Privacy Policy

Effective 25 September 2026

EMBACCI ("EMBACCI", "we", "us") is based in Addis Ababa, Ethiopia. We run the EMBACCI app and the services in it: booking makeup artists, the EMBACCI shop, memberships and the EMBACCI Academy. This policy explains what personal data we collect, why, who we share it with, how long we keep it, and your rights.

EMBACCI is for adults. You must be 18 or older to create an account or to book or buy anything.

If you have a question or want to use any of your rights, email privacy@embacci.com.

1. What we collect

When you create an account: your name, email address, phone number, password (stored only as a secure hash), your region, and whether you use EMBACCI as a client or an artist.

When you book an appointment:

• Where and when: the service, date and time, and the address or venue.
• Access details: access notes (for example a gate code or room number) and the contact number for the day.
• Map point (optional): if you tap Use my current location, or we look up the address you typed, we store a point on the map so your artist can find you.
• Preparation details: anything you tell us to help the artist prepare, such as skin type, allergies or sensitivities, the finish you want, and inspiration photos.

Health-related information. Allergies, sensitivities and skin type are sensitive. We collect them only because you choose to give them, so your artist can work safely and so we can warn you about products that contain ingredients you've told us to avoid. You can leave these fields empty.

When you shop or subscribe:

• the items you order and your delivery address;
• your membership plan and renewal dates;
• a record of each payment.

Card and wallet details are entered in our payment provider's own secure form. EMBACCI never sees or stores your full card number.

When you use the app:

• messages in booking chats and support chats, and the photos you send;
• reviews you write, and reports you make;
• your notification preferences, and a device token so we can send you push notifications;
• your Academy progress, notes and exam results;
• your loyalty points and referral code.

If you are an artist, we also collect:

• your application: a government ID, licences or certificates, your portfolio, biography and experience;
• your base area and a base point on the map, your service radius and your availability;
• the details we need to pay you (bank account, Telebirr or M-Pesa number);
• your earnings and payouts;
• while you are on your way to an appointment only, your live location. It is shared with that client until the appointment starts, then deleted.

Automatically: crash reports from the app (the device model, app version and what went wrong), which are not linked to your name. We do not use advertising identifiers, and we do not track you across other apps or websites.

If you join a waitlist: your name, phone number, region and the service you were interested in.

2. Why we use it

• To provide the service you asked for. This covers:
  • matching you with an available, certified artist;
  • taking payment, and paying artists;
  • delivering orders, running memberships and the Academy;
  • sending the notifications your booking needs.
• To keep people safe: verifying artists, handling reports, suspending accounts that break our rules, and giving you an emergency number during appointments.
• To support you when you contact us, and to resolve disputes, refunds and returns.
• To improve reliability: using crash reports to fix problems.
• To send promotions, only if you turn them on. You can turn them off at any time in Notifications.
• To meet legal obligations: for example keeping transaction records for tax and accounting.

We rely on: performing our contract with you; your consent (for health-related information, precise location and promotions, which you can withdraw at any time); our legitimate interests in running a safe and reliable service; and legal obligations. This follows Ethiopia's Personal Data Protection Proclamation No. 1321/2024, Kenya's Data Protection Act 2019, and the privacy laws of the US states where we operate.

3. Who sees your data

The other person in your booking.

• Your artist sees: your name, the appointment details, the address and access notes, the contact number you gave for the day, the preparation details you gave, and your messages. Chat happens inside the app, and booking chat closes 24 hours after the appointment. Your account phone number isn't shown.
• As a client, you see: your artist's name, profile, rating and reviews, and their live location while they are on the way.

Public reviews. Your star rating and comment appear on the artist's profile, with your first name and last initial. You or anyone else can report a review, and we remove reviews that break our rules.

Service providers who process data for us, and only on our instructions:

• Supabase: app hosting and database, in data centres in the United States.
• Google Firebase: push notifications and crash reports.
• Vercel: hosting of EMBACCI's staff console.
• Our payment provider(s) in your region, for payments and refunds.
• YouTube (Google): Academy lessons are YouTube videos played inside the app. When you play a lesson, YouTube receives information about your device and may set cookies under its own privacy policy.
• OpenStreetMap Foundation: map images and address lookup. Your device's internet address, and any address you type for a lookup, are sent to it.
• Email and SMS providers, when we switch those channels on, to send receipts, codes and messages.

Authorities, when the law requires it, or to protect someone's safety.

A buyer or successor if EMBACCI's business is ever sold or merged. They would be bound by this policy.

We do not sell your personal data, and we do not share it for advertising.

4. Where your data is stored

Our main database is hosted in the United States, so your data leaves Ethiopia, Kenya or your own country. We use providers that protect data in transit (encryption) and at rest. We only transfer data as the laws above allow: for example because it's necessary to provide the service you asked for, with appropriate contractual safeguards.

5. How long we keep it

• Your account and profile: while your account is open.
• If you delete your account (Profile → Your data → Delete my account):
  • you're signed out at once and can't sign in again;
  • your personal data is erased within 30 days;
  • records of payments and completed orders are kept, with your identity removed, for as long as tax and accounting law requires.
• Artists' live location: deleted as soon as the appointment starts.
• Booking chats: close 24 hours after the appointment and are kept as part of the booking record, for support and safety.
• Crash reports: kept by Firebase for up to 90 days.
• Waitlist entries: deleted 90 days after we've told you bookings are open, and after 12 months at the latest. We remove them sooner if you ask.

6. Your rights

Depending on where you live, you can:

• see and get a copy of your data. Profile → Your data → Download my data gives you a file straight away.
• correct it, in Profile or by asking us.
• delete it, in the app at any time.
• object to or restrict how we use it, and withdraw consent, for example by turning off location or promotions, or clearing the preparation details you gave.
• complain to a regulator: in Ethiopia, the Ethiopian Communications Authority; in Kenya, the Office of the Data Protection Commissioner; or your local authority.

Email privacy@embacci.com and we'll respond within 30 days. We may ask you to confirm your identity first.

7. Security

We use encryption in transit, access controls on every table so people see only their own data, short-lived links for private files (ID documents, lesson materials, chat photos), and staff access limited to what their role needs. No system is perfectly secure. If a breach affects your data, we'll tell you and the regulator as the law requires.

8. Children

EMBACCI is not for anyone under 18. If we learn that a child has created an account, we delete it.

9. Changes

If we change this policy in a way that matters, we'll tell you in the app before the change takes effect. The date at the top shows when it last changed.

10. Contact

EMBACCI, Addis Ababa, Ethiopia · privacy@embacci.com · support: support@embacci.com