Privacy Policy

Last updated: 2026-10-20

1. Who we are

Kseniia Vasileva (trading as Kseniia Brow Art) operates the websites at kseniia.co.uk, kseniia.academy and kseniia.business, the client portal at my.kseniia.co.uk, the studio portal at portal.kseniia.co.uk, and the Kseniia app for iPhone and Android. This policy explains what personal data we collect, why we collect it, and what rights you have over it.

Contact: support@kseniia.co.uk

Address: 12 Station Road, Gerrards Cross SL9 8EL, United Kingdom

2. What we collect

• Booking details - the dates, services, prices, and notes associated with appointments you book with us, handled by our online booking system.
• Customer record - your name, email address, phone number, and any intake-form answers you submit to us.
• Enquiries and leads - when you contact us through a form, the website chat, a message on WhatsApp, SMS, Instagram, Facebook Messenger, Telegram or by phone, or when you reply to one of our messages, we keep your name, the contact details you used, what you asked about, the messages exchanged and, for a phone call we missed, the voicemail you left and a written transcript of it. We keep this as an enquiry record before you book, so we can answer you and follow up.
• Consent per channel - which channels you have agreed to hear from us on (email, SMS, WhatsApp), the wording you agreed to and when; and when you ask us to stop.
• Sign-in details (portal and app users) - the email address you use to sign in (via a magic link on the web, a six-digit code in the app, or Google on the web and on Android), and the basic profile information Google returns when you choose that sign-in method.
• Operational logs - basic technical records (sign-in timestamps, system events) so we can keep our services secure and reliable.
• Website access logs - when you visit kseniia.co.uk, our server records the request: your IP address, the page you asked for, the date and time, the page that referred you, and your browser type. This is recorded for every visit. It does not rely on cookies, and we keep it to protect the security and availability of the site.

3. Why we collect it

• To let you sign in and see your own bookings, photos, and notes.
• To deliver the treatments you have booked and the aftercare that goes with them.
• To contact you about your appointments (confirmations, reminders, aftercare).
• To answer your enquiry and follow it up: a reply when you message us, a reminder of a consultation you asked about, and, if you agreed to hear from us, an occasional message about treatments, availability or courses. Automatic messages run under published limits: at most one automatic message a day and three a week to any one person, none between 8 pm and 9 am or on Sundays, and every one of them records the rule that allowed it. A reply of STOP, or "unsubscribe", on any channel stops them on every channel.
• To text you back when we miss your call, with one message, so you know we have seen it.
• To keep records we are required to keep for accounting and tax purposes.
• To keep the website secure and available - access logs let us investigate abuse, errors and attacks.

4. Where your data is stored

• Our online booking system - holds the live appointment data that the portal mirrors.
• Our portal database, hosted in the United Kingdom - holds customers, enquiries and leads, appointments, messages across every channel, consent records and files.
• The carriers of our text messages and phone calls - see your number and the message text in transit, and a voicemail recording until we have stored it. Some of them are based in the United States under standard contractual safeguards.
• The messaging platforms you contact us on (WhatsApp, Instagram, Facebook Messenger, Telegram) - carry your messages under their own terms with you; what they hold is governed by those terms.
• A transcription service - turns a voicemail into text for us; the audio is deleted once the transcript is stored.
• A form-delivery service - receives the website forms as a fallback when our own system is unavailable and forwards them to us by email.
• Our transactional email service, hosted in the United Kingdom - sends emails such as magic-link sign-ins and appointment confirmations.
• Google Workspace - if you sign in with Google, your authentication is handled by Google and we only receive your email and basic profile.
• Microsoft Clarity - if you accept analytics, it records how pages are used on kseniia.co.uk (see section 8). Microsoft processes this outside the UK.
• Our hosting - a private UK-based server. No data is copied outside the UK or EU under normal operation.

5. Who we share it with

We do not sell your data. We share it only with the service providers described above - our booking system, our database host, our email and analytics providers, the carriers of our calls and messages, the messaging platforms, a transcription service and a form-delivery service - each under a contract that limits them to acting for us, and only what is necessary for them to do their job. We never share your data with third parties for marketing without your explicit consent.

We do not share your enquiry or messages with anyone else, and we never pass your details to another business for marketing.

6. How long we keep it

We keep your account data for as long as you are a customer. If you ask us to delete your account, we will remove your personal data within 30 days, except for records we are legally required to keep (for example, invoices for tax purposes - 7 years per HMRC rules).

An enquiry that does not become a booking is kept for 12 months from your last message, then deleted, unless you have agreed to hear from us, in which case we keep your contact details and consent record until you withdraw it. Message histories on a customer’s record are kept with the record. Voicemail recordings are deleted once transcribed; the transcript stays with the enquiry.

Website access logs, which include IP addresses, are kept for 90 days and then deleted automatically. Anonymous aggregated statistics derived from them - such as which pages are popular, or which country visitors came from - contain no personal data and may be kept indefinitely.

7. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate personal data.
• Erase your personal data (subject to the retention exceptions above).
• Restrict or object to how we use your data.
• Port your data to another service in a machine-readable format.
• Complain to the UK Information Commissioner’s Office at ico.org.uk if you are not satisfied with how we handle your data.

To exercise any of these rights, email support@kseniia.co.uk.

You can stop our messages on any channel by replying STOP or "unsubscribe" to any message; that stops automatic messages on every channel at once. To object to processing, or for anything else, email support@kseniia.co.uk.

8. Cookies, tracking, session recording and similar storage

The portal uses only the cookies strictly necessary to keep you signed in. The kseniia.co.uk website uses cookies required for site operation, and - only if you accept them - Google Analytics cookies that help us understand how the site is used. No analytics cookies are set unless you choose Accept on the banner, and you can withdraw that at any time by clearing your cookies for this site. We do not use advertising cookies.

The website chat sets no cookie. It keeps your conversation together while you are on the site in your browser’s session storage, which is cleared when you close the tab; it holds no personal data and is not used for analytics.

Session recording. If you accept analytics, we also use Microsoft Clarity to record how pages are used - mouse movement, clicks, taps and scrolling - so we can see where the site is confusing and fix it. This produces a replay of the page as you used it, and heatmaps showing where people click and how far they scroll.

• All text on the page is masked before it leaves your browser, including anything you type into a form. We see the shape of the page and how you moved through it, not its words.
• Nothing is recorded until you choose Accept on the banner. If you decline, or simply do not answer, no recording takes place and no Clarity script is loaded at all.
• We do not use it to identify you, and we do not combine it with your booking or account records.
• Microsoft acts as our processor for this and may process the data outside the UK. You can withdraw consent at any time by clearing your cookies for this site.

9. The Kseniia app (iPhone and Android)

Our app is for existing clients of the studio and does the same things as the client portal at my.kseniia.co.uk: it shows your visits, your treatment photos, your messages with the studio and the forms before a treatment, and lets you keep your contact details current. There is no sign-up in the app: the studio creates your account by invitation. You sign in with your email address and a six-digit code we email you; the app keeps your signed-in session on your device only, so you do not need a code every time.

The app uses your camera or photo library only when you choose to send a healing photo to the studio; the photo goes to your client record and the app keeps no copy on your device. Your treatment photos are shown through links that expire after a few minutes and are never saved to your device by the app.

The app contains no analytics, no session recording and no crash reporting. Apple and Google may show us anonymous crash and usage statistics that they collect under their own terms if you have opted in on your device.

Booking and rescheduling open our booking page in your browser. Requests about your data (a copy, a correction, deletion) start in the app and reach the studio by email; we complete a deletion within 30 days, except for the records we must keep as described in section 6.

10. Changes to this policy

If we change this policy in a way that materially affects your data, we will update the date above and notify you by email before the change takes effect.

11. Contact us

Questions about this policy, your data, or any of your rights? Email support@kseniia.co.uk.