Privacy Policy

Last updated: 11 September 2026

1. Who is responsible for your data

The Autevia Beauty service is operated by FHU Mateusz Gruza, with its registered office in Oława, NIP (Polish tax identification number) 9121934249, e-mail address: contact@autevia.com.

We act in two different roles, and that distinction has legal significance.

Towards salon owners and staff who use the panel we are the data controller: we decide what data we collect at registration and for what purpose.

Towards salon clients we are solely a data processor. The controller of their data is the salon that entered it or that they wrote to. It is the salon that decides on the purposes of processing; we merely provide the tool and process the data on the salon's instruction, on the terms of the umowa powierzenia (data processing agreement) concluded at registration.

The practical consequence: if you are a salon client and you wish to exercise your rights, contact the salon. We will pass such a request on to the salon and help it carry the request out, but we cannot decide about someone else's data on our own.

2. Data of salon owners and staff

What we collect: e-mail address and password (stored only as a hash, we do not know it), the salon name, address and telephone number, staff first names, invoicing details together with the NIP number, and the IP address and basic technical information at sign-in.

Why, and on what basis. Operating the account and providing the service - performance of the contract (Article 6(1)(b) GDPR). Settlements and invoices - a legal obligation (point (c)). Security, preventing abuse and pursuing claims - our legitimate interest (point (f)).

For how long. Account data for the duration of the contract and for 30 days after it ends - this is the period for downloading the data, after which we delete it automatically. We keep accounting documents for 5 years from the end of the tax year, because tax law requires it and we cannot delete them earlier, even on request. The administrative event log - 180 days.

3. Data of salon clients

The salon enters it itself, or it arises when a client books an appointment or writes to the salon on Messenger or Instagram.

Scope: first name and surname, telephone number, e-mail address, visit history, salon notes, the content of conversations with the AI assistant, and the Messenger or Instagram account identifier, if the client wrote through that channel.

Retention periods - the actual position, enforced automatically:

Once a salon's contract ends, we delete all of its clients' data within 30 days.

Nobody except the salon reads the content of conversations. We have no access to it from the administration panel; it serves solely to let the assistant remember the context of the current conversation.

4. Who we entrust data to

We use the services of entities that process data on our behalf. We have an umowa powierzenia (data processing agreement) with each of them.

We make the full list of sub-processors, together with their names, available to salons in the data processing agreement concluded when an account is created.

Transfers of data outside the European Economic Area take place on the basis of the standard contractual clauses approved by the European Commission.

On the AI assistant separately. The content of a client's conversation with the assistant is sent to Google's language model in order to generate a reply. Google does not use that content to train its models. Conversations are not profiled and are not used to make decisions producing legal effects.

5. Your rights

You have the right to access your data, to rectify it, to erase it, to restrict its processing, to transfer it, and to object to processing based on our legitimate interest. You may withdraw your consent to analytics cookies at any time.

Address requests to contact@autevia.com. We reply within 30 days.

If you are a salon client, contact the salon - it is the controller of your data. We can pass your request on, but we will not carry it out without the salon's instruction.

You also have the right to lodge a complaint with the supervisory authority, which in Poland is the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office).

6. Cookies

Necessary - without them the website and the panel do not work. They maintain the sign-in session, remember the language choice and protect forms against bots. They do not require consent, because they are necessary in order to provide the service you are asking for.

Analytics - they help us understand how the site is used: which sections you read, where you end your visit. We run them only after you have consented. Refusing restricts nothing.

Marketing - they make it possible to measure how effective advertising is. Also only with consent.

You give or refuse consent in the window shown on your first visit, and you change it at any time using the "Cookie settings" link in the footer. Until consent is given, no analytics or marketing script runs.

7. Security

Connections are encrypted. We store passwords only as hashes. Only people authorised by the salon have access to that salon's data. Platform administrator access to salon data is logged. The registration and booking forms are protected against bots.

Database backups are made daily and kept for 7 days.

8. Changes

We will inform you of material changes by e-mail, to the address assigned to the account, at least 14 days in advance.