Privacy Policy
1. INTRODUCTION
Strand ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect your information when you use the Strand mobile application ("the App").
The data controller is Shortcuts Software (UK) Limited, trading as Strand. Contact details are in Section 14.
2. DATA WE COLLECT
We collect the following categories of data:
- Account information: name, email address, phone number, date of birth (to verify age), profile photo.
- Identity & authentication: credentials managed by our identity provider (AWS Cognito), session tokens, and — if you enable it — a flag that biometric unlock is active on your device (the biometric data itself never leaves your device).
- Stylist onboarding data: business type, services offered, trading hours, portfolio photos, and any documents you upload to support your stylist profile.
- Client preferences: service interests, discoverability settings, and address (when you opt in to geo-discovery).
- Booking data: appointment history, services booked, status changes, and payment records.
- Payment data: payment is processed by Stripe. We receive limited metadata (last four digits of card, payment status, Stripe identifiers). We do not store full card numbers.
- Location data: approximate or precise location, only when you grant permission, used to surface nearby stylists.
- Photos and media: profile photos, stylist portfolio images, and any photos attached to bookings or messages.
- Communications: messages sent through the in-app messaging feature, including attached media.
- Device & technical data: device type, OS version, app version, device identifiers, IP address, crash logs, and push notification tokens.
- Usage analytics: screens viewed, features used, and interaction events, collected via PostHog.
3. HOW WE USE YOUR DATA
We use your data to:
- Create and manage your account.
- Provide and improve the Strand service.
- Process bookings and payments.
- Send booking confirmations, reminders, and service-related notifications (push and email).
- Match clients with stylists based on location, services, and preferences.
- Detect and prevent fraud, abuse, and security incidents.
- Respond to support requests.
- Analyse usage to improve the App.
- Comply with legal obligations.
4. LEGAL BASIS FOR PROCESSING
Under UK GDPR, we rely on the following legal bases:
- Contract performance: to create your account, process bookings, and deliver the service.
- Legitimate interests: to secure the App, prevent fraud, analyse usage, and improve features. You can object to processing on this basis (see Section 9).
- Consent: for precise location, marketing communications, and optional analytics. You can withdraw consent at any time.
- Legal obligation: to meet tax, accounting, and regulatory requirements.
5. SUB-PROCESSORS AND DATA SHARING
We share your data with the following categories of recipients:
- Stylists you book with: your name, contact details, photo, and booking details necessary to fulfil the appointment. Stylists are independent businesses and act as separate data controllers for the data they receive.
- Stripe (payment processing): https://stripe.com/privacy
- AWS Cognito (identity and authentication): https://aws.amazon.com/privacy/
- Firebase / Google (push notifications, crash reporting): https://firebase.google.com/support/privacy
- PostHog (product analytics): https://posthog.com/privacy
- Cloud hosting providers (AWS) for storage and compute.
- Legal and regulatory authorities, where required by law.
We do not sell your personal data and we do not share it for third-party advertising.
6. INTERNATIONAL TRANSFERS
Some of our sub-processors are based outside the United Kingdom (notably in the United States and the European Union). Where data is transferred outside the UK, we rely on safeguards including UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, as appropriate.
7. DATA RETENTION
We retain your data as follows:
- Account data: while your account is active. On deletion, your name, email address, phone number, date of birth, profile photo and biography are erased or anonymised straight away.
- Messages you sent: the contents are erased when you delete your account. An empty placeholder remains in the other person's conversation so their thread stays readable. A message you delete yourself is erased in full within 30 days.
- Portfolio and profile images: deleted with your account, including the underlying image files.
- Booking and payment records: six years, to meet UK tax and accounting obligations and to defend disputes and chargebacks. These are retained even if you delete your account, as UK GDPR Article 17(3) permits.
- Reviews you wrote: retained on the stylist's profile with your name removed.
- Crash logs and analytics: typically up to 90 days.
- Marketing preferences: until you opt out or your account is deleted.
8. DATA SECURITY
We use encryption in transit (TLS) and at rest, role-based access controls, and standard security practices to protect your data. No system can be guaranteed 100% secure; if we become aware of a personal data breach affecting you, we will notify you in accordance with our legal obligations.
9. YOUR RIGHTS
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten"), subject to legal retention requirements.
- Restrict or object to processing.
- Data portability — receive your data in a structured, commonly used format.
- Withdraw consent, where processing is based on consent.
To exercise any of these rights, contact support@shortcutssoftware.com. We will respond within one month.
If you are unhappy with how we have handled your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk or by calling 0303 123 1113.
10. AUTOMATED DECISION-MAKING
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Stylist matching is algorithmically assisted but does not produce binding decisions.
11. CHILDREN
Strand is not intended for users under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact support@shortcutssoftware.com and we will delete it.
12. COOKIES AND SIMILAR TECHNOLOGIES
The App uses local storage and device identifiers for essential operation (session, preferences) and, where you consent, for analytics. Mobile platforms do not use traditional browser cookies; you can manage advertising identifiers and tracking permissions through your device settings.
13. CHANGES TO THIS POLICY
We may update this policy from time to time. Material changes will be notified through the App. The "Last updated" date at the top of this policy indicates when it was last revised.
14. CONTACT
Data Controller: Shortcuts Software (UK) Limited, trading as Strand
Registered in England and Wales, company number 04384547
Manchester Business Park, 3000 Aviator Way, Manchester M22 5TG
Contact: support@shortcutssoftware.com
Telephone: +44 161 972 4900