Back to AMP Lashes

Privacy & cookies

Updated 15 October 2026. This notice covers bookings, the owner login and the salon’s AI assistant, under the EU GDPR and Irish Data Protection Act 2018.

Who is responsible?

Aisa Pasztor trading as AMP Lashes is the data controller. Contact lashesamp@gmail.com. The studio is inside Mise salon, 75 Park St, Townparks, Dundalk, Co. Louth, Ireland.

What we use and why

  • Booking names, contact details, treatment, date/time, style preferences, payment status and private references are used to arrange and deliver appointments, process payments and cancellations, and send necessary service emails. We rely on taking steps at your request before a contract and performing that contract, Article 6(1)(b).
  • Necessary accounting and transaction records meet legal obligations, Article 6(1)(c). Stripe processes card details; this website does not store your full card number or security code.
  • Owner credentials, security challenges, sessions and rate limits protect the studio and customers, based on legitimate interests in access security and preventing abuse, Article 6(1)(f). Passwords are stored as salted hashes; verification codes expire and are single use.
  • A review-request email requires your separate optional consent, Article 6(1)(a). It is off by default and does not affect your booking. Withdraw it by emailing Aisa or using a supported preference control in your private booking link. No marketing mailing list is created.
  • If you choose to use AI chat, your general question and a short recent conversation are processed by our AI service to answer your enquiry. This supports your requested enquiry or pre-contract steps; security controls also serve our legitimate interests. AI receives the public service list and salon information, and has no access to customer booking records, owner credentials or the personal details entered into the separate booking form. AI can make mistakes; contact Aisa for an authoritative answer.

Required booking contact fields are needed to arrange the service; notes and review emails are optional. Please keep passwords, codes, payment information and health/allergy details out of chat and booking notes. Discuss treatment suitability directly with Aisa. You can contact Aisa instead of using online booking or AI.

Providers and transfers

Authorised studio staff and people supporting the site may access information needed for their work. Providers include our hosting and database platform for hosting, the database and AI, Stripe for payments, Resend for email delivery, the business mailbox provider for correspondence. Advisers and authorities receive information where needed for legal duties or claims. Information is not sold.

Providers may process information outside the EEA. Applicable adequacy decisions or appropriate safeguards, such as EU Standard Contractual Clauses, must cover relevant transfers. Ask Aisa for information about the safeguards applying to your information. Payment providers may also act as independent controllers for their legal and fraud-prevention purposes.

Retention

The studio’s retention policy is to remove abandoned unpaid booking records after seven days once payment status is checked, minimise routine booking contact details and style notes after 12 months from the appointment or latest related transaction, and retain necessary financial records for six years. Relevant information may be kept longer for an active claim or legal hold, with review. Provider logs, emails and backups have separate retention arrangements; removing a database record does not automatically erase them.

Verification codes and password setup grants expire after five minutes. Sessions expire after 30 minutes of inactivity or eight hours in total. Security counters expire within their set window, up to 24 hours for chat usage limits. The website keeps chat messages in browser memory until you clear the conversation or leave/reload the page; it does not create a chat transcript entity in the studio database. Our hosting and AI providers may process requests and technical logs under their own service retention arrangements. Owner password hashes remain while the owner account is active.

Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw optional consent at any time without affecting earlier lawful processing. Email lashesamp@gmail.com. We may verify your identity proportionately and normally respond within one month. You may complain to Ireland’s Data Protection Commission. AI is not used to make decisions with legal or similarly significant effects about you.

Cookies and storage

The added booking and chat components use browser memory and add no advertising pixels, analytics, social embeds or optional tracking cookies. Essential platform, security and requested payment functionality may use necessary cookies or similar technology. Stripe Checkout is hosted by Stripe. Social media and map links open only when selected. Any future non-essential tracking must remain blocked until you consent, with an equally accessible way to reject and withdraw consent.

For an accessible alternative or help using the site, email lashesamp@gmail.com.