Privacy Policy
Last revised: 8 September 2026
About this policy
This policy explains how information is handled through emeldalifestyle.com, the website for Emmy Lifestyle & Wellbeing’s women-only at-home services in Abu Dhabi and Dubai. It covers the public website, booking requests, assistant and private Admin sign-in. It does not describe a walk-in storefront or an online checkout.
Information you provide
A booking request asks for your name, international WhatsApp phone number, selected services, Abu Dhabi or Dubai, preferred date and start time. We also record the submission language, request identifiers, service/category references, request status and processing timestamps. The website does not ask for a street address, customer notes, payment card details or medical records in its booking form. Further details may be discussed directly during follow-up.
Why we use booking information
We use these details to receive and review your request, check the requested service area and time, communicate with you on WhatsApp, discuss pricing and appointment details, and administer pending, confirmed, completed or cancelled requests. A request is not a confirmed appointment. We also use request identifiers to prevent duplicate submissions and limited technical information to prevent abuse. There is no online payment or marketing mailing-list feature on this website.
Chatbot messages
The assistant keeps its conversation history and booking draft in the current page’s memory, rather than saving them to browser storage or a chat-transcript database. Some questions are answered locally. Other messages, your selected language and up to six recent history entries are sent through our Netlify function to Google’s Gemini API to prepare a response. The application does not attach the structured booking draft to those AI requests, but anything you type into a message may itself contain personal information. Please do not send medical records, sensitive health details, passwords or payment information. AI responses can be inaccurate and are not diagnosis, medical advice or emergency care.
Hosting, security and service providers
Netlify hosts the site and processes booking/chat requests. Supabase provides the service catalogue, availability API, booking database and Admin authentication. Cloudflare Turnstile performs anti-abuse checks and receives a challenge token and source IP during server verification, as well as technical browser/device signals through its widget. The booking gateway derives a keyed HMAC identifier from the source IP for private rate-limit counters; counters can also contain the canonical phone number and expiry information. These identifiers are pseudonymous, not anonymous. Our functions log operational outcomes and error categories, not intended copies of booking payloads or chat transcripts. Hosting and security providers may separately process request metadata and operational logs.
Google, Admin sign-in and external contact
Public pages request fonts from Google Fonts. Google Gemini processes AI requests under the terms applicable to the configured project; provider retention and use of prompts depend on the service arrangement. We do not promise that messages are never retained or used by a provider. Google OAuth is used only for private Admin sign-in through Supabase; authentication can process account identity, email/profile information and session tokens. Access to customer data additionally requires an authorized Admin record. Choosing a WhatsApp link opens an external WhatsApp/Meta service. A continuation link may include a prefilled message containing your booking details in its URL, which can remain in browser history and be processed by WhatsApp. You control whether to continue and send it.
Storage, retention and international processing
The public site remembers an explicitly chosen language using localStorage. Booking drafts and chat history are held in page memory and are lost when the page is reloaded or closed. Admin authentication uses persistent browser storage. See the Cookie Policy for details. No fixed general retention period for booking/customer records has yet been defined. Records and provider logs may remain until an appropriate deletion or retention decision is implemented. Rate-limit records have expiry values and a cleanup function, but expiry alone does not prove deletion has run. Providers may process information outside the UAE according to their infrastructure and terms; a specific storage country or transfer safeguard is not promised here.
Your choices, privacy requests and security
You can choose not to submit a request, clear the site’s browser storage or contact Emmy about access, correction, deletion or concerns regarding your information. What can be provided depends on applicable law, verification of your identity and any legitimate retention obligations. Use the WhatsApp Emmy contact link on this page for a privacy enquiry; avoid sending sensitive documents in the initial message. This website does not provide an automated data-export or deletion portal. We use access controls and security verification, but no website or communication method can guarantee absolute security.
Minors and policy changes
A service age or guardian-consent policy has not been confirmed. Please ask Emmy before sending a request concerning a minor, and do not submit a child’s sensitive details through the assistant. This does not establish eligibility for any treatment. We may update this policy as the website, service providers or information practices change. The date on this page identifies the latest revision.
Cloudflare Privacy · Google Privacy · Supabase Privacy · Netlify Privacy