Privacy Policy

1. Who we are

TRESS is a beauty platform run by Tress Labs (Pvt) Ltd, a company in Sri Lanka. In this policy, "TRESS", "we" and "us" mean Tress Labs (Pvt) Ltd.

Address: 358 Mihinthala Road, Anuradhapura, Sri Lanka. Email: tressbeta@gmail.com.

We decide how personal information is used to run TRESS, so we are responsible for it under Sri Lanka's Personal Data Protection Act, No. 9 of 2022.

2. What this policy covers

It covers the TRESS app for clients, the TRESS for Business app for salons, barbers and other beauty businesses, the tress.lk website, and the emails, text messages and notifications we send.

Businesses can also use TRESS to keep records about their own clients, for example a walk-in client added at the front desk. The business decides what it records about those clients, and we store and process that information for the business. If you have a question about those records, ask the business first. We will help where we can.

3. Information you give us

• Account details: when you sign in with Google, your name, email address and profile picture from your Google account. If we add other ways to sign in, such as Apple, the same applies to the details they share.
• Registration details: your mobile number, date of birth, gender, and either your National Identity Card (NIC) number or a profile photo, which help businesses know who is booking.
• Verification: we send a one-time code by text message or email to confirm your number or email address.
• Profile details you choose to add, such as a short bio and your favourite salons.
• Bookings: the business, services, stylist, date and time, price, notes and any reference photos you add, and the booking's status.
• Messages: the text messages you and a business send in a booking's chat.
• AI Studio: the photos and reference photos you upload, the looks you choose, any description you write, and the previews that are created.
• Payments: the billing name, email, phone and address for an order, and its amount and status. If you buy AI credits, we keep your credit balance and history.
• Business details: the business's name, contact details, address and map location, opening hours, services, prices and photos; team members' names, contact details and roles; stylist pay settings; and bank details for payouts.
• Messages you send us through the contact form on tress.lk or by email.

4. Information collected automatically

• Sign-in records: when you sign in, we keep a record of the session, including the device's IP address and app or browser details, to keep your account secure.
• Notification tokens: if you allow notifications, we keep your device's notification token, its platform and when it was last used.
• Location: the TRESS for Business app asks for your device's location only to help you place your business on the map. We keep the location you confirm for the business, not a history of where your device has been. The TRESS app for clients does not ask for your location.
• Copies of messages we send: we keep a copy of the emails and text messages TRESS sends, such as booking updates and verification codes, so we can check they were delivered.

The apps and tress.lk do not use advertising, analytics or crash-reporting trackers, and tress.lk does not set tracking cookies.

5. How we use your information

• To create and run your account and sign you in.
• To show businesses, services and availability, and to handle booking requests, confirmations and changes.
• To let you and a business talk in a booking's chat.
• To create AI Studio previews, keep your preview history and work out credits.
• To take payment for things you buy through TRESS, such as AI credits, and keep records of them.
• To send service messages: verification codes, booking updates, receipts and notifications.
• To send news about TRESS by email or text message, unless you have opted out. Every marketing message has a way to unsubscribe.
• To keep TRESS safe: preventing fraud and misuse, enforcing our Terms of Use and fixing problems.
• To meet our legal, tax and accounting duties.

Under the Personal Data Protection Act we rely on what is needed to give you the service you asked for, on your consent (for example for marketing, notifications and the photos you use in AI Studio), on our legal duties, and on our legitimate interest in keeping TRESS secure where that does not override your rights.

We don't sell your personal information, and we don't use it to build advertising profiles.

6. AI Studio and your photos

When you create a look, the photo, any reference photos and your description are sent to Google's Gemini service, which creates the preview. We send these requests with Google's storage option turned off, and Google processes them under its terms for paid API services.

We save the original photo and the preview so they appear in your history. You can delete any preview from your history, which removes both pictures from our servers.

Previews carry a "Made with TRESS" mark. They are illustrations, not a promise of the final result.

Instant hair colour in the TRESS for Business app runs on the device. That photo is not sent to us or to Google to make the instant preview.

We don't use your photos to train AI models.

Businesses must only upload a client's photo with that client's permission, and should delete it if the client asks.

7. Who we share information with

• The business you book with: your name, the contact details you share with it, your booking details, notes, reference photos and the booking chat. You can stop sharing your phone number with businesses in Settings.
• Clients: a business's public profile, including its name, address, map location, opening hours, services, prices, photos and the team members it shows, is visible to people using TRESS.
• Service providers that run parts of TRESS for us, and only for that purpose.

Our service providers today are:

• Microsoft Azure: our servers and file storage.
• MongoDB Atlas: our database.
• Google: sign-in, Gemini for AI Studio, Firebase Cloud Messaging for notifications, Gmail for sending email, Google Maps for the map and address lookup in the business app, Google Fonts for the apps' fonts, and Firebase Hosting for tress.lk.
• Notify.lk: text messages in Sri Lanka.
• PayHere: payments. PayHere collects your card or wallet details directly. TRESS only receives the payment reference and the payment method.

We also share information when the law requires it, or when it is needed to protect the safety and rights of our users, the public or TRESS. If Tress Labs is ever merged, bought or sells TRESS, information may pass to the new owner, who must protect it as this policy describes.

8. Where your information is stored

Our servers are in Microsoft Azure's Central India region. Our database and other service providers may store or process information in other countries, including the United States. When information leaves Sri Lanka, we use established providers and take steps so that it stays protected as this policy describes.

9. How long we keep it

• Account details: for as long as your account is open.
• Deleting your account: choose Delete account in Settings. We deactivate the account straight away and permanently delete your account details after 30 days, unless you sign back in before then to keep it.
• Bookings and payments: for as long as the business you visited and the law need them, including tax and accounting rules, and then we delete or anonymise them.
• AI Studio previews: until you delete them or your account.
• Copies of messages we send and sign-in records: for a limited time, for delivery checks and security.
• Messages to us: for as long as we need them to help you.

10. Your choices and rights

• See and correct: you can change most of your details in your profile and settings.
• Get a copy: email tressbeta@gmail.com and we will send you a copy of your personal information.
• Delete: delete your account in Settings, or email us. You can also delete single AI Studio previews from your history.
• Withdraw consent: turn off notifications in your device settings, unsubscribe from marketing using the link in any message, or stop sharing your phone number with businesses in Settings.
• Object or complain: if you are unhappy with how we handle your information, email us first. You can also complain to the Data Protection Authority of Sri Lanka.

We will reply as soon as we can and within the time the law allows. We may need to confirm your identity before acting on a request.

11. Security

We use encrypted connections between the apps, the website and our servers, and we limit who at TRESS can access personal information. No system is completely secure, so please keep your sign-in safe and tell us straight away if you think something is wrong.

12. Children

TRESS is for people aged 18 and over. We don't knowingly collect information from children. If you think a child has an account, email us and we will delete it.

Businesses must not upload photos of children to AI Studio without permission from a parent or guardian.

13. The tress.lk website

tress.lk does not use analytics or advertising cookies. If you use the contact form, we receive the details you enter and use them only to reply to you.

14. Changes to this policy

We will update this policy as TRESS grows and change the date at the top when we do. If a change is important, we will tell you in the app or by email before it applies.

15. Contact us

Email tressbeta@gmail.com, or write to Tress Labs (Pvt) Ltd, 358 Mihinthala Road, Anuradhapura, Sri Lanka.