V | NVanilla Nails
DE Book now
V | N
Legal

Privacy Policy

Last updated: 26 October 2026

Controller

General information

Protecting your personal data matters to us. We process data solely on the basis of applicable law (GDPR, Austrian DSG, TKG 2021). This notice describes what actually happens on the website vanillanails.at, in our “Vanilla Nails” app and when you call the studio.

Visiting the website

Visiting a page automatically produces technical connection data (e.g. IP address, time, the address requested), the kind any web server needs for secure delivery. We also anonymously count page views and a handful of clicks (e.g. "book an appointment") — with no name, no IP address and no identifier, so we cannot recognise you as an individual visitor. Purpose: operating, securing and improving the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest); no consent is required for the anonymous visit count, because no personal data results from it.

Appointment booking

If you request or book an appointment through the website, we process the details needed for that — in particular your name, phone number and preferred time — to fulfil the treatment contract. Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures).

If you book through the website, we record on the appointment the campaign details from the address (e.g. “utm_source”), the website that brought you to the booking page and the page you entered on. For this we only read the page address; without your consent nothing is stored in your browser, and the click identifier of an ad is left out. The details serve only our own evaluation of which advertising leads to appointments and are not passed on. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in cost-effective advertising). The details stay with the appointment for as long as we keep the appointment itself. You can object to this processing at any time (Art. 21 GDPR) — a message to hello@vanillanails.at is enough.

If you call the studio instead, the following also applies. Calling us

Parental consent

If a booked treatment requires the consent of a parent or guardian because the customer is a minor, we additionally record the name and phone number of that parent or guardian, solely to be able to prove this consent. We send an SMS with a confirmation link to that phone number, through which consent is given; for this we use our SMS provider Twilio. We store these details only with the individual appointment, not in your customer account. If you have your customer account deleted, we delete them along with it; otherwise they remain stored for as long as we keep the appointment itself for tax purposes. Legal basis: Art. 6(1)(b) and (f) GDPR (performance of the contract and legitimate interest in being able to prove consent).

Proof of sterilisation

Our tools come out of the steriliser in sealed pouches with a QR code. When we open a pouch for your appointment, we note this on the appointment. Anyone who scans the QR code of that pouch sees on our verification page steril.vanillanails.at when it was sterilised, when the pouch was opened and for whom — with your first name and the initial of your surname. If you use our app, you get a notification with a link to this proof when the pouch is opened. Purpose: you should be able to check that freshly sterilised tools were used for you. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a verifiable proof of hygiene). You can object to this (Art. 21 GDPR); a message to hello@vanillanails.at is enough.

Contact form

If you write to us through the form on the contact page, we process your name, your e-mail address and the text of your message in order to answer your enquiry. The message goes to our mailbox hello@vanillanails.at and from there into the inbox of our own app, where our team reads and answers it. Legal basis: Art. 6(1)(b) GDPR where the enquiry concerns an appointment or a treatment (pre-contractual measure), otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry). If a team member cannot read the language of a message, we have the text automatically translated in our inbox (Google Cloud Translation, processed in the EU); the same applies to SMS and WhatsApp messages and job applications.

To keep the form from being abused by machines, we count how many messages come from one IP address. That counter serves only to prevent abuse (Art. 6(1)(f) GDPR), not to recognise you, and it is deleted automatically after three days at the latest. For how long we keep your message, see "Retention period" below.

WhatsApp button

At the bottom right, in the menu and in the footer of every page you will find a WhatsApp button. It is a plain link (wa.me): as long as you do not tap it, nothing is sent to WhatsApp. If you tap it, WhatsApp opens with a prepared greeting; technical data such as your IP address then goes to WhatsApp Ireland Limited (Meta). WhatsApp's own privacy notice applies to your use of WhatsApp itself.

If you write to us, your message reaches the inbox of our own app through our provider Twilio, where our team reads and answers it. Legal basis: Art. 6(1)(b) GDPR where it concerns an appointment or a treatment, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry). We pass every voice message you send us through WhatsApp or SMS to Google (Vertex AI, processed in the EU) for transcription, so that our team can read it and have it translated if needed. For how long we keep it, see "Retention period" below.

Job applications

If you apply through the form on the jobs page, we process your name, your e-mail address, your phone number if you give it, and your text — solely in order to deal with your application. If you send us documents by e-mail later, the same applies to those. Legal basis: § 4(1) of the Austrian Data Protection Act together with Art. 6(1)(b) GDPR (pre-contractual measure).

Your application is sent as an e-mail to our mailbox hello@vanillanails.at and from there into the inbox of our own app. We do not file it anywhere else. If it does not lead to a job, we delete the application at the latest seven months after the rejection — that period follows from possible claims under the Equal Treatment Act. If you would like us to keep your documents for future openings, just tell us; if you would like them deleted sooner, a message to hello@vanillanails.at is enough.

Partnership enquiries

If you ask about a place with us through the form on the “Partnership” page, we process your name, your e-mail address, your phone number if you give it, your answers on place, trade licence and own clients, and your text — solely in order to answer your enquiry and prepare a possible partnership. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure). The enquiry takes the same route as an application: as an e-mail to hello@vanillanails.at and from there into the inbox of our app. If no partnership comes about, we delete it no later than seven months after our reply; a message to hello@vanillanails.at is enough to have it deleted sooner.

Course enquiries

If you ask about a course through the form on the course page, we process your name, your e-mail address, your phone number if you give it, your answers on prior knowledge and course language, and your text — solely in order to answer your enquiry and arrange the course. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure). The enquiry is sent as an e-mail to hello@vanillanails.at and from there into the inbox of our app. If no course comes about, we delete it no later than seven months after our reply; a message to hello@vanillanails.at is enough to have it deleted sooner.

Reviews and the map (Google)

Star ratings and opening hours are displayed from our public Google Business Profile; no data about you as a visitor is sent to Google for this. The map on the contact page only loads once you actively click it — only then is data (including your IP address) sent to Google. Legal basis for the map: Art. 6(1)(a) GDPR (your consent, given by clicking).

Analytics (Google Analytics 4, Microsoft Clarity)

On your first visit we ask whether we may analyse how the site is used. Only after your explicit yes do we load Google Analytics 4 (Google Ireland Limited) and Microsoft Clarity (Microsoft Ireland Operations Limited); before that, none of it is loaded and no cookie of these services is set. What is processed: a shortened IP address, device and browser, the pages you open and how long you stay, and — with Clarity — mouse movement, clicks and scrolling as a pseudonymised recording of how the page was used. The legal basis is your consent (Art. 6(1)(a) GDPR); this may involve a transfer to the USA, covered by the Standard Contractual Clauses and the EU-US Data Privacy Framework. You can withdraw your consent at any time, with effect for the future, via “Cookie settings” in the footer of every page.

Ad measurement (Google Ads)

We advertise with ads on Google. To learn whether an ad led to an appointment, we ask for your consent — in the notice on your first visit (“Ad measurement”) or, if you came through an ad and have not chosen anything there, with a separate, voluntary tick box when booking. You can book with or without consent.

With your consent we remember in your browser which ad or campaign you came through (the ad’s click identifier, campaign details, first page, referring website): the click identifier for at most 90 days, the other details for at most 30 days. If you book an appointment, we record these details on the appointment and may tell Google Ireland Limited that a booking took place — with the value of the appointment and your phone number in hashed form (SHA-256). This is not anonymous: Google matches this hash against its own data to determine whether the booking goes back to an ad; Google does not receive your phone number in plain text from us. If the appointment is attended, cancelled or missed, we may report that afterwards as well. For ad measurement itself we load no Google script in your browser. If you have also consented to analytics, Google Analytics loads and may set its own advertising cookies.

The legal basis is your consent (Art. 6(1)(a) GDPR). Google processes the hashed phone number and the appointment value as our processor (Google Ads Data Processing Terms); for evaluating the click identifier within Google Ads, Google is also responsible in its own right; a transfer to the USA is possible, covered by the Standard Contractual Clauses and the EU-US Data Privacy Framework. We delete the click identifier on the appointment no later than 100 days after booking. You can withdraw your consent at any time, with effect for the future, via “Cookie settings” in the footer of every page; the details remembered in your browser are deleted at the same time. If you consented with the tick box when booking, a message to hello@vanillanails.at is enough to withdraw it.

App

With our “Vanilla Nails” app for iPhone and Android you book and reschedule appointments, write to us, collect stamps and find your receipts. This section explains what happens to your data along the way. You download the app from Apple’s App Store or from Google Play; their own privacy terms apply to that. For our team members who use the app in the studio, the staff usage agreement applies in addition.

Signing in with your phone number

You sign in with your phone number. Google (Firebase Authentication, Google Ireland Limited) sends the confirmation code to that number by SMS and checks that the request comes from a real device. From then on, the number is the key to your account: we use it to reach you with booking confirmations, reminders and questions, and to match to your account the appointments you booked earlier through the website or by phone, as well as your messages by SMS or WhatsApp. Legal basis: Art. 6(1)(b) GDPR (use of the app and the treatment contract).

Your account

When you set up the app, we ask for your first and last name, your e-mail address, your birthday, how you would like to be addressed and the language we should use with you. We need your birthday to check whether a minor needs consent (see “Parental consent”); on your birthday we send you our wishes and a free stamp. Telling us how you found us and adding a profile photo are optional. Over time your account also holds: the stamps and rewards of your stamp card, credit, vouchers, amounts still owed (such as a cancellation fee) and your saved coffee preferences. Legal basis: Art. 6(1)(b) GDPR; for the optional details your consent (Art. 6(1)(a) GDPR), which you withdraw by removing them in your profile or by writing to us.

Your account can be seen in the studio by the owner and our team members. The app shows your phone number to the team only in shortened form; if someone displays it in full, this is recorded. We also record when someone in the team opens a customer profile, uses the customer search or exports a list — with the identifier of your account, without any content. This log serves only to protect your data from misuse (Art. 6(1)(f) GDPR) and is deleted after 90 days. We store which consents you have given or withdrawn in the app, with the time, so that we can prove them (Art. 7(1) GDPR).

Products we avoid for you

In the app you can tell us which products we should not use on you, such as HEMA, acrylic, latex or fragrances. Because such details can point to an allergy, we treat them as health data: we process them only with your explicit consent, which you give by entering them (Art. 9(2)(a) GDPR), and only to carry out your treatment safely. They are stored with your account, our team sees them at your appointment, and they are preselected when you book (for example “work HEMA-free”). Giving them is optional. You can change or delete them in your profile at any time, which withdraws your consent for the future.

Appointments

When you book, reschedule or cancel an appointment in the app, we store the treatment, team member, time and price, your answers in the booking flow (such as shape, length and colour), your note, any photos you attach (for example of your hands or a design you would like), your coffee order and every change to the appointment. Around the appointment we record whether you came, what was paid and, where we time it, how long the treatment took; we use that to plan the right amount of time for you next time. Legal basis: Art. 6(1)(b) GDPR (treatment contract).

How you move through the booking

When you open the booking in the app, we record how you move through it: which steps and answers you chose, which days and times you looked at, which price was shown, where you went back and whether you booked or gave up, each with a timestamp. We add the device model, screen and text size, platform and app version, so that we can replay the flow the way you saw it. We show new versions of the booking flow to some customers first; your account then notes which version you see. The recording is linked to your account and can only be viewed by us in the studio. It serves to find errors and confusing steps in the booking flow and, if questions come up, to look up how an appointment was booked. We delete it after 24 months. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a clear and error-free booking flow); you can object at any time (Art. 21 GDPR).

Device and notifications

So that we know whether a notification from the app reaches you or whether we had better send you an SMS, and so that we can help you with problems in the app, the app stores with your account which device you use (platform, operating system version, model, app version), when you last opened the app, and whether you have allowed notifications, calendar, camera and photos. For notifications we also store your device’s push identifier. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reaching you in a way that actually arrives and in helping you with problems).

If you allow notifications, we send you messages about your appointments (confirmation, change, cancellation, reminder the day before), about messages from us, about amounts owed and about your stamp card (Art. 6(1)(b) GDPR). We also wish you a happy birthday and, after a visit, occasionally ask you for a review on Google (Art. 6(1)(f) GDPR, legitimate interest in looking after our customer relationship; you can object). You only receive offers and news if you have ticked the box for them (Art. 6(1)(a) GDPR); you can untick it in your profile at any time. Notifications are delivered through Firebase Cloud Messaging (Google Ireland Limited) and, on the iPhone, through the Apple Push Notification Service. On the iPhone, a Live Activity also appears on the lock screen before an appointment, showing the treatment, time, team member and studio address; it is delivered through Apple as well. You can switch off notifications and Live Activities in your phone’s settings. If no notification reaches you, we may send reminders and receipts by SMS or WhatsApp through Twilio.

Messages

In the app’s chat you can write to us and send pictures. We reply there or by another route that reaches you: by WhatsApp or SMS (both through Twilio) or, if you have e-mailed us, by e-mail. All routes come together in one inbox on our side and are linked to your account, so our team sees the whole conversation. For automatic translation and the transcription of voice messages, see “Contact form” and “WhatsApp button” above. Legal basis: Art. 6(1)(b) GDPR where it concerns an appointment or a treatment, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry). Messages stay in the conversation so that we can look things up later; we delete them at your request, and in any case together with your account.

Photos of your nails (photo folder)

Our team photographs your nails before and after the treatment with the app, or uploads such photos later from the device’s gallery. Only hands and nails are photographed, never faces. Each photo belongs to your account and, where possible, to your appointment; we also store the time and the name of the team member who took it. Purpose: at your next appointment we can see what you had last time, and if you make a complaint we can show what your nails looked like after the treatment. The photos can be seen by the owner and by every team member with whom you had or have an appointment, or to whom the owner has given access to your photo folder. Team members cannot save or share the photos in the app. You do not see the photo folder in the app yourself; on request you receive information and a copy (Art. 15 GDPR). The photos are kept as long as your account exists and are deleted with it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in documenting the treatment and in proof in case of complaints). If you would rather not be photographed, tell us: we then note “No photos” on your account, and the app’s camera can no longer be used for you (objection under Art. 21 GDPR).

Publishing photos

We may show individual photos from the photo folder on our website and on social media such as Instagram to present our work. We only choose photos in which nobody can be recognised: hands and nails without a face, name, tattoo or distinctive jewellery, and without saying whose hands they are. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing our work). You can object to this at any time (Art. 21 GDPR): a word in the studio or a message to hello@vanillanails.at is enough. We note this on your account, publish no further photos of you and take down photos of you that are already published.

Payments and receipts

If you pay in the app, Stripe Payments Europe, Ltd. (Dublin) processes the payment. For this we send Stripe your name, e-mail address and phone number, the amount, the booked treatment and internal identifiers of your account and appointment. You enter your card or account details directly with Stripe; we never see them. If you pay with Apple Pay or Google Pay, Apple or Google is involved as well. Stripe processes this data as a controller in its own right; a transfer to the USA cannot be ruled out. In the studio you pay in cash or by card at the GP tom card terminal; the card details are processed by its provider, and we only receive the result and a transaction number.

We issue receipts under the Austrian cash register security regulation (RKSV) with our till Kasseneck (Kreiseck, Salzburg). The receipt shows the treatments, amounts and payment method, and for card payments the terminal’s details of the payment. You find the receipt in the app with your appointment; it is stored by Kasseneck and can be opened through a link that we give you in the app or by message. Legal basis: Art. 6(1)(b) GDPR, and for the receipt and its retention Art. 6(1)(c) GDPR (§§ 131b, 132a of the Austrian Federal Fiscal Code, BAO; retention for seven years under § 132 BAO).

Calendar on your phone

If you agree, the app adds your appointments to your phone’s calendar and removes them again if you cancel. This happens only on your device: the app does not read any other entries, and nothing from your calendar reaches us. If your phone syncs the calendar with an account, for example with Apple (iCloud) or Google, the entries end up there too; that depends on your phone’s settings. Legal basis: your consent (Art. 6(1)(a) GDPR); you can switch the sync off in the app at any time.

Error reports and usage analysis

If the app crashes or an error occurs, it sends an error report to Firebase Crashlytics (Google Ireland Limited): device model, operating system, app version, technical details of what led to the error and a random identifier of the installation. We do not add your name or phone number to it; if signing in fails, the report contains only the country code. The purpose is to find and fix errors. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an app that works).

Usage analysis with Google Analytics for Firebase (Google Ireland Limited) stays switched off until you agree to it during setup or later in your profile under “Nutzungsanalyse” (usage analysis). It then records which screens of the app you open, a few events (such as a booked or cancelled appointment with treatment, team member and price, a payment or a coffee order), device and operating system, an approximate location derived from the IP address and a random identifier of the installation. This is not anonymous but pseudonymous: we do not give Google your name or phone number, but the identifier can be linked to a device. The purpose is to improve the app. The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021), which you can withdraw in your profile at any time.

Protecting the app from misuse

So that only our unmodified app can access our servers, it has itself confirmed by Apple (App Attest) or Google (Play Integrity) when it starts; technical details of the device and the app go to Apple or Google in the process. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of our systems).

Where the data is stored

We store your account, appointments, messages and photos with Google Cloud/Firebase (Google Ireland Limited), our processor; our server functions run in Frankfurt. Sign-in, notifications, error reports and usage analysis are services Google runs worldwide. A transfer to the USA cannot be ruled out; it is covered by the EU-US Data Privacy Framework (adequacy decision of the European Commission) and the Standard Contractual Clauses.

How long we keep data

Deleting your account

You can delete your account at any time: in the app under “Mein Profil” (my profile), at the very bottom, with “Konto löschen” (delete account), or with a message to hello@vanillanails.at. We then delete your access to the app, your name, phone number, e-mail address, birthday, form of address and language, profile photo, the products we should avoid, how you found us, your consents with the time you gave them, the details of your device and the push identifiers, your saved coffee preferences, stamp card and vouchers, the photos you attached when booking, the notes on your appointments, your photo folder, the treatment times we noted for you, the recordings of your booking flows, your messages to us in our inbox together with our replies, pictures and attachments, and a shop account with its addresses and basket; any consent to offers counts as withdrawn. Appointments and receipts remain without your name and number, because we have to keep them for tax purposes; so do payments and any credit or outstanding amount. Whatever deleting in the app does not cover — e-mails that sit in the mailbox hello@vanillanails.at itself — we delete at your request; a message to hello@vanillanails.at is enough. Stripe keeps the data on your payments according to its own legal obligations.

Recipients

Depending on how you contact us, we share data with the following processors or providers:

Retention period

We keep personal data only for as long as needed for its purpose, or until you ask us to delete it — unless a statutory retention obligation says otherwise. Purely technical connection data is deleted automatically after a short time. What applies to the app is set out above in the “App” section under “How long we keep data”.

Your rights

Just get in touch at hello@vanillanails.at. You can also delete your app account yourself (see “Deleting your account” in the “App” section).

Right to complain

If you believe the processing of your data breaches data-protection law, you can lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna). dsb.gv.at