Privacy policy

This notice explains how personal data is used when you visit the Sashkelooo website or enquire about makeup services. Sending the form is an enquiry, not a confirmed appointment.

1. Who is responsible

The person responsible for processing your data is Грецкая Александра Олеговна, known as Sashkelooo in Sofia, Bulgaria. For privacy questions or to exercise your rights, email beauty@sashkelooo.com.

2. What we receive

The form asks for your name, chosen service and date, preferred contact method and the corresponding contact detail: email, telephone number or social/messaging username. Depending on the service, you may provide a time, alternative date, service location, wedding preparation details, a reference link and a comment. Optional fields may be left blank. Required fields are needed to submit the form; without a working contact detail we cannot reply.

An enquiry also includes the form language, a technical reference number and submission time, and your consent checkbox response. When you visit the site or use its anti-spam check, service providers receive technical information, including your IP address, browser information and request details. Please do not send medical information, identity documents or other people's contact details through the form. The form does not upload photographs or files.

3. Purposes and legal grounds

We use form details to reply to your enquiry and discuss a service on the basis of the consent you give when submitting it (GDPR Article 6(1)(a)). You can withdraw consent by emailing the address above. Withdrawal does not affect earlier lawful processing; we stop processing on that basis and may no longer be able to continue discussing the enquiry.

When you contact us directly by email or social media about a service, we use the necessary details to take steps at your request before an agreement and, once agreed, to fulfil it (Article 6(1)(b)). Required accounting records are processed to meet applicable legal obligations (Article 6(1)(c)). We use technical data to protect the site, prevent spam and resolve faults on the basis of our legitimate interest in securing the site and correspondence (Article 6(1)(f)). The checkbox does not subscribe you to marketing. The site makes no automated appointment decisions or other decisions producing legal or similarly significant effects for you.

4. Service providers

Alexandra receives your enquiry. Vercel hosts the site and processes form submissions; Resend delivers the enquiry email to the mailbox. If you provide an email address, Resend also sends you a short receipt confirmation. Correspondence is stored in the Namecheap Private Email mailbox. Enquiries are not saved in a separate website database or in the Sanity CMS. Sanity provides website content and images and may receive technical information when images load.

Cloudflare Turnstile protects the form from bots. It starts when the form loads, before submission and before you tick the consent box. Cloudflare receives your IP address and browser signals; the server sends a token and IP address for verification. Cloudflare processes signals as a security service provider and separately as a controller to improve its bot detection technology. See the Turnstile Privacy Addendum.

Providers may process data outside the European Economic Area, including in the United States. Their terms provide international transfer mechanisms, including EU Standard Contractual Clauses and, where applicable, adequacy decisions. See Vercel, Resend, Namecheap, Sanity and Cloudflare. You may contact us for information about the applicable safeguards and a copy of them.

5. Retention

We delete enquiries that do not lead to an appointment, and related correspondence, 6 months after the last contact. We delete completed appointment details and related correspondence 12 months after the service. These periods apply to copies under our control, including email. If a particular record must be kept longer by law or to resolve a dispute, we retain only the necessary information for the relevant period.

Delivery, hosting and security services have their own retention periods for technical logs and backups; deleting an email from our mailbox does not immediately delete all such copies. Resend states that its standard plans retain email and logs for 30 days and backups for 7 days. Other providers' terms are linked above. Technical information supports operation and security of the services; it is not a customer database.

6. Your rights

You can request access to and correction of your data, and, where the GDPR provides, erasure, restriction and portability. You may withdraw consent and object to processing based on legitimate interests. Contact beauty@sashkelooo.com. Where necessary, we will ask for enough information to verify your identity. We normally respond within one month and will explain any permitted extension.

You may also complain to Bulgaria's Commission for Personal Data Protection (CPDP) or another competent supervisory authority.

7. Analytics and external links

The site has no visitor analytics, advertising pixels or ongoing collection of visitors' performance metrics. Technical processing needed to operate the site and protect the form still takes place. The application does not save enquiry text in cookies or persistent browser storage; after an error, fields remain in the open page's memory so you can retry.

If you follow an ordinary link to Instagram or another service and contact us there, further correspondence takes place on that platform under its rules. We use the details you send to reply and arrange an appointment. Following a link does not itself send the form contents to the platform.

8. Changes

If data processing changes, we will update this page and its revision date. New purposes that require separate consent are not covered by earlier consent in the form.