Privacy Policy

Last updated: 2 August 2026

        Studio Serena takes your privacy seriously. This policy explains clearly what data we collect, why, and what your rights are - in plain language.
    

1. Who we are

Studio Serena Hair
Torshovgata 5H, 0476 Oslo, Norway
Email: info@studioserena.no
Instagram: @studioserena.hair

We are the data controller for the personal data described in this policy.

2. What data we collect and why

Our website collects very little data. Here is exactly what happens:

2a. Data you give us voluntarily

Your name (Black Card feature) - If you type your name into the loyalty card on our website, it is saved in your browser's local storage only. It never leaves your device and is never sent to us or any third party. You can clear it at any time by clearing your browser data.

2b. Data from third-party services

Our website uses the following third-party services that may process your data:

Google Maps - We embed a Google Map to show our studio location. When you interact with the map, Google may collect your IP address and set cookies. This only happens if you have given consent via our cookie banner.
Legal basis: Consent (GDPR Art. 6(1)(a))
Google Privacy Policy →
Google Fonts - We load fonts from Google's servers. This means your IP address is sent to Google when the page loads.
Legal basis: Legitimate interest
Google Privacy Policy →
Cloudflare (Font Awesome) - We load icons from Cloudflare's CDN. Your IP address may be logged by Cloudflare.
Legal basis: Legitimate interest
Cloudflare Privacy Policy →
Vercel - Our website is hosted on Vercel. Vercel may log standard server access logs including your IP address.
Vercel Privacy Policy →
Supabase - When you book an appointment or look up/cancel a booking through our website, the details you provide (name, email, phone, appointment date/time/service/stylist) are stored in our database, hosted by Supabase. This data is used solely to manage your appointment.
Legal basis: Contract performance (GDPR Art. 6(1)(b))
Supabase Privacy Policy →
Resend - We send booking confirmations, reminders and cancellation notices by email. Your name, email address and appointment details are passed to Resend in order to deliver that email.
Legal basis: Contract performance (GDPR Art. 6(1)(b))
Resend Privacy Policy →
Sveve - Where you have asked for text-message confirmations and reminders, your phone number, your name and the time of your appointment are passed to Sveve AS, a Norwegian SMS provider, in order to send that message. Sveve processes this data in Norway.
Legal basis: Contract performance (GDPR Art. 6(1)(b)), and consent for any message that is not about an appointment you have made
Sveve Privacy Policy →

2c. Who processes your data on our behalf

Studio Serena decides what happens to your personal data (we are the controller). The companies below handle it only on our instructions, under a written data processing agreement, and may not use it for their own purposes (they are our processors). This is the register we are required to keep under GDPR Art. 30.

Processor	What it does for us	What it holds	Where
Supabase	Stores our bookings database	Name, email, phone, appointment history, any note the salon adds	EU (Frankfurt)
Vercel	Hosts and serves the website	Server access logs, including IP address	EU / USA (SCCs)
Resend	Sends booking emails	Name, email address, appointment details	EU / USA (SCCs)
Sveve AS	Sends booking text messages	Name, phone number, appointment time	Norway
Google, Cloudflare	Map, fonts and icons on the website	IP address only. They are never given booking details.	EU / USA (SCCs)

We do not sell your data, and we do not share it for advertising. Nobody outside the list above receives it, unless we are required by Norwegian law to hand it over.

3. Cookies and local storage

We use the following browser storage:

ss_cookie_consent - localStorage - stores your cookie preference (accepted/declined).
bcName - localStorage - stores the name you typed into the Black Card. Local to your device only.
ssVisitCount - localStorage - stores your visit count for the loyalty card tier. Local to your device only.
langBannerDismissed - sessionStorage - remembers that you dismissed the language suggestion banner. Cleared when you close the browser tab.

We do not use advertising cookies. We do not use Google Analytics or any tracking pixels.

You can withdraw your cookie consent at any time by clicking "Manage Cookies" in the footer of our website. This will clear your stored preference and show the consent banner again so you can make a fresh choice. You may also clear all stored data at any time through your browser settings.

4. Booking an appointment

When you book an appointment on our website, we store your name, email address, phone number, and the details of your appointment (service, stylist, date and time) in our database, hosted by Supabase. We use this information only to manage your appointment - to confirm it, to let you look it up, and to let you cancel it.

We keep booking records for our own scheduling and business record-keeping purposes. If you would like your booking data deleted, contact us at info@studioserena.no.

        How "My Appointments" works: To keep booking simple, we don't require you to create a password-protected account. Instead, you look up your own appointments by entering the same email or phone number you used when booking. This means anyone who knows that email or phone number could look up or cancel that booking - the same level of access as messaging us directly on Instagram to make a change. We consider this an acceptable trade-off for a small local salon's booking data, but wanted to be upfront about it.
    

You can still reach us directly on Instagram (@studioserena.hair) if you'd prefer - in that case, your message and contact information is handled by Instagram/Meta. See Instagram's Privacy Policy for how Meta handles that data.

5. Your rights under GDPR

As a person in the EU/EEA, you have the following rights:

Right of access - You can ask what data we hold about you.
Right to erasure - You can ask us to delete your data.
Right to rectification - You can ask us to correct inaccurate data.
Right to object - You can object to processing based on legitimate interests.
Right to withdraw consent - You can withdraw cookie consent at any time by clearing your browser's local storage or clicking "Decline" on the cookie banner.
Right to lodge a complaint - You can complain to Datatilsynet (Norway's data protection authority).

To exercise your rights, contact us at: info@studioserena.no

6. Data transfers outside the EEA

Your booking details are stored in the EU. Google (Maps and Fonts), Cloudflare, Vercel and Resend may transfer data outside the EEA; those transfers are covered by Standard Contractual Clauses (SCCs). Sveve processes text messages in Norway. See section 2c for what each one holds, and their privacy policies for details.

7. Children's privacy

Our website is not directed at children under 16. We do not knowingly collect data from children.

8. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will always reflect the most recent version.

9. Contact

For any privacy-related questions, please contact:
Studio Serena
info@studioserena.no
Torshovgata 5H, 0476 Oslo