Privacy Policy

Smile Map is operated as a joint venture between The Gemist Hub (ABN 60 546 912 543) and Vero Scale (ABN 95 987 726 537) (together "we", "us", "our"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Service. We are committed to protecting your privacy in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

1. Information We Collect

We collect the information you give us and the information generated as you use the Service:

• Account information: your name, email address, and authentication details.
• Profile & portfolio information: your business name, bio, Instagram handle, and the designs, images, and portfolio content you create or upload.
• Client records you enter: the client names, contacts, notes, service history, and photographs you choose to store, together with the photo-consent status you record for them.
• Onboarding information: the questionnaire answers you provide when you first set up your account (see section 5).
• Usage and diagnostic information: privacy-safe interaction, reliability, error, and product-analytics metadata about how the Service operates and is used (see section 3).

2. How We Use Your Information

We use your information to provide, operate, secure, and improve the Service; to authenticate you; to process your subscription; to communicate with you about your account; and, where you have opted in, for the optional communications described in section 6. We do not sell your personal information.

3. Analytics, Diagnostics & Cookies

We use first-party, cookieless portfolio analytics to give artists aggregate information about their public portfolio pages, such as page views, approximate visit duration, public sets or designs viewed, and clicks on public links. These portfolio analytics do not store raw IP addresses, raw user agents, cookies, persistent visitor IDs, or freeform URLs. We also use Google Analytics 4 to measure aggregate site usage. Google Analytics 4 may set first-party analytics cookies, while ad-related storage and personalisation remain disabled.

Structured diagnostics. We collect privacy-safe interaction and reliability metadata so we can understand which features are used, verify whether an action succeeded, and diagnose failures, retries, interruptions, and recoveries. This may include a normalised route name, semantic control or operation name, lifecycle outcome, timing and count buckets, app release, short-lived opaque session, tab, interaction, and attempt identifiers, and coarse device, input, connection, and visibility information.

Content excluded. Our structured diagnostic event contract prohibits client or customer names and contact details, health or service notes, design content or geometry, images, free text, raw URLs or query strings, keystrokes, credentials, and other customer-authored content. A bounded pending queue may be stored in your browser until events are received by our first-party backend.

PostHog. We send derived, allowlisted product-analytics events to PostHog to understand product use and reliability. PostHog may use cookies on public web surfaces, but the active Studio configuration is memory-only and does not use persistent analytics cookies.

Sentry. We use Sentry for scrubbed error reports and sampled performance traces so we can diagnose technical failures and reliability problems.

No recording. The active Studio does not use session replay, screen recording, keystroke capture, or broad DOM autocapture. We do not use analytics or diagnostics for advertising, and we do not sell this data. You can disable non-essential cookies through your browser settings.

4. Service Providers & Disclosure

We share data only with providers that process it on our behalf to operate the platform, under agreements that limit their use of it:

• Convex: database, file storage, backend infrastructure, and first-party diagnostic retention.
• Clerk: account authentication.
• Stripe: payment processing for subscriptions, on behalf of The Gemist Hub.
• Google Analytics 4: aggregate site analytics; PostHog: derived product analytics; Sentry: error monitoring and sampled performance traces.

These providers may process or store information outside Australia, including in the United States and other locations where they operate. We take reasonable steps to use providers with appropriate privacy and security safeguards. We do not sell your personal information. We may disclose information where required by law or to protect our legal rights.

5. Onboarding Information

When you first set up your account we ask you a short set of questions to understand our artists and improve the Service. This may include your business Instagram handle, your experience level, how you currently create designs, any other beauty services you offer, and how you heard about us. Providing these answers is part of setting up your account.

Optional outreach opt-in. At onboarding you may separately choose to let The Gemist Hub contact you, for example via Instagram or within Smile Map, about the artist community and opportunities. Because The Gemist Hub and Vero Scale jointly operate Smile Map, this is a first-party contact, not disclosure to a third party. This opt-in is off by default and you can withdraw it at any time.

Optional featured-content opt-in. You may also separately opt in to have designs you publish featured in public discovery or showcase surfaces we may introduce in future. We will not feature your content publicly on this basis unless you have given this specific consent. This opt-in is off by default and you can withdraw it at any time.

6. Optional Communications

The opt-ins described in section 5 are unbundled from your acceptance of this policy and the Terms. You can use the Service fully without them. Where you have opted in, we (including The Gemist Hub) may contact you as described, and you can withdraw consent at any time by contacting us or updating your preferences.

7. Data Retention

We keep your information for as long as your account is active and as needed to provide the Service. When you delete content or your account, we remove it from the live Service, though copies may persist in routine encrypted backups for a limited period before they are overwritten. We may retain some information where the law requires it.

Detailed first-party diagnostics. Detailed structured interaction and reliability records held in Convex are automatically deleted after 14 days.

Derived PostHog analytics. Our retention target for derived product-analytics events in PostHog is 90 days. We are verifying the provider-side project settings against that target, so this is a target rather than a claim that the setting is already enforced.

Sentry diagnostics. Scrubbed error reports and sampled performance traces are retained according to the configured Sentry project settings and only for as long as reasonably needed for security, reliability, and troubleshooting.

Deletion requests. To request deletion of your account or related diagnostic and analytics data, contact legal@smilemap.io or support@smilemap.io. We will action the request across our systems and relevant providers, subject to any information we must retain by law or for security and fraud prevention.

8. Data Security

We take reasonable technical and organisational measures to protect your information against loss, misuse, and unauthorised access. No method of transmission or storage is completely secure, but we work to protect your data and to limit access to it.

9. Your Rights

Under the Australian Privacy Principles you may request access to the personal information we hold about you and ask us to correct it. You may also withdraw any optional consent you have given. To make a request, contact us at legal@smilemap.io.

10. Children’s Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the effective date and, where appropriate, notify you.

12. Contact Us

For privacy-related enquiries, contact us at legal@smilemap.io. Smile Map: a joint venture of The Gemist Hub (ABN 60 546 912 543) and Vero Scale (ABN 95 987 726 537) · New South Wales, Australia.

Terms of Service