Notice: Our legal documents are provided in English only to ensure legal accuracy and consistency. We recommend using a translation tool if you need assistance understanding these documents.
Last Updated: October 14, 2026
This Privacy Policy describes how GlowForms LLC ("GlowForms," "we," "us," or "our") collects, uses, and discloses your Personal Information when you visit or use glowforms.com or purchase and use our Services.
Our Services are intended for beauty professionals, estheticians, and similar wellness providers ("Professionals"). This Policy applies to the information we collect from and about Professionals. It does not apply to personal information you collect from your clients (such as intake or consent forms). You are responsible for your own privacy practices with your clients. GlowForms only stores that data on your behalf.
When you use GlowForms to collect information from your clients, you act as the data controller and are fully responsible for deciding how and why that information is used. GlowForms acts solely as a data processor, securely storing, transmitting, and making the information available to you.
Security & Compliance
Your client data is protected with industry-leading security standards. GlowForms is GDPR and HIPAA compliant, ensuring we meet all relevant regulatory requirements for privacy and data protection.
GlowForms handles all personal data in compliance with applicable privacy laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). These Terms incorporate by reference our Privacy Policy and Data Processing Addendum (DPA).
Contact
After reviewing this policy, if you have additional questions, want more information about our privacy practices, or would like to make a complaint, please contact us or by mail using the details provided below.
Collecting Personal Information
When you visit the Site or use our Services, we collect certain information about your device, your interaction with the Site, and information necessary to process your purchases or maintain your account.
In this Privacy Policy, we refer to any information about an identifiable individual as "Personal Information."
Device Information
- Purpose of collection: to load the Site accurately for you, and to perform analytics on Site usage to optimize our Site.
- Source of collection: automatically when you access our Site using cookies, log files, web beacons, tags, or pixels.
- Disclosure for a business purpose: shared with our service providers.
- Personal Information collected: version of web browser, IP address, time zone, cookie information, what sites or products you view, search terms, and how you interact with the Site.
Order Information
- Purpose of collection: to provide products or services to you to fulfill our contract, to process your payment information, provide you with invoices and/or order confirmations, communicate with you, screen for potential risk or fraud, and, when in line with your preferences, provide information or advertising about our Services.
- Source of collection: collected from you.
- Disclosure for a business purpose: shared with our service providers, including our payment processor Stripe.
- Personal Information collected: name, billing address, shipping address, payment information (including credit card numbers), email address, and phone number.
Professional/Business Information
- Purpose of collection: to verify your professional status and allow you to use the Services.
- Personal Information collected: license numbers, business hours, service details, cancellation policies, and any images or videos of your work portfolio you choose to share.
Customer Support Information
- Purpose of collection: to provide customer support.
- Source of collection: collected from you.
- Disclosure for a business purpose: none, unless necessary to resolve your request.
Minors
Our Services are intended for individuals 18 years of age or older. We do not knowingly collect Personal Information from children. If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us to request deletion.
Sharing Personal Information
We share your Personal Information with service providers to help us provide our Services and fulfill our contracts with you. We may also share your information to comply with laws, respond to subpoenas or legal requests, or otherwise protect our rights.
We use Stripe to process payments. You can read more about how Stripe uses your Personal Information here: https://stripe.com/privacy.
We may also share non-identifiable, aggregated data for analytics and improvement.
Google API Services
If you connect a Google account to GlowForms (for example Gmail for admin–technician communication, or Google Calendar for booking sync), we access only the Google user data needed for that feature, as authorized by you through Google's consent screen via Google OAuth.
Depending on the feature you enable, this may include access through the Gmail API and/or Google Calendar API. For Gmail, that may include reading, sending, and inserting messages used for admin–technician communication. For Google Calendar, that may include creating or updating calendar events when bookings are synced to your calendar. We use this data solely to provide the connected GlowForms features you request. We do not sell Google user data, and we do not use Google user data for advertising or for unrelated profiling.
Access tokens are stored securely and can be revoked by disconnecting the integration in GlowForms or by revoking access in your Google Account settings. GlowForms's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Behavioural Advertising and Analytics
We use your Personal Information to provide marketing communications that may interest you.
We use Google Analytics, Google Tag Manager, Meta Pixel, the Meta Conversions API, Smartlook, and Microsoft Clarity to measure site usage and advertising on glowforms.com. These tools may set cookies or similar identifiers and receive IP address, device, and page-activity data.
Microsoft Clarity records how the Site and the technician app at my.glowforms.com are used. Clarity may set cookies such as _clck and _clsk and may receive IP address, device, and page-activity data. Recordings are stored by Microsoft in the United States. Text shown on screen is masked. On the technician app, Clarity does not run on client form, booking, or portal pages. Microsoft's privacy statement is at https://privacy.microsoft.com/privacystatement.
Google Analytics helps us understand how Professionals use the Site:
Social media pixels (such as Meta Pixel) may track your activity for ad measurement. You can opt out of targeted advertising on this site at Your Privacy Choices, or through:
We do not work with additional advertising partners beyond these analytics/social tools.
Using Personal Information
We use your Personal Information to:
- Provide and improve our Services
- Process payments through Stripe
- Communicate with you, including sending updates, offers, newsletters, and promotions (you can unsubscribe using the link in emails)
- Provide customer support
- Conduct analytics to improve user experience
- Administer surveys, sweepstakes, promotions, or contests
- Comply with legal obligations and prevent fraud
Lawful Basis (for EEA Residents)
If you are a resident of the European Economic Area (EEA), we process your Personal Information under these lawful bases:
- Your consent
- The performance of the contract between you and us
- Compliance with our legal obligations
- Protection of your vital interests
- Performance of a task carried out in the public interest
- Our legitimate interests, which do not override your fundamental rights and freedoms
Data Retention & Deletion
We retain your Personal Information as long as you maintain an account with us. If you cancel your account, we delete your personal data unless we are legally required to retain it (e.g., for tax or compliance purposes).
You may cancel your GlowForms account at any time by following the steps in your account settings or by contacting us.
Important Notice:
- Canceling your account will permanently delete all data associated with it.
- We do not retain data for unpaid or inactive accounts. If your subscription expires or payment fails, we are not obligated to store or maintain your data.
- Data recovery after cancellation or non-payment is not possible.
- Upon termination, your license to use the Service ends, and access to any connected third-party platforms may also be revoked.
Automatic Decision-Making
We do not engage in fully automated decision-making that has a legal or otherwise significant effect using customer data.
Selling and Sharing Personal Information
We do not sell Personal Information for money. We may share identifiers (such as cookie IDs, IP address, device information, and hashed contact details) with Meta and Google for cross-context behavioral advertising and ad measurement. That sharing can be treated as a "sale" or "share" under the California Consumer Privacy Act ("CCPA") and similar U.S. state laws.
You can opt out at any time on our Your Privacy Choices page. We also honor the Global Privacy Control (GPC) signal as an opt-out of sale or sharing.
Sensitive Information Disclosure
We do not use or disclose any information that is considered "sensitive" under applicable law for the purpose of inferring characteristics about you.
Your Rights
U.S. State Privacy Rights
If you are a resident of California or another U.S. state with privacy laws, you may have the right to:
- Access the personal information we hold about you
- Request correction or deletion
- Opt out of sharing personal information for targeted advertising
- Appeal if we deny your request
- Exercise your rights without discrimination
To opt out of sale or sharing, use Your Privacy Choices. To exercise access, correction, or deletion rights, contact us. Authorized agents may be required to provide written authorization.
GDPR and UK GDPR (for EEA and UK Residents)
If you are a resident of the EEA or the United Kingdom, you have the right to access, correct, update, erase, restrict, object to, or port your Personal Information, and to withdraw consent. Contact us to exercise these rights.
We do not set analytics or advertising cookies until you accept them on the cookie banner or in Cookie settings. You can withdraw that choice at any time on that page. Essential cookies (login, language, and storing your choice) do not require consent.
Cookies and Tracking Technologies
We use cookies and similar storage to operate the Site, remember preferences, measure usage, and support advertising. Analytics and advertising cookies stay off until you click Accept on the cookie banner, or turn a category on in Your Privacy Choices. You can turn them off again on that page.
Necessary / first-party product cookies
sb-*and related auth tokens: Supabase login sessionNEXT_LOCALE: language preference (1 year)gf_privacy: your privacy choices on this browser (1 year)gf_regime: whether this visit is treated under EU/UK or US privacy copy (1 day)gf_attr: first-party visit attribution such as UTM parameters and landing page (30 days). This cookie is set only after you consent to analytics. Advertising click IDs from Meta are stored here only when sale/share is allowed.
Analytics cookies (optional)
- Google Analytics / Google Tag Manager identifiers such as
_gaand related cookies - Smartlook session-replay cookies and local storage
- Microsoft Clarity cookies such as
_clckand_clsk
Advertising cookies (optional; sale or share)
- Meta Pixel cookies such as
_fbpand_fbc - Google advertising cookies such as
_gcl_*
Most optional cookies are persistent and expire between 30 minutes and two years. Blocking necessary cookies in your browser may affect login and language settings.
Additional Technical Information (Admin Panel and Technician App)
Marketing pixels and analytics scripts are not loaded on admin or authentication pages. Those areas still use necessary first-party cookies (session and privacy preferences) and may use local browser storage:
Admin Panel
TOKEN: login session token (stored until logout or manual deletion)soundEnabled: user preference for notification sounds
OAuth login via Google may result in cookies set on Google's domains.
We use Pusher for real-time notifications. Pusher may process IP, connection IDs, and set cookies under their own privacy policy.
Other technologies:
- OTP/Email verification codes stored server-side for up to 10 minutes
- Consent logging for legal/security (IP, User-Agent)
- Sound files cached in browser resource cache
Technician App
TOKEN: session tokenform_token: for resuming in-progress formssoundEnabled: notification sound preference
Pusher handles real-time updates (same as above).
Microsoft Clarity session recording on product pages may set _clck and _clsk. It is not loaded on client form, booking, or portal pages.
Google reCAPTCHA v3 and OAuth may place cookies on Google domains.
Server-side logging includes consent, form submissions, and verification metadata.
Global Privacy Control and Do Not Track
We honor Global Privacy Control (GPC) as an opt-out of sale or sharing for advertising. When we receive a GPC signal, we do not load Meta advertising tools or send Meta Conversions API events for that browser.
Browsers may also send a "Do Not Track" signal. There is no consistent industry standard for DNT, so we do not treat DNT as an opt-out. Use GPC or Your Privacy Choices instead.
External Links
Our Services may contain links to third-party websites. GlowForms is not responsible for the privacy practices of those websites.
Changes
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through our Services before they take effect.
Complaints
If you would like to make a complaint, please contact us: https://glowforms.com/contact