Privacy Policy
Winkly is operated by Stellar Pursuits Inc., doing business as Winkly (“Winkly”, “we,” “us,” or “our”). We are committed to protecting the privacy of personal information of the people who use our platform. This Privacy Policy describes how we collect, use, and disclose personal information through the Winkly platform at winklyapp.com (the “Platform”).
The Platform is a business management tool for lash technicians. It is designed to help lash technicians manage their client directory, send consent forms, schedule appointments, and track their business.
This Policy applies to lash technicianswho create a Winkly account (“Technicians”) and to clients whose personal information is entered into the Platform by their lash technician.
Our Two Roles
We act as a data controller for information collected directly from Technicians — meaning we determine how and why that information is used.
We act as a data processor for information that Technicians collect about their clients through the Platform. In that role, we handle client information on behalf of the Technician. The Technician is the data controller for their clients' information and is responsible for having a lawful basis for collecting it.
Information We Collect
From Technicians, we collect the information needed to create and manage an account, including identity and contact details, business profile information, professional certification documents uploaded for verification, and account security and subscription data.
From clients (collected on behalf of Technicians), we process the information Technicians enter to manage their lash business. This includes client contact and identity information, health and safety information provided on consent forms (such as allergies, skin and eye conditions, and pregnancy status), signed consent form records, appointment history, service notes, photos and files uploaded to client profiles, and financial transaction records.
Automatically, we collect technical data necessary to operate and secure the Platform, such as session information, IP addresses at the time of form signing, and error monitoring data.
How We Use This Information
We use personal information only to provide and improve the Platform. This includes:
- Creating and managing Technician accounts
- Displaying public business profiles and enabling online booking
- Delivering and storing client consent forms
- Supporting Technicians in managing client records, appointments, and business finances
- Processing subscription payments
- Verifying Technician certifications
- Maintaining the security and integrity of the Platform
We do not use personal information for advertising or sell it to third parties.
Who We Share Information With
We share personal information only with third-party service providers who assist us in operating the Platform, such as hosting, file storage, email delivery, payment processing, and error monitoring. Each provider is bound by contract to protect personal information and use it only as directed by us.
To receive payments through the Platform, Technicians connect via Stripe. By doing so, you agree to Stripe's terms and privacy policy.
We do not sell personal information. We may disclose information if required by law or court order.
Cross-border transfers: Some of our service providers are located outside Canada, including in the United States. Your information may be subject to the laws of those jurisdictions. We take reasonable steps to ensure all providers protect personal information appropriately.
How Long We Keep Information
We retain personal information for as long as it is needed to provide the Platform and meet our legal obligations. Signed consent form records are retained for a minimum of seven years. When a Technician closes their account, personal data is deleted following a short retention period, except where longer retention is required by law.
How We Protect Information
We take reasonable physical, organizational, and technical steps to protect personal information. Sensitive health information collected through consent forms is encrypted at rest. Signed consent form records are stored with cryptographic integrity protections. Passwords are stored as one-way hashes and are never accessible to our staff. File uploads are stored in private, access-controlled cloud storage.
No system can be guaranteed completely secure. If you believe your account has been compromised, please contact us immediately.
Cookies
We use only essential cookies required to operate the Platform. We currently use one preference cookie to remember your sidebar display settings. We do not use advertising, tracking, or analytics cookies. If we introduce non-essential cookies in the future, we will update this Policy and request your consent.
Your Rights
Technicians may request access to, correction of, or deletion of their personal information by contacting our Privacy Officer. You may also withdraw consent, request a portable copy of your data, or file a complaint with the BC Office of the Information and Privacy Commissioner or the Office of the Privacy Commissioner of Canada.
Clients do not have accounts with Winkly. To access, correct, or delete your information, please contact your lash technician directly. For further assistance, you may also contact our Privacy Officer.
Quebec
Quebec residents may additionally request that we provide their data in a portable, machine-readable format. We conduct Privacy Impact Assessments before introducing new data processing activities. We do not use automated decision-making that produces legal or significant effects on individuals. Personal information may be transferred outside Quebec to the service providers described above, with contractual protections in place.
Changes to This Policy
We may update this policy as needed to comply with relevant regulations and reflect any new practices. If we make significant changes, we will refresh the date at the top of this page and notify you by email or with a notice in the app.
Contact Us
Winkly (Stellar Pursuits Inc. doing business as Winkly)
Vancouver, British Columbia, Canada
This Policy is governed by BC's Personal Information Protection Act (PIPA), the Personal Information Protection and Electronic Documents Act (PIPEDA), and Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25), as applicable.