Privacy Policy

Welcome to the Privacy Policy for DoAvelon (https://doavelon.com) and digital software products, web services, and mobile applications engineered, owned, or operated by DoAvelon, specifically including the Glam&Cut mobile and web application platform.

DoAvelon is committed to protecting your personal privacy, maintaining operational transparency, and handling personal data strictly in accordance with applicable data protection laws, including Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation / GDPR) and applicable Italian privacy regulations (Decreto Legislativo 196/2003 as updated by D.Lgs 101/2018).

This document details how we collect, store, use, share, and protect information when you visit our website, submit project inquiries, enter into software engineering service agreements, or create and maintain an account on the Glam&Cut platform. By accessing or using our website, services, or applications, you acknowledge that you have read and understood the privacy practices described herein.

The Data Controller responsible for the processing of your personal data under this Privacy Policy is:

Important Legal Notice: DoAvelon is currently operated independently by Prafull Kedari Lohgaon as an independent developer and sole proprietor, rather than as a corporate entity. No corporate VAT number, commercial registration number, or incorporated company legal status is claimed or published at this stage.

This Privacy Policy applies universally to all individuals and entities who interact with our digital ecosystem. We distinguish five distinct categories of users across our systems:

The categories of personal information we collect depend on how you interact with our website, services, and software applications:

A. Information Collected via DoAvelon Website & Inquiries

• Contact Identifiers: Full name, work email address, phone number, company/organization name, and country of residence.
• Project Briefing Data: Service interests, estimated budget ranges, target timelines, project goals, uploaded specifications, and written notes.
• Website Technical Telemetry: IP address, browser user-agent, operating system, referring URLs, request timestamps, and session interactions.

B. Information Collected via Glam&Cut Application Platform

• Customer Account Profiles: Name, email address, mobile phone number, profile photo (optional), and authentication credentials.
• Barbershop & Salon Profiles: Business trade name, salon owner/manager identity, business address, contact telephone numbers, operating hours, service catalog, price list, and staff member schedules.
• Appointment & Booking Information: Selected salon/barber, requested services (e.g. haircut, beard trim, styling), date and time of appointment, booking status (pending, confirmed, canceled), and client notes.
• Location Data (Optional): With your explicit device permission, we collect precise or approximate geolocation coordinates strictly to display nearby barbershops and salons on interactive maps. Location tracking is active only when using map search features.
• Photos and Media: Profile photos uploaded by customers, as well as showcase portfolio photos/videos of haircuts and salon interiors uploaded by barbers or shop owners.
• Authentication & Session Tokens: Login credentials managed securely via Firebase Authentication, including encrypted session tokens.
• Push & In-App Notifications Telemetry: Device tokens utilized to deliver transactional push notifications regarding appointment confirmations, reminders, and schedule updates.

We process personal data strictly for specified, explicit, and legitimate purposes:

In accordance with Article 6 of the EU GDPR, we process personal data under the following legal bases:

• Contractual Necessity — GDPR Article 6(1)(b)Processing is necessary to fulfill our obligations under terms of service, manage Glam&Cut customer accounts, execute appointment bookings, and honor business client scoping agreements.
• Legitimate Interests — GDPR Article 6(1)(f)Processing is conducted to secure platform infrastructure, prevent spam/fraud, optimize system performance, maintain technical logs, and manage business client communications.
• Consent — GDPR Article 6(1)(a)Processing relies on your explicit consent for optional device permissions (such as precise geolocation access for map features or photo gallery access for uploads). Consent may be withdrawn at any time via your device settings.
• Legal Obligations — GDPR Article 6(1)(c)Processing is conducted where required to comply with statutory legal, accounting, tax, or regulatory obligations under Italian and European Union law.

To provide our services efficiently, we rely on trusted third-party technology providers who process data strictly under our instructions and in compliance with data protection standards:

Payment Processors Notice:If or when online payment features are enabled in future updates of Glam&Cut, payment transaction details will be handled directly by PCI-DSS compliant third-party payment gateways (such as Stripe). Payment card numbers are never stored on DoAvelon servers.

We adhere to strict data sharing principles:

• Operational Sharing in Glam&Cut: To facilitate appointment bookings, necessary details (e.g. customer name, phone number, appointment time, and service requested) are shared with the specific barbershop or salon booked by the customer. Likewise, salon address and stylist details are provided to the customer.
• Legal & Regulatory Compliance: We may disclose personal data if required to do so by applicable law, court order, subpoena, or valid legal demand by Italian or EU law enforcement authorities.
• Business Transfers: In the event of a reorganization, merger, or transfer of DoAvelon brand operations, customer data will remain protected under equivalent terms.

DoAvelon is based in Italy (European Union). Data collected from users within the European Economic Area (EEA) is primarily stored on secure European cloud servers provided by infrastructure partners (such as Google Firebase servers located in the EU).

Where data is transferred to or accessed from countries outside the EEA (such as global hosting nodes operated by Vercel or Resend in the United States), such transfers are safeguarded through appropriate legal mechanisms, including the European Commission's Standard Contractual Clauses (SCCs) or vendor certification under the EU-U.S. Data Privacy Framework.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

Upon expiration of retention periods or upon valid deletion request, personal data is permanently deleted or anonymized.

We implement robust technical and organizational security measures to protect personal data against unauthorized access, loss, alteration, or disclosure:

• Encryption in Transit: All web traffic and mobile application API requests are transmitted over HTTPS encrypted with modern TLS protocol suites.
• Encryption at Rest: Database records, session tokens, and uploaded media are stored in encrypted cloud environments managed by Google Firebase and Vercel.
• Access Controls: Access to backend administrative tools and databases is strictly limited to authorized maintainers through multi-factor authentication and role-based access rules.

Please note that despite industry-standard safeguards, no method of transmission over the internet or electronic storage is 100% secure. You remain responsible for maintaining the confidentiality of your account credentials.

Under European Union data protection laws (GDPR Articles 15-22), users have fundamental privacy rights:

To exercise any of these rights, please email us at prafullkedari44@gmail.com. We respond to all valid requests free of charge within 30 days.

We provide clear mechanisms for requesting the complete removal of your account and associated personal data:

Upon receipt and verification of a valid deletion request, your profile, authentication records, and associated data will be permanently deleted from our databases within 30 days, except where retention is required by statutory law.

DoAvelon services and the Glam&Cut application are not directed toward children under the age of 16 (or under 14 under Italian national law regarding information society services). We do not knowingly collect or solicit personal data from minors without verified parental or guardian consent.

If we learn that personal data of a minor under the applicable legal age has been collected without verifiable consent, we will take immediate steps to delete such information. Parents or legal guardians who believe their child has provided data may contact us at prafullkedari44@gmail.com.

Our website utilizes cookies and local browser storage (localStorage) strictly for technical operation and performance optimization:

• Essential Technical Storage: Used to store dark mode theme preferences, navigation states, and security tokens.
• Performance Analytics: Google Analytics or Microsoft Clarity scripts may be loaded to evaluate site performance, viewport scaling, and page load speeds without profiling individual users across external websites.

You can manage or disable cookies through your web browser preferences panel. Please note that disabling essential storage may impact site theme rendering.

DoAvelon and the Glam&Cut application do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects users within the meaning of GDPR Article 22.

Barbershop search results and salon listings presented in Glam&Cut are displayed based on objective, user-selected parameters (such as geographic distance, service requested, operating hours, and average user rating) without opaque algorithmic profiling.

The DoAvelon website and Glam&Cut applications may contain links to third-party platforms, social media networks, or scheduling tools (such as Calendly).

DoAvelon is not responsible for the privacy practices, content, or security of third-party external websites. We encourage you to review the privacy statements of any external service you visit.

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in legal requirements, technical updates, or expansion of our software offerings (including new features in Glam&Cut).

Any updates will be published directly on this page with a revised "Last Updated" date. Continued use of our website or applications following posted updates constitutes acceptance of the revised policy terms.

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact the Data Controller directly:

Supervisory Authority Complaints (EU / Italy)

If you reside in the European Union or Italy and believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with your local supervisory authority.

In Italy, the supervisory authority is the Garante per la protezione dei dati personali:
• Address: Piazza Venezia n. 11 - 00187 Roma, Italy
• Website: https://www.garanteprivacy.it