Privacy notice

1. Who we are

"Glänzen", "we", "us", or "our" refers to Glänzen Car Detailing, a sole proprietorship registered in Ghana under the Registration of Business Names Act, 1962 (Act 151) with registration number BN756360625, whose principal place of business is House No. 75, Central Street, Adjiringanor, Accra, Greater Accra. We are the data controller for the personal data described in this notice.

If you'd like to reach our Data Protection contact, write to privacy@glanzen.studio or call +233 59 770 6656.

2. What we collect

We collect only what we need to deliver the service you've booked and to run our business responsibly. In practice, that falls into these categories:

• Contact details — your full name, phone number, and email address (if you provide one).
• Vehicle details — make, model, plate number, year, colour, and any notes you add to your booking. Plate number is required because it identifies the vehicle on the work-order tag and on your invoice.
• Booking details — the service you chose, any add-ons, the branch, the date and time, and any pickup or delivery instructions.
• Inspection and work-order media — photos taken on intake (documenting the condition of the vehicle on arrival, including any damage), and photos taken during work and for quality control. These are stored with your vehicle's service record.
• Payment details — for cash bookings, no card data passes through us. For MoMo, the relevant reference numbers and amounts. For card payments (processed by a third-party provider), we never see or store full card numbers.
• Account data — if you have a customer account on app.glanzen.studio, your sign-in details, which are handled by Supabase Auth, and the bookings, vehicles, and history that account holds.
• Ratings — if you rate a finished visit in your customer account, the stars, tags and note you give are kept with that visit and can be seen by our staff at that branch and at head office.
• Technical data — when you visit our websites (glanzen.studio and app.glanzen.studio), our hosting provider keeps standard server logs: IP address, user-agent, the URL visited, and the timestamp. These logs help keep the sites secure and diagnose problems.
• Communications — when our WhatsApp number or phone line is connected to our system, the WhatsApp messages and voicemails you send us (for a voicemail, its transcript) are kept against your customer record so the next manager you speak with has context.

3. Why we collect it

We use your personal data for these purposes:

• To deliver the service you booked — identify your vehicle on intake, run the work, hand the car back to the right person.
• To communicate with you about a booking — confirm the appointment, propose alternate slots, tell you when the car is ready, send the invoice and receipt.
• To handle payment — and to settle any disputes about what was charged.
• To maintain a service history — so you (and our branch staff) can see what's been done to your vehicle, and so you don't have to re-explain anything on your next visit.
• To improve our service — patterns across bookings, such as our busiest times and the most-booked services. We never single you out.
• To meet our legal obligations — tax records, accounting records, anti-money-laundering checks (only if relevant).
• To protect our business and our customers — fraud prevention, security incident response, vehicle damage claims.

4. Lawful basis

Under Act 843 we must have a lawful basis to process your personal data. We rely on the following bases, depending on what we're doing:

• Contract — to deliver the service you booked, we have to process your contact and vehicle details. Without these, we can't honour the booking.
• Legal obligation — invoicing and tax records are kept for as long as the law requires (typically 6 years for tax purposes).
• Legitimate interest — security logging and fraud prevention. Where we rely on legitimate interest, we've considered your privacy and use the minimum data needed.
• Consent — for push notifications, which you switch on in your browser and can switch off at any time. We do not currently send marketing messages; if we start, we will ask for your consent first.

5. Who we share it with

We don't sell your data, ever. We share it only with the third parties we genuinely need to deliver the service.

Always used — every booking, and every visit to our sites, passes through these:

• Supabase (Supabase Inc.) — the database, file storage and authentication behind app.glanzen.studio, hosted in Ireland. Customer records, bookings, work orders, invoices, and photos are stored here, and your sign-in details are handled by Supabase Auth.
• Vercel (Vercel Inc.) — hosts the marketing site and the operational app in Ireland and Germany, and delivers pages through its global edge network. Server logs (IP, user-agent) pass through Vercel.
• Resend (Resend Inc., United States) — the email delivery provider that sends booking emails, invoices, receipts, and account emails such as invitations and password resets from notify@glanzen.studio. Resend sees your email address and the email body.

Used only when a feature is switched on — each of these receives data only while the feature that needs it is in use:

• Paystack — card and mobile money checkout. When you pay through it, Paystack receives your name, your email address and the amount, and takes your card or wallet details on its own page; we never see card numbers in full.
• Junipay — a second card and mobile money checkout. When a payment goes through it, Junipay receives your email address, your phone number and the amount.
• OpenRouter, and the AI model providers it routes requests to — for the staff assistant, for reading WhatsApp messages and voicemails sent to us, for drafting replies to them, for reading the notes staff post on the branch board, for reviewing quality-control photos of vehicles, for suggesting a decision on approvals staff raise, for the weekly and branch summaries and the staff pace summary on staff dashboards, and for explaining a dashboard figure when staff ask. They receive those messages, those notes, which may name customers, those photos, the records the assistant is asked about, an approval's details, which include the customer's name, the vehicle and the amounts, and, for the summaries and explanations, business figures and staff names.
• Meta's WhatsApp — carries messages to and from our WhatsApp number, so Meta receives your phone number and the messages.
• Twilio and OpenAI — when you leave a voicemail on our phone line, Twilio records it and keeps the recording, and OpenAI transcribes it. Twilio receives your phone number.
• Mapbox — suggests addresses as you type a pickup or delivery address, so it receives what you type and your IP address.
• Your browser's push notification service — if you switch on notifications, the service run by your browser's maker delivers them to your device.
• Google Maps, Apple Maps or Waze — when a driver or a branch opens a pickup or delivery address in a maps app, that address is sent to the app's provider.

And, only when needed:

• Professional advisors — our accountants and lawyers, only when needed and only for specific matters.
• Regulators — including the Ghana Revenue Authority for tax records and the Data Protection Commission if a lawful request is made.

6. Where your data lives

Our database and the photos we store are hosted by Supabase in Ireland, and the application runs on Vercel in Ireland and Germany, with pages delivered through Vercel's global edge network. Resend, which sends our email, is based in the United States. So are OpenRouter, Meta, Twilio, OpenAI and Mapbox, which receive data only when the features described in section 5 are switched on, and Google and Apple, whose maps apps a driver may open. OpenRouter may pass a request to an AI model provider in another country, and Paystack and your browser's push service may also process data outside Ghana. Personal data sent to these providers is handled under each provider's own data protection terms.

7. How long we keep it

We keep data only as long as we have a reason to. In practice:

• Active customer records — for as long as you remain a customer.
• Booking and work-order history — at least 6 years from the date of service, to meet tax and accounting obligations.
• Vehicle photos — kept with the vehicle's service record and are not deleted on a schedule. A branch can remove a photo taken by mistake, for example of the wrong car, or of belongings left inside.
• Server logs — kept for a limited period by our hosting provider.

You can ask us to delete your personal data (see section 8). We delete what we no longer have a reason to keep; records we must keep for tax and accounting are kept for that purpose and not used for anything else.

8. Your rights

Under Act 843 you have the right to:

• Access — ask us what personal data we hold on you, and get a copy.
• Correction — ask us to fix inaccurate data.
• Deletion — ask us to delete data we no longer have a lawful reason to keep.
• Object — to particular uses of your data, especially direct marketing.
• Restrict processing — ask us to pause using your data in specific ways while a complaint is being resolved.
• Portability — get your data in a machine-readable format so you can take it elsewhere.
• Withdraw consent — for any processing we do on the basis of consent.

To exercise any of these, email privacy@glanzen.studio from the email address on your account, or call us and we can verify your identity on the phone. We respond within 14 working days; complex requests may take up to 30 days, in which case we'll tell you.

9. Cookies and similar technologies

The marketing site (glanzen.studio) sets these cookies:

• mk-theme — remembers whether you've chosen the light or dark theme. Functional, no tracking. Lives in your browser's local storage, not as a cookie technically; deleting your browser data clears it.

The operational app (app.glanzen.studio) sets the following:

• sb-* cookies — Supabase's authentication session cookies that keep you signed in after logging on. Strictly necessary. They expire when you sign out or when the session times out.
• active_branch_id — set only for owner and head-office staff accounts, to remember which branch they are viewing. It expires after 30 days.
• Local storage — a few display preferences, such as whether you dismissed the install prompt, are kept in your browser. On owner and head-office staff accounts, the admin assistant also keeps your recent conversation with it in the browser, up to the last 30 messages, which may name customers; clearing the chat removes it. Functional, no tracking.

We don't run advertising pixels, third-party trackers, or cross-site cookies. We don't fingerprint browsers.

10. Photos and inspection imagery

Every vehicle is photographed on intake and during work. These photos serve three purposes:

• Pre-existing damage record (protects both us and you in case of a dispute).
• Quality control — supervisors review them before sign-off.
• Service history — the photos we share with you, such as your car's condition on arrival, appear on your account.

We never use these photos for marketing, social media, or advertising without your explicit, written permission. If we ask permission to use one (e.g. for a before/after feature on our blog), you can decline without affecting your service in any way.

11. Marketing and communications

We send these kinds of messages:

• Transactional (booking emails, invoices, receipts, and account emails such as invitations and password resets) — sent by email, because they are part of the service.
• Push notifications — only if you switch them on in your browser; you can switch them off at any time.
• Promotions and newsletters — we do not currently send any. If we start, we will ask for your consent first.

If we ever send promotional messages, each one will include a way to unsubscribe.

12. Security

We take reasonable steps to keep your data safe: encryption in transit (HTTPS), encryption at rest by our database provider, and role-based access, so staff reach only the records their role needs.

No system is perfectly safe. If something does go wrong, we'll notify you and the Data Protection Commission within 72 hours of becoming aware of a breach that affects your personal data.

13. Children

We don't knowingly collect data from children under 18. Our services are bought by adults, and our website is designed for adults. If you believe a child has provided us data without parental consent, email us and we'll delete it.

14. Complaints

If you're unhappy with how we've handled your personal data, please email privacy@glanzen.studio first — we want to fix it. If you remain unsatisfied, you have the right to lodge a complaint with Ghana's Data Protection Commission:

15. Changes to this notice

We update this notice from time to time. The "Effective" date at the top tells you when the current version started applying. If we make a material change (one that affects what we collect or how we use it), we'll email everyone with an active account at least 30 days before the new version takes effect.

16. Contact

For any privacy question, request, or concern:

See also: Terms of service.