This Policy explains what personal data is processed by the automated assistant (chat-bot) of Snigyr Lashes Studio on Instagram Direct and Facebook Messenger, for what purpose, who it is shared with, and how long it is kept.
Data owner / controller:
Individual entrepreneur Adelina Serhiyivna Snigyr (Ukrainian: ФОП СНІГИР АДЕЛІНА СЕРГІЇВНА), trading as Snigyr Lashes Studio, Uzhhorod, Ukraine.
Contact for questions and data requests: snihyr.d@gmail.com
1. What data we collect
We collect only what is needed to consult you and book an appointment:
A technical identifier of your account (Instagram-scoped user ID) — a service number that the Meta platform assigns to your account within our app. It is used as the key of your conversation. We do not receive your @username, profile name or photo.
The text of your messages to the bot and the type of attachments (for example, "sent a Reel", "sent a photo"). The bot does not store the media file itself, only the fact and type. Technical service logs may temporarily contain the platform-provided preview or link to an attachment.
Your name and phone number — only if you provide them yourself to make a booking.
The chosen service, preferred date and time of the appointment, and any effect preferences you mention.
A referral tag — if you came to Direct from one of our ads: the ad identifier (ad_id), the campaign name and an internal segment. Used to measure ad performance.
Technical conversation flags: whether a human administrator is handling the chat, the time of the last action, and internal markers (for example, whether an add-on service has already been offered).
2. Purpose and legal basis
The purpose is to give you a consultation, help choose a service, agree on a time, create a booking in the studio's system, and notify an administrator when a human is needed.
The legal basis is Ukraine's Law "On Personal Data Protection": your consent (you contact the bot yourself) and the need to take steps to provide the service you requested.
3. Who the data is shared with
Some data is processed by third-party services so the bot can work:
Meta Platforms Inc. (Instagram, Facebook Messenger) — the platform you write on. All messages pass through Meta's servers; the bot sends replies via the Meta Graph API.
Google LLC (Gemini API) — the text of your message and a few recent turns of the conversation are sent in order to (a) generate a reply and (b) determine the topic of your message (booking, general question, off-topic, spam). Processed on Google's servers.
Altegio (booking CRM) — when a booking is created, your name, phone number, chosen service, date and time are sent, together with a service comment on the record (an "Instagram bot booking" marker and, where applicable, the referral tag and any agreed add-ons).
Telegram — the studio's administrators receive service notifications: about a new booking (containing name, phone, service, time), and about the need for a human to step in or an off-topic message (which may contain the text of your last message).
4. Where the data is stored and for how long
The studio's server (VPS) — physically located in the Netherlands (Amsterdam area). It stores: a window of the last 10–12 conversation messages, technical flags, and service data about the most recent booking (record number, service, time — without name or phone in this store). Your name and phone may temporarily appear in the text of stored messages until those messages fall out of the recent-messages window.
Execution service logs on the same server — kept for about 14 days, then deleted automatically. They may temporarily contain the full text of messages and the name and phone you gave when booking.
The "a human is handling this chat" flag is cleared automatically after 6 hours.
The "came from an ad" tag is valid for 48 hours from the click, after which it is treated as stale.
Altegio cloud — your booking data is kept for as long as you are a client of the studio and as long as record-keeping for services actually rendered requires.
Meta, Google and Telegram servers — under those companies' own privacy policies.
5. Cross-border transfer, EU processing and GDPR
Part of the processing happens outside Ukraine: Meta and Google — the USA; Telegram and Altegio — those services' own infrastructure. By using the bot you understand that your data may be processed in these jurisdictions under the policies of the named companies.
The server that runs the bot is physically located in the Netherlands (European Union). Hosting is provided by vps.ac (Podaon SIA), which acts as a data processor on our instructions and does not use your data for its own purposes. Because processing partly takes place in the EU, the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) applies alongside Ukraine's Law "On Personal Data Protection".
Under the GDPR you have the right to:
access — obtain confirmation of processing and a copy of your data;
rectification — request correction of inaccurate or incomplete data;
erasure ("right to be forgotten") — request deletion of your data (see section 8 and the dedicated page);
restriction of processing — in the cases provided by law;
data portability — receive your data in a structured, machine-readable format;
object to the processing;
withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
lodge a complaint with a supervisory authority — the data protection authority in your EU country (list: edpb.europa.eu) or the Ukrainian Parliament Commissioner for Human Rights.
Send GDPR requests to snihyr.d@gmail.com; we respond within 30 days, free of charge.
6. What we do not do
we do not sell or pass your data to third parties for their own marketing;
we do not use the content of your conversation for ad targeting;
we do not build advertising or behavioural profiles from your messages.
7. Your rights under Ukrainian law
Under Ukraine's Law "On Personal Data Protection" you have the right to:
find out what data of yours we process and receive a copy of it;
request correction of inaccurate data;
withdraw consent and request deletion of your data;
lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights.
Regardless of your country, GDPR rights also apply to you — see section 5. To exercise any of these rights, write to snihyr.d@gmail.com.
8. Data deletion
You can request deletion of your data at any time. Step-by-step instructions are on a separate page:
In short: send an email to snihyr.d@gmail.com, or a message on Instagram Direct with the text "delete my data" (or the Ukrainian "видалити мої дані"). Requests are handled within no more than 30 days, free of charge, for any person regardless of country.
9. Changes to this Policy
We may update this Policy. The current version is always available at this address; the effective date is shown at the top of the page.