Privacy Policy

Who we are

Cavy is a trading name of Guinea Pig App Ltd, registered in England & Wales, company no. 17272796, registered address 75 Aintree Road, Chatham, Kent, ME5 8PQ. We are the “data controller” for the information you give us here. You can reach us any time at support@cavybeauty.com.

What this notice covers

This notice covers everything: the Cavy website, the waitlist, and the Cavy app. Where something applies to only one of them, we say so.

The short version

We collect what we need to run a booking service between stylists and models, and nothing for advertising. We don’t sell your data, we don’t share it with advertisers, and there’s no advertising or tracking software in the app or on this site. The website counts page visits without cookies and without identifying anyone — section 11 explains.

Some of what we hold is sensitive — photos of you, and details about your hair and skin. Those get extra protection, and section 7 explains them separately.

What we collect — website and waitlist

When you join the waitlist, we collect only what you enter in the form:

• Your first name
• Your email address
• Whether you’re a stylist or a model
• Your city or area, if you choose to add it (optional)
• Your TikTok or Instagram handle, if you choose to add it (optional)
• A record that you gave consent, and the date you signed up

That’s everything for the waitlist. We don’t track you around the web.

What we collect — the app

Your account: your first name and surname, email address, date of birth, whether you’re a stylist or a model, and your general region. Your password is stored by our login provider in a scrambled form that nobody at Cavy can read.

Your profile: your profile photo, a short bio, your Instagram handle if you add one, and any photos you upload. Stylists also have a banner image and a portfolio of their work.

Your look, if you’re a model: hair colour, type, length and condition; skin tone and skin type; eye colour and shape; nail condition. Each has a free-text box if the set options don’t fit. You choose what to fill in — none of it is required, and stylists search on it to find models for particular treatments.

Your location: your approximate location, so we can show you people nearby and sort results by distance. Stylists also have a location for their shop or working area. We ask your device for this and you can refuse; if you do, you can still browse.

Account checks: a selfie you take holding a handwritten note, which a member of our team looks at alongside your profile photo. We keep the result of that check, and any note the reviewer makes. It is not an identity check against a document — we do not ask for, see, or keep a passport or driving licence.

Bookings and messages: the appointments you make, when and where, which treatment, any notes or photos attached, what it cost, and the messages you exchange with the other person, including when they were read.

Reviews: the ratings and comments you leave, and those left about you.

Safety records: reports you make or that are made about you, anyone you block, any warning, suspension or ban, and a record of what our team did and why.

Agreements: when you agree to a treatment’s terms before a booking, we record which version of the terms you were shown, a fingerprint of that exact wording, the specific points you ticked, and when — so it can be shown later precisely what you agreed to. We don’t record your IP address or your device.

Payments: we use Stripe. Your card details go straight to Stripe and never reach us. We keep a reference to your Stripe account, what you paid, when, and whether a subscription is active.

Your device: if you turn on notifications, a token identifying your device so we can send them, and your notification preferences.

Why we use it, and our legal basis

To provide the service — your account, bookings, messages, reviews and payments. Our basis is that we need it to perform our contract with you. Without it there is no service to give you.

To keep people safe — identity checks, reports, blocking, moderation, and preventing someone banned from simply signing up again. Our basis is our legitimate interest in running a service where people meet in person, which we consider outweighs the limited intrusion involved. This is the reason some safety records outlive your account (section 9).

To take payment and keep proper records. Our basis is performance of our contract, and for financial records, our legal obligations.

Where we ask your permission — notifications, your device location, marketing emails, and the sensitive information in section 7 — our basis is your consent, and you can withdraw it at any time without affecting anything done beforehand.

We do not make any decision about you by purely automated means that has a legal or similarly significant effect. Decisions to warn, suspend or ban an account are made by a person.

Sensitive information

UK data protection law gives extra protection to certain information, including anything about your health or racial or ethnic origin. Three things we handle may fall into that category, and we want to be straightforward about them.

Details about your hair and skin. Hair type and skin tone are how stylists find models suited to a particular treatment, which is the core of what the app does. Depending on how they are described, they can also indicate someone’s ethnic origin. You choose whether to provide them and you can remove them at any time.

Your account-check selfie. A member of our team looks at it beside your profile photo, to see that a real person is behind the account and that the photo has not been taken from somewhere else. It does not confirm who you are against any document. We do not run facial recognition on it, we do not create a face template from it, and we do not use it to identify you anywhere else.

Where we rely on your consent for any of the above, you can withdraw it at any time by emailing us or by removing the information in the app.

Who we share it with, and where it’s kept

We do not sell your information and we do not share it with advertisers. There is no advertising software in our app or on this website, and no analytics in the app. The website counts page visits through our website host — see section 11.

Other people using Cavy see only part of your profile. Publicly, members see your first name and the first letter of your surname — for example, “Sarah B.” Your surname, email address, date of birth and exact location are never shown to other users. When you book with someone, they see what they need to carry out the appointment.

We use a small number of service providers who handle information only on our instructions: our database, login and file storage provider; our payment provider (Stripe); our email provider; our notification provider; and our website host.

Your information is stored in the United Kingdom (London). Some of our providers are based outside the UK and their staff may access it to provide support, in which case the transfer is covered by the safeguards UK law requires for international transfers.

We will also share information where the law requires it, or to protect someone from harm — including reporting child sexual abuse material to the authorities, as set out in our Terms and Community Guidelines.

How long we keep it

Your account and everything in it: until you delete your account. Deletion removes your profile, photos, messages and booking history straight away, and anything remaining in our systems is gone within 30 days.

Verification selfies: up to 90 days after the check, or until you delete your account — whichever comes first.

Safety and agreement records: up to 6 years, then deleted automatically. This covers records that you agreed to a treatment, any moderation action taken, and reports made by or about you. These survive account deletion — a report about someone shouldn’t disappear because they left. What stays is your first name and a scrambled version of your email address that we cannot turn back into an address, not your photos, messages or contact details. Our Request account & data deletion page explains this in full.

Waitlist details: until Cavy launches and we’ve told you, or until you unsubscribe or ask us to delete them — whichever comes first.

Your rights

Under UK data protection law you can, at any time:

• Ask what we hold about you, and get a copy
• Correct anything that’s wrong
• Have your details deleted
• Ask us to restrict how we use your information, or object to us using it
• Withdraw any consent you’ve given, including for notifications or location
• Ask us to send your details to you, or to another service, in a portable format

To do any of these, email support@cavybeauty.com and we’ll sort it out. You can delete your account yourself at any time in the app: Settings → Delete account.

Cookies

This website doesn’t use tracking or advertising cookies. Our fonts are served from this site rather than a third party, so loading a page doesn’t share your IP address with anyone else. The app uses a login token to keep you signed in, which is not used for tracking.

We measure page visits with Vercel Web Analytics, which doesn’t use cookies or identify individuals.

Age

Cavy is strictly for adults. You must be 18 or over to join the waitlist or use the app, and we ask for your date of birth at sign-up to check. We don’t knowingly collect information about anyone under 18; if we find that we have, we delete the account.

Changes to this notice

If we change how we handle your information, we’ll update this page and change the date at the top. If the change is significant, we’ll tell you in the app or by email rather than relying on you to notice.

Contact & complaints

Questions or requests: support@cavybeauty.com. If you’re unhappy with how we’ve handled your data, you can complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk. We are registered with the ICO under reference ZC196530.