Privacy policy.

RG Nails is a one-to-one nail studio in Belmont, Perth, WA. RG Nails is a registered business name of Rashika Ghimire (ABN 60 155 682 451), a sole trader who operates the business and is responsible for this policy. In this policy, “we”, “us” and “our” mean RG Nails.

This website (rgnails.com.au) lets you view our services and prices and book appointments online. You do not need an account to book.

When you book an appointment, we collect:

• your full name, email address and phone number
• your Instagram username, if you choose to give it
• the service, date, time and price of your appointment, and a booking reference
• any design notes or other notes you add
• a design inspiration photo, if you choose to upload one

When you book by phone, Instagram, in person or another way, RG Nails records your appointment in the same booking system, with your name and any phone number or email address you choose to give, how you booked, and any notes needed for your appointment.

To protect the booking system from misuse, our server converts your IP address into a one-way coded value and uses it to count requests over a short period. Your IP address itself is not saved in our booking records. Our hosting provider also processes standard technical information, such as IP address, browser type and the pages requested, to deliver this website and keep it secure.

In your browser, the booking form keeps a random request code in session storage while you book. It is used only to stop the same booking being made twice, and it is removed when your booking is confirmed or when you close the tab. The public website does not set cookies and does not use advertising or analytics tools. The private owner area, used only by authorised RG Nails personnel, uses essential sign-in cookies.

We do not take payments online, so we do not collect card or bank details through this website.

We use your information to:

• create and manage your appointment
• send booking confirmation, appointment reminder and cancellation emails, including a link to view or cancel your booking
• notify RG Nails of new bookings and cancellations, and add appointments to the owner’s Google Calendar (see below)
• communicate with you about your appointment
• prepare your nail design from your notes and photo
• prevent misuse and protect the booking system
• carry out legitimate business administration

Marketing. We do not use your booking details to send unsolicited promotional emails, marketing campaigns or unrelated promotional messages unless you have separately given us permission. The booking system does not send marketing emails. RG Nails promotes its work on social media such as Instagram and TikTok; that general social media activity does not use your booking details. We do not sell your personal information.

Uploading a design inspiration photo is optional. We collect it only to prepare for your appointment.

• JPG, PNG and WebP images up to 4 MB are accepted. Before storing your photo, we resize it to a maximum of 1600 pixels and remove its hidden metadata, including any location (GPS) information.
• Photos are stored privately with no public link. Only authorised RG Nails personnel, signed in to the private owner area, can view them. Photos are not attached to emails.
• We will not publish your photo on our website, Instagram, TikTok or in any advertising without your specific permission, and we do not sell customer photos.
• The images in our website gallery and on our homepage are separate from customer uploads. Customer uploads are never shown there.

How long photos are kept:

• Uploads where the booking is not completed become eligible for deletion 30 minutes after upload and are deleted automatically during our next scheduled clean-up, which currently runs once a day.
• Photos attached to a booking are kept with that booking record. They are not deleted automatically and remain until we remove them manually, for example in response to a deletion request.
• Photos attached to a cancelled booking are treated the same way. Cancelling a booking does not delete its photo.

We use a small number of service providers to run this website and booking system. They process personal information on our behalf to provide their services:

• Supabase: our database, private photo storage and owner sign-in. Our Supabase project is set up in Supabase’s Sydney region.
• Vercel: hosts this website and runs the booking system.
• Resend: delivers booking confirmation, reminder, notification and cancellation emails.
• Google: Google Calendar, used for the owner’s appointment calendar (see below).

Some of these providers are based in, or may process information in, countries outside Australia, including the United States. Each provider has its own privacy policy.

Our website also links to Instagram and TikTok. If you contact us there or by phone, those conversations are handled through those services under their own terms.

With the owner’s authorisation, this website connects to the owner’s own Google Calendar to manage appointments. It does not connect to customers’ Google accounts and does not request access to the owner’s Google profile, contacts or other Google services.

• Permission used: Google’s calendar events permission. This permission would allow events on the owner’s calendars to be viewed and edited, but the website uses it only to create and delete the appointment events that the booking system makes.
• What it does: when you book, it creates an event in the owner’s calendar showing the service, appointment time, your name, phone number, email address, booking reference and any notes you added. If the booking is cancelled, it deletes that event.
• What it does not do: it does not read, list or copy other calendar events, and it never adds you as a guest, so Google will not send you an invitation.
• What we store: the ID of each calendar event, saved with the booking so the event can be removed if the booking is cancelled. The owner’s Google authorisation is stored as a secret in our hosting configuration, not in the booking database. Short-lived access tokens are not stored.
• How Google data is used: only to provide this appointment calendar feature. It is not used for advertising, not sold, and not disclosed for unrelated purposes.

The use and transfer of information received from Google APIs by RG Nails will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The owner can remove this access at any time from their Google Account permissions. Because appointments appear in the owner’s Google Calendar, Google stores those event details under Google’s own privacy policy.

We keep customer and booking information for as long as reasonably required for appointment management, business administration, booking history, responding to enquiries, resolving disputes and any applicable legal or financial record-keeping requirements.

We do not currently have an automatic deletion schedule for customer and booking records, including cancelled bookings and photos attached to bookings. These are kept until we remove them manually.

Some information is deleted automatically:

• uploaded photos where the booking was not completed, as described above
• the coded request counters used to protect the booking system, which are deleted during the scheduled clean-up after they expire
• the owner’s Google Calendar event for a booking, when that booking is cancelled

Booking emails stay in the mailboxes they were sent to until deleted, and our email provider may keep its own delivery records under its policies.

Pages and booking requests are served over encrypted HTTPS connections. Booking details and photos can only be viewed by authorised personnel signed in to the private owner area, and links to view or cancel a booking use a unique private code. Photos have their hidden metadata removed before storage, and service credentials are kept on the server, not in the website code. No method of storing or sending information is completely secure, but we take care to protect the information you give us.

You can contact us to:

• ask for access to the personal information we hold about you
• ask us to correct information that is inaccurate
• ask us to delete your information, where appropriate
• ask how your information is handled
• raise a privacy concern or complaint

We may need to verify your identity before disclosing, changing or deleting personal information. We will respond within a reasonable time. Some information may need to be kept for legitimate business or legal reasons, and if so we will explain this. You can cancel an appointment online up to 24 hours before it starts using the link in your confirmation email, as explained in our cancellation policy.

If you have a concern about how we have handled your personal information, please contact us using the details above and tell us what happened. We will look into it, may ask you for more information, and will let you know the outcome within a reasonable time. If you are not satisfied with our response, you can ask us to review it again or seek independent advice.

We may update this policy when our website, services or practices change. The date at the top shows when it was last updated.

Questions? Get in touch.