is processed by Gloumi as the data controller. Data is processed in accordance with the General Data Protection Regulation (GDPR).

There are two exceptions, and they matter. What a master writes down ABOUT YOU in their private notes, they collect for their own purposes: there the data controller is the master, and Gloumi only stores those records on their instructions. Address such notes to the master; if they do not reply, write to us and we will help you reach them.

The second exception is published content. When you or a master publish a post, photo or review that contains another person’s personal data, Gloumi and the user who uploaded it are jointly responsible for publishing it, as joint controllers (Article 26 GDPR). The uploader is responsible for having the right to publish that data, for example the consent of the person shown. Gloumi is responsible for the security of the app, for handling reports about content and for removing unlawful content. You can contact Gloumi about such content (support@gloumi.lt or the “Report” button): we will remove or restrict it ourselves or pass your request on to the uploader. The person shown in a photo or other content is informed about the publication, and their consent is obtained, by the user who uploads it; how Gloumi processes the data is explained by this Privacy Policy. You can exercise your rights against Gloumi and against the uploader alike: Gloumi handles your request itself, even where it concerns the obligations of the uploader. Joint control covers only publishing and displaying the content in the app and on gloumi.lt; the uploader alone is responsible for how they use the content outside Gloumi, and Gloumi alone for its use on the social media accounts and in the advertising of Gloumi.

Gloumi has not appointed a data protection officer and is not required to under Art. 37 GDPR. For any data question write to privatumas@gloumi.lt - we answer within one month, and in more complex cases may extend that by a further two months, telling you so.

2.What data we collect

We only collect the data needed for the app to work:

  • Account data: name, username (and previous usernames – for 30 days after a change), email address, phone number (optional), date of birth, country, device region (to determine the age limit for consent), gender (optional, masters only), profile photo, a short description about yourself (optional), the app language (search and the feed are ranked by it and by English).
  • Master data: service list, prices, working hours, city, portfolio photos, business phone number and email address, business address and map location, social media links, company name and code (if you work through a company), description, cancellation terms, languages, service translations, the country where you provide services and since when you have been working (signed-in users see all this in the app).
  • Calendar time blocks and their notes: the time you blocked and your note on it (other users only see that the time is taken; the note is visible only to you) and, if you switched them on, the reminders about them. If you write the data of another person in a note, we process it on your instructions, like private notes about clients (see “Who processes your data”).
  • Data on invoices issued to masters: first name and surname or company name, one code you choose for the invoice (VAT code, company code, individual activity certificate or business licence number, or personal code; if you do not choose, by your form of business; for a VAT payer also the VAT code), business email, the invoice number, date, period and lines (visit dates, turnover, commission, Stripe fee, debt). We process it to meet a legal obligation under accounting law.
  • Booking data: the chosen service, date, time, status and deposit information, and for clients under 18 also the confirmations of a parent's or guardian's consent (by the client and by the master) and their time; also your wishes and inspiration photo, whether you came, who cancelled the visit and when, the compensation kept by the master and warnings about frequent cancellations or no-shows. If you cancel a visit a master booked you in for by tapping “This isn’t my visit”, we record that too (the visit, the master, the time), so that we can spot masters who book people in without agreement (legitimate interest – fraud prevention); this record is kept like booking records. Also waiting-list entries (the master, the wanted date, when we notified you) and your reports that a visit did not take place, with the reason you gave, their status and the decision.
  • If a visit is more than 5 days away, your card is saved by Stripe – Gloumi never sees its details. You can pick the saved card for later visits or remove it in the payment sheet; it is removed when you delete your account.
  • Content: Stories and Story albums, posts, reviews and photos added to them (visible to all signed-in users), chat messages and reactions to them, chat read markers (the other participants see when you read a message) and the history of in-app notifications. When you view another user's Story, its author sees your name, profile photo and when you viewed it; when you like a Story, they see your name and profile photo and may be notified of it. If you are under 18, to other users – in Story views and likes, comments, reviews and chats – you appear as “Junior user”, with no name, username or profile photo, you are not shown to others in follower lists, and your profile cannot be opened or found in search; only a master you follow, or with whom you booked a visit yourself that was confirmed or took place, sees your name and photo (see “Account and roles” in the Terms of Use). Until a date of birth is entered, an account that is not a master's appears the same way. When you turn 18, your name and photo will automatically be shown everywhere, including on comments, likes and reviews you left earlier; we will remind you in the app 14 days before, and until then you can delete comments and reviews and remove likes. Notifications already sent keep “Junior user”. Your review of a master is shown on their profile to all users together with your name, profile photo and the date. If you allowed it when writing the review, it is also shown on the master's public page on the gloumi.lt website, which anyone can see and search engines can find – only with your first name and the initial of your surname, without a photo. We do this on the basis of your consent; you can withdraw it at any time by editing the review, and the review is then removed from the website. The master may reply to it publicly; the reply is shown under the review and is deleted together with it. If the visit was marked as having taken place automatically, we keep with the review the fact that you confirmed the visit took place, and when – this shows the review is genuine. We keep a record of when you confirmed that you only upload content whose people have agreed to it being published and, when you upload a photo or video showing another person’s skin or body condition, of when you confirmed that person’s explicit consent. We also keep your confirmation before your first Story (that you are 18 or older and will comply with the content rules), with its time and the version of the Terms in force at that moment.
  • Ratings of you as a client: after a completed visit, a master can rate you with stars (1 to 5) and write a short review. The star average and the number of ratings are seen by you and by masters with whom you have or had a visit, not by other users; who rated you and the written reviews are seen in the app only by those masters (you also get them in a copy of your data).
  • Social activity: whom you follow, your likes, comments, saved posts and masters, and the Stories you viewed. Which masters you follow is shown in masters’ follower lists and in your following list, which all signed-in users can see; if you are under 18, only that master sees that you follow them, and others see only the total number of followers. Only the author of a Story sees that you liked it. Your likes under posts and your comments are visible to all signed-in users (if you are under 18 – as a “Junior user”).
  • Content language: we detect the language of posts and Stories automatically from their text and keep it with the post, so that search and the feed can be ranked by your app language and by English (performance of the contract). It is a label on the post: it does not profile you or decide anything about you, and it is deleted together with the post.
  • Checking content before it is published: we check the text of content that other users can see against word lists on our server; we do not pass it to third parties. Photos and videos that will be published openly are checked for explicit sexual content by the app on your device: the image is not sent anywhere for this, and the server receives only a flag that the content is awaiting review, and the version of the checking tool. We do not recognise faces, age or any other personal characteristics. If text is held back and you do not ask for a review, we do not keep it. We keep review requests and decisions (what was submitted and when, the category of the reason, the decision and its date, and for text also the text itself) for 6 months from the decision – the time in which it can be appealed; a checksum of approved text is kept for 30 days, while you can publish it (legitimate interest – user safety and compliance with the Terms; Digital Services Act). A person makes the review decision. We do not check the content of private chats automatically.
  • Gloumi points, coupons, invitations and gift cards: how many points you earned and for what (visits, invitations), your coupons and their use, your gift card balance and its movements, any remaining earlier credit, and who bought or activated a gift card and when. When you sign up with an invitation code, we record who invited you and check within 90 days of your sign-up whether the visits named in the invitation terms have taken place; the person who invited you sees that you signed up with their code, when, and whether the condition is still pending, met or expired, but does not see your visits, amounts or masters. We do this to run the invitation programme described in the Terms (Article 6(1)(b) GDPR). Whoever buys a gift card gives the recipient’s name and a message, which are shown on the card; the buyer passes the card code to the recipient themselves. If we refund a gift card balance when you delete your account, we keep the bank account, account holder and contact email you gave; we also keep the date on which you withdrew from a gift card purchase.
  • Support requests, content reports and blocks: your requests and reports, their status and our decisions, and the users you have blocked.
  • The website form for masters: name, email, phone, city, field, a link to your work and your message (optional fields only if you fill them in).
  • Location data: approximate or precise location – only if you grant permission. It is used to find nearby masters and to order the feed (posts from masters closer to you appear higher), except if you have switched personalisation off and for users who, by the date of birth they gave, are under 18. Your last known location is stored with your account only while the personalised feed is on (switching it off deletes it), and is never shown to other users. We do not ask users under 16 whom we cannot establish to live in Lithuania for their location or store it – they find masters by city or on the map (see “Children’s privacy”).
  • Calendar: if you tap “Add to calendar” on a visit and allow it, the app creates an event on your phone with the service, the master, the time and the address. Gloumi does not read your calendar entries and receives nothing from your calendar on its servers; the event is then handled according to your calendar settings (for example, it may sync with your iCloud or Google account).
  • Interaction data: which posts in the feed you were shown, opened, shared or tapped "Book" on (kept for 30 days), and your interest in service categories worked out from your actions. They are used to order the feed (see Ranking of results in the terms of use), but not to personalise your feed if you have switched personalisation off, nor for users who, by the date of birth they gave, are under 18; they are deleted together with your account. If you tap “Not interested” on a post, we record that post, its master, its category and the time – so that we no longer show you that post and, if your personalised feed is on, show similar posts less often. The master does not see this; the record is deleted after 90 days, or earlier together with your account or the post.
  • Technical data: device type, OS version, push notification token, crash reports and, when you contact support, the app version. When you sign in, our authentication provider Supabase uses your IP address to limit sign-in attempts and for security. When you write a message or comment in the app, report content, create a booking, follow or unfollow a master, or take another action that sends a notification to another user, or ask for a review of held-back text, we compute a hash of your IP address with a secret key to limit too frequent actions and abuse (legitimate interest – security); we do not store the address itself. On the website form, too, we keep only a hash of the IP address, not the address itself. When you sign up, sign in with a password, reset your password, ask for a new sign-up code or ask for sign-in help on gloumi.lt, Cloudflare Turnstile checks that you are not a bot; for this it receives your IP address and technical data about your browser and device. This is necessary to protect accounts, so we do not ask for consent (legitimate interest – security). We do not store the check token or Cloudflare’s response ourselves; if a check fails, an error code stays in the server logs for up to 7 days.
  • Consent records: which version of these documents you accepted and when, whether you agreed to receive news and when, and when you allowed or withdrew permission to show a review on the website; for masters, also their acceptances of the Terms for Masters and Salons (including when creating a salon) and the confirmations they gave on registration (for example that they hold a permit-hygiene passport), with the version of the terms and the time. They are kept with your account and are never shown to other users in the app. After the account is deleted, we keep a minimal record of them (the kind of consent, the version and the time, the former account identifier, for news consents the age limit and country applied, and instead of the email address only a hash of it) in a closed archive, so that we can defend ourselves in a dispute (see “How long we keep data”). A master’s registration confirmations are not archived – they are deleted with the account.

4.Masters' tax data (DAC7)

If you are a master, Council Directive (EU) 2021/514 (DAC7) and the Lithuanian Law on Tax Administration require us to collect your details and report them to the State Tax Inspectorate each year: name and surname or company name, home address (for a company, its registered address), date of birth or company code, tax identification number and the country that issued it (or, if you have none, your place and country of birth), country of residence or registered office, VAT number (if any) and, for a company, any permanent establishment in another EU country through which the services are provided, as well as the consideration by quarter for services booked through Gloumi (including those paid on site), the commissions and fees deducted by Gloumi and the number of services.

We process this data to comply with a legal obligation. We check the validity of a VAT number in the European Commission’s VIES system; only the number and the country that issued it are sent to it. The tax identification number, name as in the identity document and birth details are never shown to other users; the business address and company name and code are shown on the master profile (see “What data we collect”). The data is kept for as long as tax law requires: when the account is deleted, we keep the DAC7 details, the records of requests and reminders and the calculated amounts until the end of the year of deletion and for 5 more years, and then delete them. You receive a copy of the data reported to the State Tax Inspectorate by 31 January of the following year.

5.Is providing data mandatory

Some data is necessary to perform the contract, and without it the service simply would not work. An email address is needed for the account and for booking notifications; a name so that the master knows who to expect; a username so that your account can be told apart from others; a date of birth and country to check the age limit. Without these we cannot create an account.

Everything else is your choice, and declining costs you only that one feature: without a phone number Gloumi cannot call you when it needs to reach you urgently about your visit or account, without location we cannot show the nearest masters (and distance in the feed is counted from the centre of Vilnius), without notification permission you will not get a reminder about your visit.

We process data following the GDPR principles: only for clearly stated purposes, only as much as those purposes need, no longer than needed, and in a way that keeps it accurate and secure.

6.Where we get data that you do not give us yourself

You provide most of the data yourself. But some of it arrives another way, and you should know about that:

  • From a master - when they book you in themselves, mark whether you came, assign you a colour label in their calendar or write a private note about you.
  • From another user – when they tag you in a Story, or, as a master, rate you as a client (see “What data we collect”). Other users may report your content or profile, and a client may write a review of you as a master and report that a visit did not take place.
  • From Apple or Google - signing in with their account gives us your name and email address (with Apple, a private relay address if you choose that). With Apple, we also keep a refresh token so that we can revoke Sign in with Apple when you delete your account; with Google, the Google account identifier that Google passes on.
  • From Stripe - payment status, refunds, card dispute data and the result of a master identity check. We never receive the full card number; in the payment confirmation we keep only the card type, the last 4 digits and, if you paid with Apple Pay or Google Pay, the wallet.
  • From the device itself - technical data and crash reports when the app fails.
  • From Apple and Google (through RevenueCat) – a master’s subscription events; from a salon owner – an invitation to join the salon; from the buyer of a gift card, if someone gave you one – your name, email address and the message.

7.Who we share data with

We do not sell your data. It is shared only with service providers that help us operate:

  • Supabase – account authentication and the database.
  • Cloudflare R2 – storage of photos, videos and voice messages.
  • Cloudflare Turnstile – checking that a person, not a bot, is signing up or signing in. It receives the IP address and technical data about the browser and device: it processes them on our behalf to detect bots and, as a separate controller on the basis of its own legitimate interest, to improve its bot detection. It does not use them to identify, profile or target individuals.
  • Stripe – payment processing, payouts to masters and master identity verification (KYC).
  • Expo – delivery of push notifications to your device.
  • Apple / Google – signing in with an Apple or Google account, subscription processing, and the map in the app (Apple Maps on iOS, Google Maps on Android). For the map they receive the area shown, technical data about your device (such as the IP address) and, if you allowed location access, your location on the map; they process this data as independent controllers under their own privacy policies. Push notifications are also delivered to your device through Apple and Google systems (Apple Push Notification service, Firebase Cloud Messaging), which receive the notification content and the device token.
  • Sentry – collection of error reports so we can fix app failures. Data is stored in the EU.
  • RevenueCat – verification and status of a master subscription. Receives your account identifier and purchase data from the App Store or Google Play; neither they nor we receive your payment card details.
  • Resend – sending emails: sign-up confirmation, password reset and other account emails, and emails from the forms on gloumi.lt. It receives your email address and the content of the email.
  • Vercel – hosting the gloumi.lt website, its forms and the administration portal. It processes technical data of website visitors (such as the IP address) and the data entered in the forms.
  • UAB Bartus pro (domenai.lt) – the support@gloumi.lt and info@gloumi.lt mailboxes, through which we receive your emails, content reports, data requests and complaints. It receives the content of the emails and the sender's email address.
  • Accounting service provider (bookkeeper) – keeps MB Gloumi's accounts and handles its taxes. Receives invoice, payment and tax data only as far as accounting needs it, and acts on our instructions.
  • Anthropic – AI tools we use to build and maintain Gloumi. It may receive data we review while handling your request or fixing a fault; it does not use them to train models.
  • The master you book with can see your name, photo and visit history. If you are a gold Gloumi points member, the master sees a gold-level badge next to your visit. The master does not see your phone number or email address – you talk to them in Gloumi chats. A master may add you to one of their client groups – manually or automatically, based on the number of completed visits with them – and show some of their times only to members of that group. You do not see group names, and times you cannot book are simply not shown to you. The master manages groups as an independent data controller (as with their private notes about clients – see the Terms for Masters and Salons); Gloumi stores them on the master’s instructions, and membership is deleted together with your or the master’s account.
  • We provide data to the police, courts and other public authorities only when the law or an order from an authority requires it, or when someone's life or safety is under threat (see section 22).
  • The name, the form of address by the gender given in the profile, specialty, city and district, style tags, working hours, photo, description, services with their prices and cancellation terms and up to 24 works – only those uploaded after the confirmation under the Terms, and never skin or body condition photos – of a master who has turned on “Show my page on gloumi.lt” are shown on a public page at gloumi.lt, which search engines can find and show (they are separate controllers); contact details and the exact address are not shown there; reviews appear there only with their authors' permission. The master can turn the page off at any time in the same setting; it disappears from search results once search engines re-index it. The basis is the master's request (contract).

8.What a salon owner sees

If you book with a master who belongs to a salon, the salon owner (the master who created the salon page) sees the time, duration and status of that visit, the master and the service, and whether that master got the client through Gloumi, and sees your name only on the day of the visit; on other days “Client” is shown instead of your name. The name of a client under 18 is never shown to the salon owner. The salon owner does not see your contact details, photo or other data through the salon feature.

This data is shown to them on the basis of legitimate interest – so that the salon can organise shared work, for example allocate workplaces and time. The salon owner may use it only for that and is responsible for this as an independent controller; using it for marketing or to contact you in their own name is prohibited. Access ends when the master is no longer a member of the salon. You can object to this processing in settings (“Show my name in salon calendars”) or by writing to privatumas@gloumi.lt – the salon owner will then always see “Client” instead of your name.

9.Transfers outside the European Economic Area

Some service providers are in the United States and Singapore (Supabase Pte. Ltd.). For such transfers we use the standard contractual clauses approved by the European Commission and, for US providers certified under the EU-US Data Privacy Framework, that framework as well. Where possible, data is stored in the EU: the database in Frankfurt, files in EU-jurisdiction storage, and emails are sent from Ireland. Anthropic (United States) receives data under the standard contractual clauses included in its data processing agreement (modules 2 and 3). We have data processing agreements with these providers binding them to process data only on our instructions.

Sentry error reports are stored in the EU. Photos and videos in Cloudflare R2 are stored in the EU region.

A copy of the Standard Contractual Clauses is available on request at privatumas@gloumi.lt.

10.Automated decisions and profiling

We do not make decisions with legal or similarly significant effects on you by automated means alone. Some actions happen automatically under rules set out in advance in the Terms and in the Terms for Masters and Salons, because that is how the contract is performed (GDPR Art. 6(1)(b)) or a legal obligation is met: a visit the master does not mark within 24 hours is marked as having taken place; a visit the master does not confirm before it starts is declined and the amount paid is refunded; a visit not paid in the app within 30 minutes, and a visit whose amount could not be reserved on the card and whose payment you did not confirm 24 hours before it, are cancelled; after a late cancellation or no-show, the late-cancellation compensation set in the master’s cancellation terms is charged (no more than 30% of the visit price); limits on how often you can book and how many upcoming visits you can hold apply; text containing clearly prohibited words is not published (see “Checking content before it is published”); payouts are suspended for a master who does not provide DAC7 details in time; on-site payment is switched off for a master who does not pay an amount owed to Gloumi in time after a payment request, until it is paid; an account whose date of birth shows the user is under 14 is deleted at once; when a gift card purchase is disputed with the bank, the card balance is frozen until the dispute is resolved. When a client reports that a visit did not take place, the payment is held automatically only temporarily; a person makes the final decision within 14 days, and the master can explain and provide evidence. If no person decides within 30 days, the dispute is closed automatically in the master’s favour – we tell you, and at your request a person reviews the decision. A card dispute is decided by the bank. If you think an automatic action was applied wrongly, write to us through Help or at privatumas@gloumi.lt – a person will review it. The average of masters' ratings of a client is the average of the stars masters gave after completed visits; whether to accept a booking is the master's decision, not the app's. If you think a rating is wrong or given in retaliation, write to us through Help – a person will review it and remove it if needed. No account is blocked by an algorithm alone – a person is always answerable for such a decision; a payment may be declined automatically by your bank or by Stripe’s fraud prevention. The app automatically counts your cancelled and missed visits over the last 30 days and warns you when you reach the limit set in the Terms; only a person can restrict your bookings.

The order things are shown in is not a decision about you, but it should be clear as well - the parameters that determine it are set out in the terms of use under Ranking of results. We also determine automatically (1) which age of consent applies to you – from the country in your profile, your device region and a verified phone number (see “Children’s privacy”); (2) your Gloumi points level – from the points earned for visits over 12 months (see the Terms section “Gloumi points”); (3) automatic membership of a master’s client group, set by that master, based on the number of completed visits with them – it only opens additional times and takes nothing away. Neither is a decision with legal or similarly significant effects on you.

We do not build advertising profiles and we do not pass data to advertising networks.

When a visit is reported as not having happened, an amount not yet charged is not charged while a person decides, unless the card reservation would expire sooner: then the amount is charged and, if it is decided to refund it, refunded in full. If the amount has already been charged and a refund is decided, it is refunded to you and recovered from the master under the Terms for Masters and Salons. When a card dispute is received, the disputed amount is automatically recovered from the master’s Stripe balance. In both cases this is temporary: whether the amount goes to the client or to the master is decided by a person in the case of a report, and by the bank in the case of a card dispute.

11.A master’s private notes

A master can write private notes about a client (for example colour formulas or preferences). In the app these notes are visible only to the master who wrote them; you receive them when you ask for a copy of your data (see “Your rights”). Gloumi staff may view them only as far as necessary for support, security or legal obligations. A master can also mark a client with a colour: it is not shown to other users, and you receive it in your copy of the data. The app does not ask for health data and has no field for it. The master is responsible for not keeping excessive or sensitive data in these notes, health data included, without your consent. If you yourself write information about your health (for example allergies) in booking notes or messages, the master will see it, and it is kept with the booking or the conversation. Write only what is needed for the service to be safe.

12.Tips and the master code

If you leave a tip, we process its amount, the percentage chosen, the time and status of the payment, the Stripe payment identifier, the Stripe fee and the data of the payment to the master, linked to your visit and account. The master is told who left the tip and how much. We process this data to perform the contract and keep it like other payment records – for up to 10 years (accounting requirements).

If you enter a master code, we record which master's code you entered, when, and whether it took up one of the code's uses. This is needed so that Gloumi does not charge the master commission on their existing clients and so that the code is used according to the rules (performance of a contract and legitimate interest). The master can see in their client list that you came with the code. The record is deleted together with your account or the master's account.

13.How long we keep data

  • Account data – while the account is active; once you ask for it to be deleted, for 30 more days from the request, after which it is deleted. Deleted data may remain in database backups for up to 7 days, until they are replaced by newer ones; data are restored from them only after a failure.
  • Data of an account with no date of birth and no activity – until 48 hours after our notice asking for the date of birth; it is then deleted at once, without these 30 days (see the Terms section “Account restriction and termination”).
  • Booking and payment records – up to 10 years (accounting requirements).
  • Gloumi invoices to masters (with the PDF issued) – 10 years from 1 January of the year after the invoice was issued (the retention period for accounting documents); they are kept until then even if the master's account is deleted.
  • Chat messages – while the account is active or until you delete them.
  • Stories – stop being shown to others after 24 hours; they stay in your archive until you delete them or your account. Records of who viewed a Story and when are deleted 30 days after it stopped being shown; records of who liked it are kept while it is in your archive.
  • Masters' ratings and reviews of you, Gloumi points, coupons, invitation records, the gift card balance and credit – while the account is active; when the account is deleted, ratings, reviews of you, points, coupons and invitation records are deleted, and the balance and credit cease to be valid. Gift card purchase records – like payment records. If we refund the gift card balance when an account is deleted, we keep the email address for 60 days after the account is deleted, so that we can contact you if the bank rejects the refund; the refund record, bank account details and the transfer record are kept like payment records.
  • Records of administrator actions (who did what and when: deleted or corrected content or an account, together with a copy of what was deleted or changed; corrected a date of birth, with both dates and the reason; restricted or suspended an account; resolved a dispute; granted a concession; viewed a phone number; turned off two-factor authentication or changed the email address of an account; handled a support request; and similar actions) – 3 years, then deleted.
  • Records of e-mails about visit confirmations, amounts owed to Gloumi, switching off payment on site and the deletion of an account without a date of birth (type of e-mail, recipient, time sent, the message identifier given by the e-mail provider) – 3 years, then deleted. The text of the visit confirmation e-mail is kept with the record as proof that the contract was confirmed – for the same 3 years, also after the account is deleted; the text of the other e-mails is deleted as soon as it is sent.
  • Content reports, together with the copy of the reported content: upheld – 3 years from the decision; rejected – 12 months from the decision; they are then deleted. Reports not yet reviewed are kept until we decide. If we have reported content to the police, we keep its copy, including photos and videos, for as long as the investigation needs it, but no longer than 12 months unless the police ask us to keep it longer (see “Content reports and moderation”).
  • Website form data and correspondence with companies – until you create an account, but no longer than 12 months after our last exchange. An opt-out (the account and the date) is kept for as long as we need it so as not to write again.
  • IP address hash (not the address itself) used to limit too frequent actions in the app and too frequent submissions of the website form – one day after the last action; we delete these once a day, so it is kept for no longer than 2 days.
  • History of in-app notifications – 90 days after the latest event of that notification; we delete it daily.
  • Previous usernames – 30 days after a change; for 14 days the old username stays reserved for you, so that no other user can take it and pretend to be you (legitimate interest – security).
  • The record that we sent the reminder before your 18th birthday – 30 days after the birthday (so that the reminder is not sent again).
  • Archive of consent records after the account is deleted: the history of the “News and offers” and “Reminders to rate a visit” settings, permissions to show a review on the website, acceptances of these Terms and the Privacy Policy, and photo and video confirmations, the parent’s or guardian’s confirmation and the history of their settings – 3 years (if the account had visits or payments, acceptances of the Terms and photo and video confirmations – as long as their records are kept); acceptances of the Terms for Masters and Salons – as long as that master’s payment records are kept, but no less than 3 years. They are then deleted.
  • Content review requests and decisions – 6 months from the decision; the checksum of approved text – 30 days.
  • Two-factor authentication recovery code hashes – until you create new codes or no confirmed two-factor authentication device remains (when you turn it off or sign in with a recovery code); records of attempts to enter a recovery code – one day; we delete these once a day, so they are kept for no longer than 2 days.
  • Requests to turn off two-factor authentication or change the account email through support (times, status, whether the password was correct) – 90 days.

14.Your rights

Under the GDPR you have the right to:

  • access your data and receive a copy of it – including what others wrote about you, such as masters' ratings and reviews, unless this would affect the rights of others; and masters' private notes about you, which we provide on the master's instruction. You can ask for a copy in the app settings and choose which data you want (the first option is “All my data”), or write to privatumas@gloumi.lt; you do not need to give a reason;
  • request correction of inaccurate data;
  • request erasure of your data (the "right to be forgotten");
  • restrict or object to processing;
  • transfer your data to another service provider;
  • withdraw a consent you have given;
  • lodge a complaint with the State Data Protection Inspectorate (vdai.lrv.lt) or with the data protection supervisory authority of the EU or EEA country where you live or work, or where you believe your rights were infringed.

15.Data security

Data is transmitted over an encrypted connection (TLS). Account and booking data is stored in the Supabase infrastructure with row-level access rules, and photos and other files in Cloudflare R2 storage. Passwords are stored only as one-way hashes – we cannot see or recover them.

You can protect your account further with two-factor authentication (in settings). The authenticator app's secret key is then stored by our authentication provider Supabase. We do not store recovery codes – only their one-way hashes, from which the codes cannot be recovered, so we cannot show them to you again. So that codes cannot be guessed, we record when an attempt to enter a recovery code was made and whether it succeeded. When you sign in with a recovery code, we sign out the other devices where you are signed in, turn off two-factor authentication and let you know by email.

If you have lost both your phone and your recovery codes, write to support@gloumi.lt. We send a code to your account's email address to confirm the request. We turn off two-factor authentication no sooner than after 3 days if you also confirm the request with your account password, or after 7 days if you do not; meanwhile we send warnings to the account's address, and the request can be cancelled. We then sign out all devices. We do not store the password – we only record whether it was correct.

If you no longer have access to your account's email, we can change the address only once you confirm the account in another way that is already linked to it: by signing in with your linked Apple or Google account, or by entering your account password in the app on a device where you have been signed in for more than 7 days. We save the new address only after 7 days, during which we warn you through every contact we have, and the request can be cancelled; we then sign out all devices. In both cases we do not ask for identity documents or photos.

No system is completely secure, so we recommend using a unique password.

16.Children’s privacy

Gloumi is not intended for people under 14. Fourteen is the age Lithuania has set for a child to consent to information society services on their own (GDPR Art. 8(1)). We ask for a date of birth at sign-up and do not create accounts for anyone younger. If we learn that data of a person of that age has been collected anyway, we will delete it without delay. Some other EU and EEA countries set that age at 15 or 16, so we do not offer users under 16 whom we cannot establish to live in Lithuania what relies on consent, or direct marketing: location, “News and offers” and reminders to rate a visit. We apply the Lithuanian age only when every signal we have – the country in your profile, your device region and a verified phone number – points to Lithuania; if any of them points to another country, or there are none, we apply the age of 16. If it turns out that you live outside Lithuania and are under 16, we switch these features off. We do this to meet a legal obligation (GDPR Art. 6(1)(c) and Art. 8). For users under 16 we apply parental supervision in every country (see below).

A client aged 16 or 17 confirms in the app, before a paid visit or a deposit, that they have the consent of a parent or guardian, and for a client under 16 the parent’s or guardian’s confirmation applies (see the next paragraph); the master confirms before the procedure that they have made sure of it. We keep the confirmations and their time with the visit record, so that we can show, if needed, that consent was asked for and checked (legitimate interest).

Parental supervision under 16. A user under 16 gives the email address of a parent or guardian; we send a confirmation code to it, and the parent or guardian who confirms sets a PIN and can switch on or off booking visits, messages, comments and reviews, reactions, following masters, in-app payments and location (see “Account and roles” in the Terms of Use). We process the parent’s or guardian’s email address, the confirmation code and its time, a hash of the PIN (we do not store the PIN itself), the state of the settings and the history of their changes, and the time the online-safety reminder was shown to the user. The purpose is to check that the child’s parents or guardians allow this and to be able to prove it (GDPR Art. 8(2); Article 2.8 of the Civil Code) – a legal obligation and a legitimate interest (GDPR Art. 6(1)(c) and (f)). To the parent’s or guardian’s address we send only the confirmation code and notices of changes to the settings, never marketing; the parent or guardian is not a Gloumi user and has no access to the account, but may ask us to delete their address – the permission is then withdrawn. We keep this data for as long as the account exists; after it is deleted, only the times of confirmation and withdrawal, the state of the settings and their last changes, with the parent’s or guardian’s address masked, stay in the archive of consent records for 3 years (we do not keep the full address there, only a check value to verify it; see “How long we keep data”).

Accounts of users under 18 (Junior account) are subject to additional rules: to other users they appear as “Junior user”, with no name or photo, they cannot be found in search, masters without a connection to them cannot message or tag them, and their feed is not tailored to their activity or location (see “What data we collect” and “Account and roles” in the Terms of Use). Which rules apply is set by the date of birth given; we do not check age with documents, and parents or guardians have no access to the account.

17.Cookies and local storage

Gloumi is an app rather than a website, so it uses no browser cookies of its own; the one exception is the strictly necessary Cloudflare Turnstile bot-protection entries described below. The gloumi.lt website uses no cookies or analytics of its own for visitors; its sign-in help form shows the same Turnstile check, and only the administration portal for Gloumi staff uses strictly necessary sign-in cookies. Some data is still kept on the device itself, and you should know about it just the same.

  • Sign-in session: kept in the device keystore (iOS Keychain, Android Keystore) and encrypted by the operating system. It exists so you do not have to sign in every time you open the app.
  • Content cache: the most recent feed, Stories and images are kept on the device so the app opens quickly and works on a poor connection. It is cleared when you sign out.
  • Preferences: language, theme choice and similar settings.
  • Bot check: when you sign up, sign in with a password, reset your password or ask for a new sign-up code, the Cloudflare Turnstile check opens in a browser window inside the app, where Cloudflare may keep its strictly necessary bot-protection cookies and entries (challenges.cloudflare.com). They stay on the device between checks so that the check works and does not repeat – without them it does not work, so we do not ask for consent (Article 73(4) of the Lithuanian Law on Electronic Communications). Only Cloudflare reads them, and only for the check; what it receives is described under “What data we collect”.
  • Drafts and recent activity: unsent drafts of posts, Stories and the master application, recently viewed masters, Stories you have seen and an invitation code not yet used – so you can carry on where you left off. Drafts and recently viewed masters are cleared when you sign out; the marks of Stories you have seen stay on the device, and the invitation code until you use it.
  • None of this is used for tracking or advertising; Gloumi shares none of it with third parties, and the Turnstile entries are read only by Cloudflare. Deleting the app deletes them too.

18.Marketing messages

We send news and offers only with your consent. You may withdraw that consent at any time - in the notification settings in the app, or through the unsubscribe link in the email; nothing else about your account changes.

After a completed visit the app asks you to rate the visit and leave a review of the master – this is an app feature and cannot be turned off. We send a reminder by push notification until you turn it off – when signing up or later in notification settings (“Reminders to rate a visit”); each reminder says how to do this. We do not send these reminders to users under 16 whom we cannot establish to live in Lithuania. After your third completed visit we ask you once to rate Gloumi in the app store; that window is shown by your device’s operating system and is not a marketing message. We send invitations to book a visit again – including reminders timed by your previous visits – and offers from masters only if you have given your consent (“News and offers”).

Separately from marketing we send service messages - about a booking, a change to it, a payment or security, and to a master also a reminder to finish setting up the profile (no more than a few times). These cannot be turned off, because without them the service would not work.

19.Personal data breaches

If a personal data breach occurred, we would report it to the State Data Protection Inspectorate within 72 hours of becoming aware of it. If the breach were likely to pose a high risk to your rights, we would tell you personally as well - plainly and without delay, saying what is worth doing on your side.

20.Cancellation and refunds

Each master chooses their cancellation terms, and they are shown before you book. Below is how they apply; the Terms section “Bookings and deposits” sets this out in full.

  • Cancel 24 hours or more before the appointment and everything you paid in the app is refunded.
  • Cancel a confirmed appointment less than 24 hours before it, or do not turn up, and the late-cancellation compensation set in the master’s cancellation terms is charged (no more than 30% of the visit price and no more than the deposit) - it covers the time the master reserved and can no longer sell. The rest of the reserved amount is released.
  • If the master or Gloumi cancels, everything you paid in the app is refunded, regardless of timing.
  • Refunds go back the way the payment came. We start the refund or the release of the reservation within one day at the latest; how long it takes to reach your account is up to your bank or card issuer.
  • If you chose to pay on site, only the deposit is reserved in the app and charged after the visit (where the master set one) and you pay the rest to the master; questions about that part are settled with the master.
  • Gloumi does not provide beauty services and does not arbitrate disputes about their quality; our responsibility is limited to the payment made through the app.

21.Reports that a visit did not happen, and card disputes

If you report that a visit did not happen, we keep which visit it concerns, who reported it and when, your message (if you wrote one), the status of the dispute, the decision and when it was made. If you dispute a payment with your bank, we receive the dispute data from Stripe (amount, reason, status) and the data of any reversal of the related transfer.

The master can see that you reported it and your message, because they need to know why the amount due to them is not charged or is refunded and to be able to explain. In a card dispute, we may provide the bank, through Stripe, with the booking, message and payment data.

We process this data to hold the payment, decide on a refund and prevent fraud (performance of a contract and legitimate interest), and for accounting (legal obligation). We keep it for as long as the dispute takes to resolve and then, like other payment records, for up to 10 years, because claims about a payment may be brought within that time.

22.Content reports and moderation

When you report content or an account, we process your report – the reason and your explanation, if you gave one, and, for a report of illegal content, your confirmation that the information is accurate and complete – and your account (if you report in the app) or your email address and your name, if you gave it (if you write to us by email). We also process the reported content, its author's account details and our decision. When we receive a report, we keep a copy of the text of the reported content with its author and creation time, and we do not delete the related photos or videos even if the author deletes the content, so that we can handle the report and review a decision that is appealed (if the author deletes their whole account, the photos and videos are deleted and the text copy remains). Only Gloumi staff see the copy, every viewing is logged, and it is kept for as long as the report (see “How long we keep data”). When a master marks that a client did not come and the client has already left a review, the system creates a report about that review on the master's behalf so that a person reviews it. Reports are reviewed and decisions are taken by a Gloumi staff member – we do not assess reports automatically, and we do not use reports for the feed or for recommendations; only content is checked automatically, before it is published (see “Checking content before it is published”). If content may be child sexual abuse or another criminal offence involving a threat to life or safety, we report it to the police and hand over that content and the data of the account that uploaded it (Article 18 of the Digital Services Act, Article 17 of the Law on Information Society Services); we keep such content in a closed store for as long as the investigation needs it, but no longer than 12 months, unless the police ask for longer.

We do not disclose the reporter's identity to the author of the content. The exception is when a report cannot be assessed without it (for example, a copyright claim); we then tell you in advance and disclose only what is necessary.

When we remove content or restrict an account, we tell the author the reason, the rule in the Terms and whether we acted on a report or on our own initiative; the decision can be appealed (see the Terms section “Reporting illegal content and appealing our decisions”).

The legal basis is a legal obligation (DSA requirements) and our legitimate interest in keeping the platform safe and the Terms respected (see section 3). You can object to this processing by writing to privatumas@gloumi.lt, but we may continue to process reports of illegal content and decisions on them where the law requires it or there are compelling legitimate grounds.

23.Language of this document

This document is available in Lithuanian and English, and in Polish, Latvian, German, French, Spanish and Italian translations. If the texts differ, the Lithuanian text prevails.