Who This Policy Covers
This policy applies to Lustre by CES Digital, our public website at lustre.airea.co.nz, demo and customer websites hosted through Lustre, customer consoles, booking flows, lead forms, chat features, support emails and related operator tools.
It covers personal information about salon owners, staff, website visitors, booking customers, prospects and people who contact us.
Information We Collect
We may collect names, business names, contact details, salon addresses, suburb and region, social links, website content, photos submitted for galleries, messages, notes, booking details, payment and subscription status, support requests, console login activity and usage events such as page views, call taps, direction taps and chat starts.
We may also collect technical information such as IP address, browser type, device data, timestamps, referring pages and logs needed to keep the service secure and reliable.
How We Use Information
We use personal information to create and manage Lustre websites, process orders and subscriptions, provide booking and enquiry features, send service emails or messages, support customers, secure accounts, troubleshoot issues, report website performance and improve the service.
We may use public business information and information provided by salon owners to draft website copy, build demo sites and keep customer-facing pages accurate.
Payments, Bookings And Third Parties
Payments are handled through Stripe. We do not store full card numbers. Booking, messaging, email, analytics, hosting, maps, address lookup, domain, storage and AI features may rely on trusted service providers that process information for us or for the salon using the website.
Some providers may process information outside New Zealand. Where that happens, we use reputable providers and take reasonable steps to protect the information in line with the New Zealand Privacy Act 2020.
Connecting Your Instagram Account
If you choose to show your Instagram posts on your Lustre website, you can connect your Instagram Business or Creator account through Meta's official Instagram API. Connecting is optional, and you authorise it yourself through Instagram's own login screen.
When you connect, we receive and store your Instagram account ID and username, an access token that lets us fetch your content, and your recent media - images, videos and reels, along with their captions, links and posted dates. We use this only to display your own posts on your own Lustre website, styled to match your site. We cache the images and videos on our servers so your website visitors load them quickly and reliably.
We do not post to your Instagram, read your private messages, access your followers, or use your Instagram data for advertising. We never sell it. Access tokens are encrypted at rest and are never shown publicly. Our use and transfer of information received from Meta's APIs follows Meta's Platform Terms and Developer Policies.
You can disconnect your Instagram at any time from your Lustre console, which deletes the stored token and cached posts. Removing the Lustre app from your Instagram settings, or asking us to delete your data, triggers the same removal. For data-deletion requests, disconnect in your console or email [email protected].
AI And Automated Features
Lustre may use AI tools to draft copy, suggest content, generate customer responses or help operators review site information. AI output should be reviewed before it is relied on. We avoid sending unnecessary personal information to AI providers, but some business details, prompts, support context or customer messages may be processed when a feature requires it.
Cookies And Analytics
We use cookies, local storage and similar technologies for sign-in sessions, console access, preferences, security, checkout, booking management and basic usage measurement. You can control cookies in your browser, but some service features may not work correctly if they are blocked.
How Long We Keep Information
We keep information for as long as needed to provide the service, meet legal and accounting obligations, handle disputes, maintain security and support legitimate business records. We may delete or anonymise older operational data when it is no longer needed.
Security
We use reasonable technical and organisational safeguards to protect personal information from loss, misuse, unauthorised access, disclosure or alteration. No internet service is completely risk-free, so we also monitor, restrict access and respond to issues when they arise.
Your Rights
You can ask to access or correct personal information we hold about you. You can also contact us about deletion, marketing preferences or concerns about how your information has been handled. We may need to verify your identity before acting on a request.
Contact
For privacy questions or requests, email [email protected]. If you are not satisfied with our response, you can contact the New Zealand Office of the Privacy Commissioner.