Privacy notice

Who controls your data

FELTShine is the controller for account, platform-administration and service-operation data described in this notice. A detailer may also be an independent controller for the customer information they use to provide their detailing service.

Data we collect

• Account details, including name, business name, email address and authentication data.
• Business profile information, service catalogue, prices, availability, operating areas and uploaded business media.
• Booking information, including customer contact details, vehicle details, selected services, appointment information, mobile-service address and booking history.
• Payment and refund references, amounts, status and connected Stripe account context. We do not receive or store full card numbers.
• Support notes, audit records, notification-delivery records and security or diagnostic information needed to operate and protect the service.

Why we use personal data

• To create accounts, provide the subscription service and perform contracts with detailers.
• To create, confirm, manage, reschedule and cancel customer bookings and to support refunds requested under the applicable booking policy.
• To send essential account, booking, reminder, cancellation and refund communications.
• To meet legal, accounting, tax, fraud-prevention and regulatory obligations where they apply.
• To pursue legitimate interests in securing, supporting, auditing and improving the service, provided those interests do not override individual rights.
• Where we specifically ask for consent, for the purpose stated at that time.

Who receives the data

We share data only where needed to provide, secure or support the service. Current service providers include Supabase for authentication, database, storage and server functions; Stripe for subscriptions, connected accounts, customer payments and refunds; Resend for transactional email; Lovable and its hosting infrastructure for the web application; and GitHub for encrypted backup artifacts and source delivery. A customer's selected detailer receives the booking information needed to perform the service.

These providers process data under their own terms and data-protection arrangements. Some may process data outside the European Economic Area. Where a restricted international transfer occurs, an approved safeguard such as an adequacy decision or standard contractual clauses must apply, as required by law.

Payments

Stripe hosts payment and connected-account pages. Customer booking payments go directly to the detailer's connected Stripe account. FELTShine receives payment identifiers, amounts and status so it can confirm bookings and refunds, but it does not receive full card details.

Retention

We keep personal data only for as long as it is needed for the purpose collected and for any applicable legal, accounting, dispute or security period. Account and business data is normally retained while the account is active. Booking, payment, refund and audit records may be retained after completion where needed to establish transactions, respond to disputes or meet legal obligations. Encrypted GitHub backup artifacts are retained for 30 days. Provider logs and delivery records follow the relevant service settings and are reviewed as part of the production retention schedule.

Your rights

Depending on the circumstances, you may ask for access, correction, erasure, restriction or portability of your personal data, or object to certain processing. Where processing is based on consent, you may withdraw that consent without affecting earlier lawful processing. Contact adim@feltshine.com to make a request. We may need to verify your identity.

You may also complain to the Irish Data Protection Commission. See the Commission's official website.

Security and account choices

We use access controls, tenant separation, audit records, encrypted transport and encrypted backups to protect the service. No internet service can guarantee absolute security. Use a unique password, protect your provider accounts and contact us promptly if you suspect unauthorized access.

Cookies and local storage

The current service uses authentication storage and short-lived browser storage needed to sign users in, protect sessions and safely resume an unfinished booking checkout. The current release does not use advertising cookies. If non-essential analytics or marketing technologies are introduced, this notice and any required consent controls will be updated first.

Changes to this notice

We will update the version date when this notice changes. Material changes will be communicated through the service or by email where appropriate.