Privacy Policy

This policy explains what personal information BeautyGoGo, Inc. ("Vylvet", "we") collects when you use vylvet.co, a shop's storefront on a vylvet.co address or its own domain, or the Vylvet app for iPhone and Android, and what we do with it.

Vylvet is a marketplace for independent local shops. You buy from the shop, not from us: we provide the storefront, take the payment on the shop's behalf and arrange delivery. That matters for your privacy, because it means the shop you order from receives your details directly and decides for itself what it does with them.

1. Information we collect

Information you give us

• Order details. Your name, email address, telephone number, delivery address and the items you ordered. We cannot deliver an order without them.
• Account details. If you choose to create an account, your name, email address and a password held by our authentication provider. We never see your password. An account is optional: you can browse and buy as a guest.
• Messages. Anything you write to us for support.

Information collected automatically

• Approximate location, only when you ask for it. The app does not request your location when it opens. It asks once, at the moment you use something that needs it, such as listing the shops nearest you or checking whether a shop delivers to your address. We request approximate rather than precise location, because a list of nearby shops does not need to know which room you are in. You may refuse and the app continues to work, and you can withdraw permission at any time in your device settings.
• Device and usage information. Device type, operating system, app version, and which pages were visited.
• How the app is used, and when it breaks. We use PostHog to record which screens are opened, what is tapped, the details of any crash or error, and a recording of the screen itself while you use the app. It is how we find out that something is broken before enough people give up to make it obvious.
  
  The screen recording includes what you type into the app, which at checkout means your name, phone number, delivery address and any note you leave for the shop. Two things are never in it. Your password is hidden from the recording by the app. Card details are never in it either, because paying happens in your phone's browser, outside the app, where the recording cannot reach.
  
  It is tied to your account only if you have one, and to the account identifier rather than your email address. There is no advertising identifier, nothing is shared with data brokers, and nothing follows you into other companies' apps or websites. If you would rather we did not record your screen, email us and we will switch it off for your account and delete what we have.
• Information kept on your device. Your basket, saved items, recently viewed shops and your order history are stored on your device, not on our servers. Deleting the app deletes them.

Information we do not collect

• Your card details. Payments are processed by Stripe on Stripe's own pages. Card numbers are never transmitted to or stored by Vylvet. We receive confirmation that a payment succeeded, the amount, and the card brand and last four digits shown on your receipt.
• Advertising identifiers, and any form of cross-app tracking. The app contains no advertising software. Nothing you do is tracked across other companies' apps or websites, and no data is shared with data brokers.
• Your photos, camera, contacts, calendar, microphone or files. The app does not request access to any of these.

2. Why we use it, and on what basis

Where the law requires a legal basis for processing, ours is set out below. We do not use your personal information for automated decision making that produces legal or similarly significant effects.

• To fulfil your order (performance of a contract): passing your details to the shop, arranging delivery or collection, taking payment, sending receipts and order updates.
• To operate your account (performance of a contract): signing you in and keeping your saved delivery addresses available at checkout.
• To provide support (legitimate interests, in answering you).
• To keep the service working and secure (legitimate interests, in running a service that is not being abused): diagnosing faults and preventing fraud.
• To show you nearby shops (consent): approximate location, which you grant and can withdraw.
• To understand how the website is used (consent): analytics on vylvet.co only, and only after you accept them.
• To meet legal obligations: tax, accounting and responding to lawful requests.

We do not sell personal information, and we do not share it for advertising.

3. Who receives your information

The shop you buy from

When you place an order, the shop fulfilling it receives your name, contact details, delivery address and the contents of your order. Each shop is an independent business and is responsible for its own use of that information under its own privacy practices. If you want a shop to delete what it holds about you, contact the shop; we will help you reach them.

Service providers acting on our instructions

Each receives only what its function requires:

• Stripe, payment processing and merchant payouts.
• Google Firebase, hosting, authentication and the database.
• Uber, courier delivery. Receives the collection and delivery addresses for an order being delivered.
• FedEx, shipping. Receives the delivery address for an order being posted.
• Algolia, product search across the catalogue.
• PostHog, product analytics, error reporting and screen recording. Hosted in the EU.
• Mailgun, order emails and receipts.
• Twilio, order text messages, where you have given a mobile number.

Others

We may disclose information where we are legally required to, to establish or defend legal claims, or to a buyer in connection with a sale or reorganisation of the business, in which case this policy continues to apply to information transferred.

4. Where your information is held

Our service providers operate in the United States, and some operate internationally. Where information is transferred outside the country you live in, we rely on the safeguards our providers put in place for those transfers, such as standard contractual clauses.

5. How long we keep it

• Order records are retained for as long as needed for accounting and tax, and for the shop to handle refunds and disputes.
• Account details are retained until you delete your account.
• Support messages are retained for as long as needed to resolve the matter and to keep a record of it.
• Information on your device is retained until you delete the app.

6. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected, to have it deleted, to object to or restrict how we use it, to receive a copy in a portable format, and to withdraw consent where our basis is consent. Californian residents have the right to know what is collected and disclosed, to delete it, to correct it, and not to be discriminated against for exercising those rights.We do not sell or share personal information as those terms are defined under Californian law.

Deleting your account. You can delete your account from inside the app at any time: open Account and choose Delete my account. Deletion is immediate and cannot be undone. Your profile, your saved delivery addresses and everything held on your device are removed with it.

Orders you have already placed remain with the shop that fulfilled them. They are that business's record of a completed sale and are needed for refunds, disputes and tax, so we cannot remove them on the shop's behalf. Once your account is deleted those records are no longer connected to a Vylvet account.

To exercise any other right, write to info@vylvet.co. We will respond within the period the applicable law requires, and we may need to verify your identity first. You may also complain to your local data protection authority.

7. Cookies and analytics

On vylvet.co, analytics load only after you accept them in the banner. If you decline, no analytics scripts are loaded at all. Cookies strictly necessary to run the site, such as keeping you signed in, are set without consent because the site does not function without them. The Vylvet app contains no advertising software. It does use product analytics, described in section 1. Individual shops may add their own analytics to their storefront; those are governed by that shop's own policy.

8. Notifications

Order updates appear inside the app when you open it. The app also shows a count on its own icon when something has changed, which happens entirely on your device.

If you allow it, the app sends notifications to your phone about your orders: when the shop confirms one, when it is on its way or ready to collect, when it arrives, and if it is cancelled or refunded. The app only asks for this after you place an order or when you turn a notification on in its settings, never when you first open it.

To send them we store two things: an identifier the app creates for itself when installed, and the address your phone's operating system gives us for delivering notifications. If you are signed in we link them to your account, so notifications reach every phone you use. We do not use them to track you, we do not share them, and they are not your phone's advertising or hardware identifier.

You can turn notifications off at any time, by category in the app's notification settings or entirely in your phone's settings. Notifications about a cancellation or a refund are sent even if you turn off the others, because they are about your money. When you delete your account we delete what we stored to send them.

9. Security

Information is encrypted in transit. Access to production data is limited to people who need it to run the service. No system is perfectly secure, and we will tell you and the relevant authority about a breach affecting your information where the law requires it.

10. Children

Vylvet is not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child has given us information, write to us and we will delete it.

11. Changes to this policy

If we change this policy in a way that materially affects you, we will say so on this page and update the date above. Continuing to use Vylvet after a change means the updated policy applies.

12. Contact

BeautyGoGo, Inc.
info@vylvet.co ·+1 (248) 752-8857