Privacy Policy
Effective date: 2026-05-24 Last updated: 2026-05-24
This Privacy Policy describes how Aleksandr Tikhonov, sole trader registered in Portugal under NIF 311025609, with business address Rua Almirante Manuel Pereira Crespo 198, 2765-001 Estoril, Portugal ("Labu", "we", "us", "our"), collects, uses, and protects personal data of users of the Labu mobile application and the labu.pro website (together, the "Service").
Labu is a business management tool for independent beauty professionals ("Specialists") and a booking interface for their clients ("Clients"). We act as a data controller for the personal data described below.
If you have any questions about this Policy, contact us at privacy@labu.pro.
1. Personal data we collect
1.1 Provided directly by you
When you create an account, fill in your profile or book an appointment, we collect:
| Data | Who | Purpose |
|---|---|---|
| Email address and/or phone number | Specialists, Clients | Account creation, authentication, transactional notifications |
| First name, last name | Specialists, Clients | Identification within the Service, display in bookings |
| Phone number | Specialists, Clients | Contact for booking coordination |
| Profile picture | Specialists | Display on public Specialist profile |
| Country, city, address, geographic coordinates | Specialists | Display on public Specialist profile so Clients can find them |
| Services offered, prices, duration, working hours | Specialists | Operation of the booking system |
| Booking details (date, time, service, notes) | Specialists, Clients | Operation of the booking system |
| Language preference | Specialists, Clients | Localization of the Service |
1.2 Collected automatically
| Data | Purpose |
|---|---|
| Device push notification token (Apple APNs, Google FCM, Expo Push) | Sending booking notifications and reminders |
| Device type, operating system version | Routing notifications to the correct platform; diagnostics |
| IP address and access timestamps (server logs) | Security, abuse prevention |
| Authentication session tokens | Keeping you signed in |
We do not collect: precise GPS location (unless you explicitly provide it as a Specialist), browsing history outside the app, contacts, calendar, photos other than ones you actively select for upload, biometric data, advertising identifiers, or third-party analytics fingerprints.
1.3 Special category data
The Service is not designed to process special categories of personal data within the meaning of Article 9 GDPR (health, biometric, ethnicity, etc.). Please do not enter such data into booking notes or free-text fields.
2. Legal bases for processing (GDPR Article 6)
| Processing | Legal basis |
|---|---|
| Creating and maintaining your account | Performance of a contract (Article 6(1)(b)) |
| Operating the booking system | Performance of a contract (Article 6(1)(b)) |
| Sending transactional push notifications about bookings | Performance of a contract (Article 6(1)(b)) |
| Displaying a Specialist's public profile to Clients | Legitimate interest of the Specialist to be discoverable; consent of the Specialist (Article 6(1)(a)/(f)) |
| Security, fraud and abuse prevention | Legitimate interest (Article 6(1)(f)) |
| Complying with legal obligations (tax, accounting) | Legal obligation (Article 6(1)(c)) |
You may withdraw any consent at any time by writing to privacy@labu.pro.
3. Sharing and processors
We do not sell personal data. We share personal data only with:
| Recipient | Role | Location | What |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage (data processor) | EU region (Frankfurt) | All account, profile and booking data |
| Universe, Inc. (Expo Push) | Push notification relay | United States | Push tokens and notification payloads |
| Apple Inc. (APNs) | iOS push delivery | Global | Push tokens and notification payloads |
| Google LLC (Firebase Cloud Messaging) | Android push delivery | Global | Push tokens and notification payloads |
| Google LLC (Places API) | Address autocomplete (when used) | Global | Address text you type |
| Stripe Payments Europe, Ltd. | Payment processing for Specialist subscriptions on labu.pro (when applicable) | Ireland | Billing data of subscribing Specialists |
| Hosting provider for labu.pro | Website hosting | EU | Website content only |
When personal data is transferred outside the European Economic Area, we rely on European Commission Standard Contractual Clauses or other safeguards permitted under Articles 44-49 GDPR.
A Specialist can also see the name and phone number of Clients with whom they have an existing booking or saved relationship. This is necessary for the Specialist to provide the booked service.
A Client can see the public profile information that Specialists voluntarily publish (name, photo, services, address, working hours).
4. Retention
| Data | Retention |
|---|---|
| Active account data | For as long as your account exists |
| Booking history | 5 years after the booking date (Portuguese tax recordkeeping under CIVA) |
| Server logs | 90 days |
| Push notification tokens | Until you uninstall the app or revoke notifications |
| Deleted account | Hard deletion within 30 days, except where retention is required by law |
You can delete your account at any time from within the app or by writing to privacy@labu.pro.
5. Your rights under GDPR
You have the right to:
- Access your personal data (Article 15)
- Rectify inaccurate data (Article 16)
- Erase your data ("right to be forgotten", Article 17)
- Restrict processing (Article 18)
- Data portability — receive your data in a structured format (Article 20)
- Object to processing based on legitimate interest (Article 21)
- Withdraw consent at any time (Article 7(3))
- Lodge a complaint with the Portuguese supervisory authority Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or with the supervisory authority of your EU country of residence.
To exercise any of these rights, write to privacy@labu.pro. We respond within 30 days.
6. Security
We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS), encryption at rest of the database, row-level security policies in the database, and access controls.
No system is 100% secure. If we become aware of a personal data breach affecting your data, we will notify you and the CNPD as required by Articles 33-34 GDPR.
7. Children
The Service is not intended for users under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact privacy@labu.pro and we will delete it.
8. Third-party links
The Service may contain links to third-party websites. We are not responsible for their privacy practices. Read their policies before providing personal data.
9. Changes to this Policy
We may update this Policy. Material changes will be notified through the Service or by email at least 30 days before they take effect. The current version is always available at https://labu.pro/privacy.
10. Contact
Data Controller: Aleksandr Tikhonov Address: Rua Almirante Manuel Pereira Crespo 198, 2765-001 Estoril, Portugal NIF: 311025609 Email: privacy@labu.pro