Your data, plainly

• It has no forms that send data, no accounts, no newsletter and no comments.
• It does not sell or rent data to anyone and makes no automated decisions about you.
• Fonts are served from the site’s own server; nothing is loaded from Google Fonts. There are no embedded videos or social media posts.
• It only processes what is described below: server logs, anonymous statistics, error reports and — only with your consent — Google statistics and Meta ad measurement.

The site is hosted by Vercel Inc. Like any web server, Vercel automatically records technical request logs: IP address, browser, requested page, referring page and time. The purpose is to run the site and protect it against abuse.

Legal basis: legitimate interest in keeping the site secure and working (Art. 6(1)(f) GDPR). Vercel keeps these logs only for a short time (from a few hours to a few days, depending on the log type), and I do not use them to identify you or for marketing. Vercel acts as a processor; data may be processed outside the European Economic Area with the safeguards required by the GDPR (EU-US Data Privacy Framework and standard contractual clauses).

I use Vercel Web Analytics and Vercel Speed Insights to know how many visits the site gets, which pages are read and how fast they load. They use no cookies and store nothing in your browser. Visits are counted with a temporary code derived from the request, which changes daily and cannot recognise you from one day to the next; I only see aggregated results (for example, “120 visits from Romania, on a phone”).

Besides visits, a few actions are counted: tapping a WhatsApp button or the phone number, ordering a gift voucher and switching language — only which button and on which page, never the message text or the names written on a voucher. If you arrived from a campaign, the campaign label from the link (utm_ parameters) is kept as well; it does not identify you.

Legal basis: legitimate interest in understanding how the site is used and keeping it fast (Art. 6(1)(f) GDPR). You can object at any time — just write to me; common ad blockers also stop these statistics.

If a page breaks in your browser, the site sends a short technical report to its own server: the error message and where in the code it happened (cleaned of personal data), the page address without parameters and the browser type. It contains no cookies, names or anything you typed, and the IP address is not saved in the report. The report goes to the Vercel logs and is deleted with them. Legal basis: legitimate interest in fixing errors (Art. 6(1)(f) GDPR).

Booking buttons open WhatsApp with a pre-written message that you can change. Nothing is sent until you press “send” in WhatsApp. The same goes for the voucher composer: the names and message you type stay in your browser and only reach me in the message you choose to send — the site does not save them or send them anywhere.

When you write, I receive your WhatsApp name and number, your profile photo (depending on your settings) and whatever you send me: the date, occasion, place, inspiration photos. I use them only to reply, prepare your quote and arrange the booking, course or voucher — legal basis: steps at your request before a contract, and the contract itself (Art. 6(1)(b) GDPR).

If you tell me about allergies, skin sensitivities or other health information, I use it only to work safely with you, based on your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.

I keep the conversation for as long as the booking and any follow-up questions require, then delete it; information needed for payment documents is kept for as long as Romanian accounting law requires. WhatsApp is a Meta service (WhatsApp Ireland Ltd.), end-to-end encrypted and covered by its own privacy policy, for which Meta is responsible.

The Instagram, TikTok and Facebook links are plain links: the site loads nothing from these networks until you tap them. Once there, that network’s policy applies (Instagram and Facebook belong to Meta; TikTok to TikTok). If you send me a direct message on Instagram, I treat it just like a WhatsApp message.

Photos and videos of clients, and screenshots of their messages, appear on the site and my accounts only with their consent. You can withdraw your consent at any time, and your images are removed from the site and my accounts.

The site stores only preferences it needs to work in your browser. They contain no personal data, are not sent to anyone and do not require consent.

You can delete them at any time in your browser settings; the site will fall back to Romanian and the default motion.

These tools only run if they have been switched on for the site. In that case a banner asks you before anything else, and “Cookie settings” appears at the bottom of every page. If you see neither, the tools are off. Nothing in this section loads before you accept, and refusing is as easy as accepting.

• Statistics — Google Analytics 4 (Google Ireland Ltd.): which pages are visited, where visitors come from, device type, country and the actions above. Sets the _ga and _ga_… cookies (up to 2 years). Runs in “Consent Mode v2”: everything starts as refused and only what you accept is switched on.
• Marketing — Meta Pixel and Conversions API (Meta Platforms Ireland Ltd.): shows whether Instagram and Facebook ads lead to visits and messages. Sets the _fbp and _fbc cookies (90 days). When you tap WhatsApp or the phone number, the site sends a “Contact” event to Meta both from your browser and from its own server, with the same code so it is not counted twice; the server sends your IP address, browser type and the _fbp/_fbc codes — never a name, phone number or e-mail. For collecting and sending this data I am a joint controller with Meta; what Meta does with it afterwards is Meta’s responsibility.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law 506/2004). You can withdraw it at any time under “Cookie settings”; these tools’ cookies are then deleted. Google and Meta may transfer data to the US under the EU-US Data Privacy Framework and standard contractual clauses.

Global Privacy Control: if your browser sends the GPC signal, I treat it as a refusal — nothing optional starts, and the banner only lets you know. If you then switch a category on yourself in the settings, I follow that explicit choice.

• Vercel Inc. — hosting, logs, anonymous statistics and error reports (processor).
• Meta — WhatsApp, when you choose to write to me; Meta Pixel / Conversions API only with your consent.
• Google — Google Analytics 4, only with your consent.
• Public authorities, only when the law requires it.

Under the GDPR (EU Regulation 2016/679) and Romanian Law 190/2018, you have the right:

• to know what data I hold about you and get a copy;
• to have it corrected if it is wrong;
• to have it erased;
• to restrict how it is processed;
• to object to processing based on legitimate interest;
• to receive your data in a portable format;
• to withdraw your consent at any time, without affecting what was done before.

Message or call me and I will reply within one month at the latest. If you are not satisfied with the answer, you can lodge a complaint with the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), www.dataprotection.ro.

When the site changes, I update this page and the date at the top before the change. If a change needs your consent, I ask for it again.

The conditions for bookings, courses and vouchers are in the Terms and conditions.