Privacy Policy
Last updated: September 29, 2026
1. Operator and scope
PT GUSSY INOVASI MANDIRI operates Lewih. This policy explains data use on lewih.com and app.lewih.com. Contact support@lewih.com with privacy questions or requests.
2. Data processed
Data may include account names and email addresses, salon profiles and locations, and records entered by users: customers, contact details, visits, transactions, payments, inventory, reservations, and payroll. Subscription payment evidence may be uploaded through the application. Technical data and error records may be processed to operate and secure the service.
3. Purposes and responsibilities
We determine the purposes of processing account data, support contacts, subscription payments, and service security data. Data is used to fulfill service requests or agreements and relevant legal obligations. Where a particular processing activity requires consent, that consent must be obtained for that purpose. We process salon operations records to run application functions according to the salon’s instructions and settings. Salons determine the purposes and lawful basis for processing customer and staff records they enter. Salon administrators are responsible for required notices and team access. Our role in relation to data depends on the processing purpose and applicable law.
4. Browser storage and analytics
The application uses browser storage for sessions and preferences. Registration uses Cloudflare Turnstile for anti-bot verification. GoatCounter records marketing page loads and CTA clicks, including a broad source category, page, language, and CTA placement. The events do not include the full referrer URL, search query, full UTM values, or visitor identity. Registration outcomes are recorded separately by the application and are not joined to visit sources. Analytics recording stops when the browser sends a Do Not Track or Global Privacy Control signal; site measurement also runs only when its analytics endpoint is configured. Account owners can manage application analytics in salon policy settings. This setting does not disable storage needed for login or security.
5. Access and service providers
Salon users access data according to the permissions set by the salon administrator. Lewih staff may access salon data when needed to handle a support request. Infrastructure, email delivery, security, or analytics providers may process the data needed to supply those functions. We do not sell personal data. Cross-border processing, if used, must follow applicable data protection requirements; contact us with questions about providers and processing locations.
6. Retention and security
Retention depends on service needs, account status, processing purposes, dispute resolution, and legal obligations. Closing an account does not always mean all records are immediately erased. We restrict access through authentication and tenant access rules. No system is entirely risk-free; do not share passwords or enter unnecessary data.
7. Rights and requests
Under applicable law, you may request information about the controller’s identity, legal basis, purposes, and accountability; correct inaccurate personal data; request access and a copy; ask to end processing or delete or destroy data; withdraw consent; request a pause or restriction; and object to decisions based solely on automated processing that have legal or significant effects. You may also request data in a commonly used electronic format, seek transfer to another controller where systems can interoperate securely, and pursue legal remedies or compensation where available. Send requests to support@lewih.com without including passwords. Processing a deletion request usually takes between one week and one month. We may ask you to verify your identity and authority to protect the data. For records entered by a salon, contact that salon first. The scope and response to a request depend on your rights, legal obligations, and the responsibilities of the relevant data controller.
8. Policy changes
Changes appear on this page with an updated date. Where the law requires additional notice or consent, the relevant process follows applicable requirements.