Privacy Policy

LUX Mirror is a product of Lux Mirror LLC, a Pennsylvania limited liability company. We are the controller of the personal information described in this policy, except where we act as a processor for a salon (see Our two roles).

Lux Mirror LLC
96 Commerce Drive PMB 200
Wyomissing, PA 19610, United States
privacy@theluxmirror.com

This policy applies to:

• theluxmirror.com — this website, including reservations, deposits, and booking pages.
• LUX Mirror — the business app used by salon owners and their staff to run bookings, clients, team, devices, and billing.
• LUX Booking — the client app used to find a shop, book an appointment, and view photos taken at the chair.
• The LUX Smart Mirror and the LUX cloud services it connects to.

It does not cover a salon’s own privacy practices, or any third-party site we link to.

For our own customers, we are the controller. When a salon owner signs up, reserves a mirror, or pays a subscription, we decide how that information is used, and this policy governs it.

For the records a salon keeps about its clients, we are a processor. Appointment histories, client contact details, notes, and photos taken at the chair belong to the salon. We store and process them on the salon’s instructions and do not use them for our own purposes. If you are a client of a LUX-equipped shop and want your records changed or removed, ask the shop first — they control it. We will help them act on your request.

Information you give us.Your name, email address, phone number, and password (stored only as a salted hash — never in readable form). If you sign in with Google, we receive your name, email address, and profile picture from Google, and nothing else. If you sign in with Apple, we receive your name and email address (or Apple's private relay address if you choose Hide My Email), and nothing else. Salon accounts also include business name, locations, services, hours, team members and their roles, and the client and appointment records you create. Anything you send us through the contact form or by email.

Payment information. Card details go directly to Stripe and never touch our servers. We keep what Stripe returns: the card brand, last four digits, expiry, and the Stripe customer, subscription, and payment identifiers needed to bill you and show your history.

Information we collect automatically. App version, operating system, device model, language, crash and error reports, and basic usage events. On this website, aggregate traffic measurement through Google Analytics. Server logs including IP address.

Location. Only if you ask for it. Searching for shops “near me” in the LUX Booking app uses your device’s approximate location, with your permission, to sort results. We use it for that search and do not build a location history.

Information from a paired mirror. Device serial and public key, firmware version, online status, last-seen time, and basic health metrics — the fleet telemetry a salon owner sees in the app. Plus any photos a stylist deliberately captures (see The mirror’s camera).

This is the part people ask about, so we will be exact.

The live camera feed is processed on the mirror itself and is never streamed to us. Style previews, colour try-ons, and gesture control all run on the device’s own hardware. The feed is not recorded, not uploaded, and not retained — it exists only in the mirror’s memory for as long as it takes to draw the next frame.

An image leaves the mirror only when someone deliberately takes a photo. That photo is uploaded to the salon’s private library, visible to that salon’s staff and to the client it is assigned to. Nobody else can see it. We do not use these photos to train models, and we do not sell or license them.

We do not run facial recognition and we do not build faceprints or any other biometric identifier.

A style preview generated with AI sends the relevant image to our image provider (Replicate) for processing and deletes it there once the result is returned.

• To create and secure your account, and to keep you signed in.
• To run the service: bookings, availability, client records, team access, device pairing and fleet status.
• To take payment, manage subscriptions and deposits, and send receipts.
• To send transactional messages you asked for — booking confirmations and reminders, team invitations, password resets, billing notices, and device alerts.
• To provide support, and to investigate faults, abuse, and fraud.
• To improve the product, using aggregate and diagnostic data rather than the contents of your client records.
• To meet legal, tax, and accounting obligations.

Marketing email, if you have opted in, always carries a one-click unsubscribe. Turning it off never affects the transactional messages above.

If you are in the European Economic Area or the United Kingdom, we rely on: contract, to deliver the service you signed up for; legitimate interests, to secure the service, prevent fraud, and improve the product; consent, for marketing email, push notifications, and location — each withdrawable at any time; and legal obligation, for tax and accounting records.

We use a small number of service providers to run LUX. They may only process information on our instructions, for the purpose listed, and are bound by contract to protect it.

Beyond that, we share information only: with a salon, where you are its client and the records are its own; when the law requires it, or to protect someone’s safety or our legal rights; and with an acquirer, if LUX is ever bought or merged — in which case this policy continues to apply until you are told otherwise.

We have never sold personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. We do not run advertising networks or third-party trackers in our apps, and we do not sell or rent your client lists, appointment history, or photos to anyone.

Account and business records are kept while your account is active. When an account is deleted we remove it and the records we hold for it within 30 days, except where we must keep something longer — payment and tax records for seven years, and security logs for up to 12 months.

Backups are retained on a rolling 30-day cycle, so deleted data may persist in an encrypted backup for up to 30 days after removal from live systems.

Photos and client records belonging to a salon are kept for as long as the salon keeps them, and are deleted when the salon deletes them or closes its account.

You can ask us to:

• Give you a copy of the personal information we hold about you.
• Correct anything inaccurate.
• Delete your account and the information attached to it.
• Export your data in a portable format.
• Stop marketing email, push notifications, or location access.
• Restrict or object to processing based on legitimate interests (EEA/UK).

Most of this you can do yourself in the app under Account. You can delete your account from inside either app (Settings → Danger zone → Delete account) — see Delete your account for what is removed and what we must keep. For anything else on that list, or to request deletion without the app, email privacy@theluxmirror.com from the address on the account. We respond within 30 days, and we do not charge for it or treat you differently for asking.

If you are in the EEA or UK you may also complain to your local data protection authority. We would rather you came to us first.

Data is encrypted in transit with TLS and at rest by our hosting provider. Access to your records is enforced in the database itself through row-level security, so one salon can never read another’s — it is not a rule the app is trusted to follow, it is a rule the database enforces on every query. Staff access to production is restricted, logged, and requires multi-factor authentication.

No system is perfectly secure. If a breach ever affects your personal information, we will notify you and the relevant regulators as the law requires.

LUX is built for salon professionals and their adult clients. Our apps are not directed at children and we do not knowingly collect personal information from anyone under 13 (or under 16 in the EEA/UK). If you believe a child has given us information, email privacy@theluxmirror.com and we will delete it.

Where a salon books a minor as a client, the salon is responsible for obtaining any consent required from a parent or guardian, including for photos.

LUX is operated from the United States and our providers are listed above. If you use LUX from outside the US, your information will be transferred to and processed in the US. Where required, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum with our providers.

We will update this page when our practices change, and the effective date at the top always tells you which version you are reading. For material changes we will email account holders and give notice in the app before the change takes effect.

Privacy questions, requests, and complaints: privacy@theluxmirror.com. Anything else — get in touch or write to Lux Mirror LLC, 96 Commerce Drive PMB 200, Wyomissing, PA 19610.

Our Terms of Service govern your use of LUX.