Your privacy.
What we collect, why we need it, and what we do with it — in plain English.
The short version
We collect what we need to give you a treatment safely and to run the studio — your contact details, a health questionnaire, and photos of the area being treated. We don't sell anything to anyone, we don't advertise to you, and there's no tracking on this website.
Who we are
Cosmegtic is a semi-permanent makeup studio and training academy in Gravesend, Kent. For data protection purposes we are the "controller" — we decide what information is collected and why.
Contact us about anything on this page: cosmegtic@outlook.com.
Cosmegtic, 128e Milton Road, Gravesend, Kent DA12 2PG.
What we collect, and why
If you send an enquiry
Your name, email address, which treatment you're interested in, and your message. We use it to reply to you, and nothing else.
If you book a treatment
This is the bulk of it, and some of it is sensitive:
| What | Why |
|---|---|
| Name, email, phone | To confirm your appointment and reach you about it |
| Date of birth | To confirm you're over 18 — we can't treat under-18s |
| Health questionnaire | Pregnancy or breastfeeding, skin conditions, blood-thinning medication, recent fillers, allergies to pigments, numbing agents or latex. We need this to know whether it's safe to treat you. |
| Photos of the area | So Megan can plan your treatment before you arrive, and to compare before and after |
| Your notes | Anything else you tell us about what you're after |
| Booking and payment record | What you booked, when, and what you paid |
Your card details never reach us. Payments go through Stripe, who handle the card entirely on their own systems. We only ever see that a payment succeeded and for how much.
Health information — the sensitive bit
The health questionnaire is what the law calls "special category" data. We only collect it because we can't perform these treatments safely without it, and we rely on your explicit consent, given when you complete the booking form. You can withdraw that consent at any time — though it does mean we can't go ahead with a treatment.
If you're an academy student
Your name, business name, course, email address and profile photo, plus anything you post in the student portal. If you submit a case study, that includes photographs of your own clients — you confirm at the point of upload that you have their written consent, and we keep a record of that confirmation.
If you hire studio space
Your name, business name, phone, email, your bookings and any account credit. Same payment arrangement as above — Stripe handles the card.
Why we're allowed to hold it
- To perform our contract with you — taking and fulfilling a booking, running your student or renter account.
- Your explicit consent — the health questionnaire, and photographs.
- Our legitimate interests — keeping records of what was done, so we can treat you safely next time and deal with any problem.
- Legal obligation — keeping financial records for as long as HMRC requires.
Who else sees it
Megan is the only person who sees your records. Nobody else in the studio has access to your health questionnaire, your photos or your notes.
Beyond that, only the companies that run the machinery behind the site. They process it on our instructions and can't use it for their own purposes.
| Who | What for |
|---|---|
| Google (Firebase) | Database, file storage, sign-in |
| Stripe | Card payments |
| Resend | Sending your confirmation and care emails |
| Netlify | Hosting the website |
We never sell your information, and we don't share it for advertising.
Some of these providers process data outside the UK. Where they do, the transfer is covered by the standard safeguards those providers have in place (UK addendum to the EU standard contractual clauses, or an adequacy decision).
How long we keep it
| What | Kept for |
|---|---|
| Enquiries with no booking | 12 months |
| Treatment records & health questionnaire | 7 years after your last treatment |
| Client photos | 7 years, with the treatment record they belong to |
| Student case studies & their client photos | 1 year after the course ends |
| Payment records | 6 years, as HMRC requires |
When the time is up we delete it, or anonymise it so it's no longer about you.
Your rights
You can ask us to:
- show you what we hold about you
- correct anything that's wrong
- delete it
- stop using it, or limit how we use it
- send it to you or someone else in a portable format
- withdraw a consent you gave us — including for photos
Ask us and we'll do it, normally within a month, and it's free.
If you're not happy with how we've handled it you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd rather you told us first so we can put it right.
Children
We don't treat anyone under 18 and this site isn't aimed at children.
Cookies
There's almost nothing to report, which is unusual enough to be worth reading — see our cookie page.
Last updated 28 September 2026. If we change how we handle your information we'll update this page and, where the change matters, tell you directly.