Your information.
A clearer picture.

This policy describes how Refinelook handles information when you visit therefinelook.com, use the customer experience, or use a salon or stylist workspace. It covers the web service, including booking, professional operations, and account controls, as well as guest bookings, callers and clients imported by salons who have no Refinelook account. The operator is Refinelook, inc.

Salons and stylists provide their own services and decide how to use client information for their business. Their handling of information outside Refinelook, their service policies, and websites or payment links they operate may be governed by separate privacy notices.

Refinelook, inc operates Refinelook. We determine the purposes of processing for our own accounts, platform security, support, product operation and subscription administration. Where privacy law uses that term, we act as a controller for those purposes.

Legal operator

Refinelook, inc

Business address

Phone

Platform support & billing

Privacy requests

Content reports & appeals

A salon determines how it uses client records, consultation material, appointments and business communications to provide its services. When we store or process those records on its instructions, we act as its processor or service provider. The same record may also support a separate platform purpose, such as preventing fraud or resolving a payment issue; responsibility depends on the purpose, not just the record’s label.

This policy also covers guests, people booked by someone else, callers and clients whose information a salon imports, whether or not they have an account. Ask the salon about its own purposes and policies. A person without an account can use Privacy & safety to submit a platform privacy request or use the salon’s published contact details for its own records.

The categories below supplement the information and provider descriptions in this policy. Where a legal basis is required, account and requested service processing may be necessary for a contract; security, reliability and support may rely on legitimate interests after considering individual rights; records required by law rely on legal obligations; and optional permissions or marketing rely on consent where required. Salon-controlled processing follows the salon’s own lawful instructions and basis.

We receive information directly from you when you create an account, submit a booking, upload an image, send a message, publish a review, or use an account control. Your browser and device also supply information needed to deliver and secure the service.

Salons and authorized team members can create or import client records, add appointment details and notes, and update booking status. Connected authentication, payment, communication, and infrastructure providers supply the information needed for their functions, such as sign-in results, payment status, and delivery events.

1. Your salon and its authorized team: booking contact details, chosen services, consultation references, relevant messages, and operational records are available to the people handling the service, according to their access. Hair-profile details may also be shared with the salon when you book.
2. Other visitors: published salon and professional profiles, galleries, and published reviews are visible publicly. Review display names, text, ratings, and photos can identify you, so choose what you publish carefully.
3. Service providers: infrastructure, authentication, maps, payment, communication, and configured AI providers process information required for the functions described below.
4. Service administration: authorized personnel may access information to support accounts, investigate abuse or failures, moderate content, and handle data requests. Information may also be disclosed when required by law or to protect users and the service.

The provider used depends on the feature and the salon’s configuration. Opening a third-party service can also make its own privacy policy apply to your interaction with it.

A salon can provide instructions for paying it directly outside Refinelook. Information you give the payment service or salon through that process is handled under its own practices. Refinelook displays the instructions and recorded deposit status for the appointment.

With browser permission, Refinelook uses device location to center the salon directory near you and calculate nearby results. You can browse without that permission; the directory starts with a United States overview when location is unavailable. You can change or withdraw permission in your browser’s site settings.

For signed-in accounts, the app can remember an approximate location on that browser for up to 30 days, rounded to two decimal places, to restore nearby discovery. Live device coordinates are also used in memory while you browse. Clearing site storage removes the remembered browser location.

Map requests are sent to Mapbox and can reveal the area you are viewing, along with technical information such as your IP address. Salon-directory queries and map-area bounds are sent to Refinelook; when a location is available, a location origin can accompany the request to order nearby results. Your browser permission controls device geolocation; it does not prevent ordinary network information being sent when a map loads.

Cookies and browser storage support sign-in and verification, session recovery, preferences, drafts, saved interface state, and performance caches. The marketing site also remembers whether you paused animations. Blocking or clearing storage can sign you out, remove local preferences or drafts, or affect functionality; it does not delete server-side account records.

Optional website analytics is off until you enable it in Privacy & safety. You can reject or withdraw it there. Global Privacy Control keeps optional analytics off. Essential sign-in, security, service requests and provider functions still operate. Application fonts are served by Refinelook. The current code does not include Google Analytics, Google advertising tags or Meta Pixel.

You choose which reference photos, attachments, profile images, and review photos to upload. Booking references may be processed and stored so the salon can review your consultation. Public profile, gallery, and review images are intended for public display. Avoid uploading information that is not needed for the service.

Before sending material for a supported AI import or AI assistance, Refinelook asks you to allow the described sharing with Google Gemini and confirm you are at least 18 and authorized to share it. Your permission is recorded by purpose and version, and can be withdrawn for future requests in Privacy & safety. Manual and CSV import paths remain available without sending images to AI.

AI hairstyle try-on is currently unavailable in the web interface and is labeled Coming soon. It is not part of today’s customer booking instructions. For professional imports, customer-list screenshots and service-menu images can be sent to Google Gemini for extraction. Spreadsheet column mapping uses selected header hints and simplified sample patterns instead of entire raw rows. Review the extracted or mapped preview before saving.

AI Agent sends the owner’s question, saved conversation context and an allowlisted context for the selected salon to the configured Gemini Developer API. Customer contact details and private customer notes are excluded from that automatically loaded context; do not add unnecessary personal information in your question. Saved chats and outputs are private to the requesting user within that salon.

When a completed Quo call transcript is opened for booking assistance, the authorized retained transcript and relevant permitted booking context can be sent for Gemini analysis. Saved suggestions can be reopened. An authorized person must review and confirm any booking action through the normal flow; the analysis itself does not change an appointment.

Import previews, saved AI chats and call results have different retention lifecycles. The API endpoint alone does not establish whether Google’s paid-service data terms apply. Under Google’s terms, unpaid use can permit product improvement and human review; qualifying paid-service terms provide different treatment, including no product-improvement use of prompts and responses and limited safety logging. The production billing classification, retention settings and applicable agreement must be confirmed before sensitive client inputs are submitted. This policy does not make a blanket no-training or no-human-review promise.

See Google’s Gemini API terms for the provider’s paid/unpaid distinction and personal-information and age restrictions. Do not upload images or import records without the necessary permission. A salon must limit inputs to what is needed and use a configuration suitable for that information.

1. Privacy requests and safety: use Privacy & safety without an account to request access, correction or deletion, or report public content. Signed-in users can also report conversations and manage blocked contacts. Hiding a reported public item does not erase copies held by other providers.
2. Review and update: use your profile and account settings to change the details and preferences available to you. Contact the salon about errors in the operational records it maintains.
3. Download account data: in Privacy & safety, choose Download my data. This control is available to signed-in customer and professional accounts. The export is a JSON file and may contain personal information.
4. Request account deletion: in Privacy & safety, submit a request, review its reference and status, and cancel while cancellation is available. The displayed review date is a review target, not a guarantee that all records or provider copies will be erased on that date. Your account remains available during review.
5. Salon data: owners with the required access can download salon data in Business settings. Permanently deleting a salon is a separate action with explicit confirmations, and customer and team accounts remain separate.
6. Permissions and communications: manage location in your browser and use the account and salon notification controls available to you. Signup offers an optional marketing-consent choice. Verification and booking communications support the service you request.

Information is kept to operate accounts, appointments, salons, communications, and payment records, and to handle support, disputes, security, and applicable recordkeeping obligations. Retention depends on the information and purpose; there is no single automatic deletion period for all data.

Salons can choose separate message-history retention settings for Refinelook messaging and Quo. Changing or disconnecting a channel is different from deleting records held by its provider. Appointment records have their own lifecycle.

A deletion request may require verification and review. Records held by a salon or an external payment provider may be subject to its own obligations. Removal from an active account does not necessarily remove every backup, audit entry, provider record, or record that must be retained.

Refinelook uses access controls, authenticated requests, storage permissions, validation, and other safeguards to protect information. Public and private content have different visibility rules. No online service can guarantee absolute security.

Depending on where you live and the laws that apply, you may have rights to access, correct, delete, or obtain a copy of personal information, or to limit certain uses. Available account controls are described above. Requests can require identity verification and may be subject to legal exceptions.

Use the account export or deletion-request controls in My Hair → Settings for those requests. For records a salon maintains, use the contact details shown on that salon’s public page. Do not send passwords, verification codes, or full payment-card details in a request.

If you are a parent or guardian concerned about information a child submitted, request a review of that account’s information. Do not submit information about someone else unless you are authorized to do so.

This page may be updated as the service or its practices change. The “Last updated” date identifies the version you are reading. Any additional notice or consent required for a change will be handled under applicable law.

Information may be processed outside your country by the providers used for a feature. A provider’s headquarters does not identify the storage region for your information. Specific production hosting regions, remote-access locations and transfer arrangements have not yet been specified in this policy.

Where a transfer is restricted by applicable law, the applicable agreement must provide an appropriate transfer mechanism, such as an adequacy decision or approved contractual safeguards, and any required supplementary measures. Ask the privacy contact for the locations and safeguards applicable to your information; no particular mechanism is represented here as already executed.

There is no universal deletion period. A configured history limit is not a promise that all provider copies or backups disappear at the same instant. Exact production log, backup and provider schedules are not specified here; they must be checked for the affected system when handling a request.

Depending on the law that applies, you may request access, correction, deletion, restriction, objection or a portable copy, and withdraw consent for future consent-based processing. Use Privacy & safety for platform requests, including requests from guests and imported clients without an account. Use the salon’s public contact for records it controls. Keep your request reference for follow-up.

Describe the request, the account email or phone involved, the relevant salon and a safe reply address. We may ask for proportionate evidence of identity or authority before disclosing information or making changes. Do not send an identity document unless a secure and necessary verification method is requested. We route salon-controlled requests to the responsible salon and assist it as required.

We respond within the period required by applicable law and explain a permitted extension or refusal. For example, where the EU or UK GDPR applies, the usual response period is one month, with a permitted extension for complex or numerous requests and notice of that extension. Keep the request date and acknowledgment when following up. You may complain to the competent privacy regulator or use available legal remedies; for UK matters, information is available from the ICO.

Account deletion, subscription cancellation and appointment cancellation are separate. Resolve upcoming visits and plan renewal separately; a data request does not automatically stop a charge or cancel a visit. Some information may need to remain for a specified obligation or unresolved dispute, with its use limited accordingly.

Use an account only if you can lawfully agree to its terms. A parent, guardian or authorized adult arranging a visit for a minor is responsible for permission to share the minor’s details and for following the salon’s age rules. Do not submit a child’s private material to AI features. A guardian concerned about a child’s data can ask the salon or the privacy contact for review; we may verify their authority.

Verification, security and appointment updates support a requested service. Salon marketing requires permission for that salon and purpose; an imported phone number is not proof of consent. Refinelook marketing is a separate choice, with separate optional email and text preferences at signup and in Privacy & safety. Use the unsubscribe or opt-out instruction for the sender, such as STOP for supported SMS. Withdrawing marketing consent does not delete the account; contact the salon directly if an opt-out prevents appointment texts you need.