Phoenix World Beauty
Privacy Policy
How Phoenix handles your personal data on the web and in the app, under Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016).
Last updated
Draft — pending legal review
1. Who is responsible
The team that runs Phoenix World Beauty is responsible for your personal data.
For anything about your data, message us through our Contact page.
2. What we collect
- Your account: your mobile number or the email you sign in with, your name (and its Arabic spelling if you add it), your email if you add it, the contact number you give salons and clinics, your language, your photo if you add one, and your notification choices.
- Your bookings: the salon or clinic, the services, the time, the specialist, your note, any promo code, and what happened — completed, changed, cancelled late or missed.
- What you do on Phoenix: the salons you save or follow, your recent searches, the alerts you ask for, your points, spins and reviews (with their photos).
- Messages you send us: your message, and the number, name or email you give us so we can reply.
- Technical data: your IP address (to stop abuse, kept for a day), your browser or phone type with each signed-in session, and, in the phone app, a token for sending you notifications.
- If you work at a partner salon or clinic: your name, mobile number, role, photo and the bookings you look after.
We never collect card or bank details — you pay the salon or clinic directly. If you ask a map to show where you are, your browser shows it on the map only; it isn't sent to Phoenix.
3. Why we use it
- To sign you in and run your account.
- To make, change and cancel your bookings, and to tell the salon or clinic.
- To send your confirmations, reminders and changes by text, WhatsApp, email or notification, as you choose in Settings.
- To send you offers and news — only if you turn them on.
- To answer your messages and sort out problems with a booking.
- To keep Phoenix safe and lawful: limiting codes and requests, spotting misuse, and keeping the records the law requires, such as the salons' monthly bills.
A clinic booking can say something about your health. We use it only to run that booking, and only you, that clinic and the Phoenix team can see its note.
4. Signing in with Google or Apple
If you choose "Continue with Google" or "Continue with Apple", Google or Apple confirms who you are and shares three things with Phoenix: your name, your email address and an account ID. We never see your Google or Apple password, and we don't get your contacts, photos, calendar or anything else from those accounts.
We use that information only to sign you in, to create your Phoenix account the first time and to send you emails about your bookings and your account. We don't sell it, we don't use it for advertising and we don't share it with salons, clinics or anyone else beyond the companies listed in this policy that run Phoenix for us. Phoenix's use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
With Apple you can choose "Hide My Email": we then receive a private address from Apple that forwards our emails to you. You can unlink Google or Apple at any time in Account settings (keeping at least one way to sign in), or remove Phoenix from your Google or Apple account settings. When you delete your Phoenix account we delete the link and, for Apple, ask Apple to revoke Phoenix's access.
5. Who sees it
The salon or clinic you book sees your name, number, booking and note, and your record at that venue: visits, late cancellations and no-shows. The Phoenix team sees what it needs to support you and the venues. We don't sell your data, and there are no advertising networks on Phoenix.
These companies process data for us, under contract and only on our instructions:
| Company | What it does for Phoenix | Where |
|---|---|---|
| Supabase | What it does for PhoenixDatabase and photo storage | WhereMumbai, India |
| Vercel | What it does for PhoenixRuns the website and the app's server | WhereMumbai, India, with public pages cached worldwide |
| Twilio | What it does for PhoenixSends sign-in codes and booking messages by text, WhatsApp and phone call | WhereUnited States |
| Meta (WhatsApp) | What it does for PhoenixWhatsApp messages sent directly, once Phoenix sets this up | WhereMeta's data centres |
| A Qatari mobile operator | What it does for PhoenixText messages, once Phoenix sets this up | WhereQatar |
| Resend | What it does for PhoenixBooking emails | WhereUnited States |
| Expo | What it does for PhoenixNotifications to the phone app | WhereUnited States |
| A map provider | What it does for PhoenixMap images on search and venue pages, once Phoenix sets this up; it receives your IP address | WhereDepends on the provider chosen |
| GitHub | What it does for PhoenixEncrypted weekly backups, kept for 90 days | WhereUnited States |
6. Where it's kept
Phoenix's database and photos are kept in Mumbai, India, and some of the companies above are based in the United States, so your data leaves Qatar. We choose companies that protect it with encryption in transit, access controls and contracts.
7. How long we keep it
We keep data only as long as we need it:
| Data | How long we keep it |
|---|---|
| Your account, points, saved salons and follows | How long we keep itUntil you delete your account |
| Your bookings and their notes | How long we keep it5 years; after that your name and note are removed and only the totals stay |
| Reviews and their photos | How long we keep itWhile they're published; after you delete your account they show as from a former customer |
| Signed-in sessions | How long we keep it30 days, then removed a day after they end |
| Notifications in the app | How long we keep it1 year |
| Messages to the Phoenix team | How long we keep it12 months after they're closed |
| Availability alerts | How long we keep it90 days after they're set or sent |
| Recent searches | How long we keep it180 days |
| Records of the texts and emails we send you | How long we keep it30 days |
| The Phoenix team's activity records | How long we keep it2 years (7 years for the salons' monthly bills) |
| IP addresses kept to stop abuse | How long we keep it1 day |
| Encrypted backups | How long we keep it90 days |
8. Your rights
You can ask to see the personal data we hold about you, to correct or delete it, to object to how we use it, and to withdraw a consent you gave — for example to offers.
- Change your details and notification choices in Settings.
- Delete your account in Settings. Your upcoming appointments are cancelled and the salons and clinics told; past bookings stay in their records without your name or notes.
- For anything else, message us about your account.
If you think we've mishandled your data, you can complain to the competent authority in Qatar.
9. Cookies and device storage
Phoenix uses only the cookies and device storage it needs to work and to remember your choices. There are no advertising or tracking cookies, so there's nothing to accept.
| Name | What it's for | How long it lasts |
|---|---|---|
pwb_session·pwb_refresh | What it's forKeeps you signed in on the customer site | How long it lasts30 days |
pwb_bo_session·pwb_bo_refresh | What it's forKeeps salon teams and the Phoenix team signed in to their dashboards | How long it lasts30 days |
pwb_locale·pwb_bo_locale | What it's forYour language | How long it lasts1 year |
pwb_theme | What it's forLight or dark look | How long it lasts1 year |
pwb_vertical | What it's forSalons or Clinics | How long it lasts1 year |
pwb_provider_salon | What it's forThe salon a dashboard opens on | How long it lasts1 year |
pwb_recent_searches(device storage) | What it's forYour recent searches while you're signed out | How long it lastsUntil you clear this site's data |
pwb_last_search(device storage) | What it's forYour last search on the home page | How long it lastsUntil you clear this site's data |
On the live site the sign-in cookies start with __Host-, which keeps them to this site only. The phone app keeps your sign-in and a copy of recent screens on your phone until you sign out or remove the app.
10. Children
Phoenix is meant for adults. If you think a child has given us personal data, write to us through our Contact page and we'll delete it.
11. Keeping it safe
You sign in with one-time codes, never a password. Codes and sign-in tokens are stored scrambled, connections are encrypted, and only the people who need your data can see it.
12. Changes to this policy
When we change this policy, the date at the top changes, and we'll tell you in the app before an important change applies.