Data and Privacy

1. Data Controller and General Information

The controller of the personal data processed through the StilHub Platform is MEDIASTAGE S.R.L., with its registered office at str. Timiș nr. 81B, Giroc village, Giroc commune, Timiș County, CUI 55259305, registered with the Trade Register under no. J2026045379002, e-mail: [email protected] (hereinafter "we" or "StilHub").

We are committed to protecting the confidentiality of your data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian legislation. This policy explains what data we collect, why, on what legal basis, with whom we share it, and what rights you have.

Controller roles: StilHub is the controller for the data necessary for the operation of the Platform (accounts, bookings, payments, communications). Each Salon is an independent controller for the data of its own clients that it manages through the panel (e.g. clients added manually, its own SMS campaigns); for these operations, StilHub acts as the Salon's processor.

2. What data we collect

Depending on how you use the Platform, we process:

Account and contact data (Clients): name, phone number (verified via SMS code), e-mail address, password (stored encrypted), language preference.
Usage data (Clients): booking history, reviews and ratings left for salons, memberships and product orders placed, gift cards and promotional codes used, waiting list registrations, messages sent through support.
Location data: if you grant permission, we use the device's approximate location to show you nearby salons. You may decline and search manually by city; permission can be withdrawn from your device settings.
Payment data: card payments are processed directly by the payment provider (Stripe). We do not store your card number; we retain only technical transaction identifiers (e.g. payment ID) and payment status.
Notification data: the device's push notification tokens and/or web-push subscriptions, in order to send you confirmations and reminders.
Business data (Salons): company name, CUI, address, coordinates, contact details, employee names and schedules, services and prices, products, onboarding information, billing data, billing and subscription history.
Technical and analytics data: IP address, browser/device type, pages visited and interactions, cookies and analytics identifiers (see sections 7 and 8).

3. Purposes and legal bases of processing

Purpose of processing	Legal basis
Providing the service (account creation, bookings, payments, orders, memberships, transactional communications)	Performance of the contract (Art. 6(1)(b) GDPR).
Phone verification via SMS to prevent fake accounts	Legitimate interest and performance of the contract.
Legal obligations (invoicing, accounting, e-Factura, retention of tax documents)	Legal obligation (Art. 6(1)(c)).
Security, fraud prevention and service improvement (including usage statistics)	Legitimate interest (Art. 6(1)(f)).
Marketing communications and analytics cookies (e.g. newsletter, campaigns, Google Analytics)	Consent (Art. 6(1)(a)), which you may withdraw at any time.

4. How long we retain data

Account data: for the duration of the account's existence; we delete or anonymize it upon account closure, except for data required for legal obligations.
Fiscal documents (invoices): under the law, generally 10 years.
Booking/order history: for the reasonable period necessary for the operation of the service and the resolution of any disputes.
OTP codes, reset tokens, technical logs: short periods (from minutes to a few months).

5. Who we disclose data to (processors and partners)

We do not sell or rent your data. We share it only with service providers ("processors") strictly necessary for operation, who process it under data processing agreements (DPAs) and only according to our instructions:

Provider	Purpose of processing
Stripe	card payment processing (client → salon).
Netopia mobilPay	processing payments for salons' subscriptions to StilHub.
Oblio	issuing invoices and e-Factura (ANAF).
BulkGate	sending SMS messages (verification codes, reminders, campaigns).
Twilio SendGrid	sending e-mails (confirmations, reminders, notifications).
Expo	delivering push notifications to the app.
Google	sign-in with your Google account (optional), Google Analytics (only with consent) and secure storage of database backups.
Hosting provider	the infrastructure the Platform runs on.

We may also disclose data to authorities when required by law. Salons have access to the data necessary to fulfill the bookings and orders they receive (e.g. the name and phone number of the client who made the booking).

6. International transfers

Some providers (e.g. Stripe, Google, SendGrid) may process data outside the European Economic Area (e.g. the United States). In such cases, transfers are carried out on the basis of the safeguards provided by GDPR, standard contractual clauses approved by the European Commission and/or adequacy mechanisms (e.g. the EU-U.S. Data Privacy Framework), ensuring the data receive an equivalent level of protection.

7. Cookies

We use essential cookies for the operation of the website (login, language preferences, remembering consent), these do not require consent. We use analytics cookies and technologies (see section 8) only after your consent, given through the banner shown on your first visit. You can accept all or choose "essential only", and you can withdraw your consent at any time by deleting cookies from your browser or reopening the banner. Functional affiliate/marketing cookies (e.g. remembering a referral code) are first-party cookies, used only for the stated purpose.

8. Traffic Analysis (Google Analytics)

To understand how the website is used and to improve it, we use Google Analytics 4. This tool is activated only if you accept analytics cookies in the banner, until then it does not load and does not collect anything. Google processes data such as pages visited, device type and an IP address (truncated/pseudonymized), acting as an independent controller/processor, in accordance with its own policy. You may object at any time by withdrawing your consent.

9. Data Security

We apply reasonable technical and organizational measures: encrypted connections (HTTPS), passwords stored encrypted (hashed), restricted access, logging of administrative actions, secure backups and monitoring. However, no system is 100% invulnerable; in the event of an incident affecting you, we will inform you in accordance with legal obligations.

10. Your rights under GDPR

You have the following rights:

The right to access stored data;
The right to rectification of inaccurate or incomplete data;
The right to erasure of data ("the right to be forgotten");
The right to restriction of processing;
The right to data portability;
The right to object to processing based on legitimate interest and to withdraw your consent (including for marketing and analytics), without affecting the lawfulness of prior processing.

➜ Account Deletion

Some of these rights can be exercised directly from the app (e.g. editing your profile, deleting your account). For any request, you may contact us at [email protected] (subject: "GDPR Request"). We reply within 30 days at the latest. You also have the right to lodge a complaint with National Supervisory Authority for Personal Data Processing (ANSPDCP).

11. Minors

The Platform is not directed at persons under 16 years of age. We do not knowingly collect data from minors under this age without the consent of their legal representative. If we learn that we have processed such data without a legal basis, we will delete it.

12. Changes and Contact

We may update this policy to reflect changes in the services or legislation; the date of the last update is displayed at the beginning. For any question regarding data processing, you may contact us at [email protected].