1. Who we are
Olux CMS (“Olux”, “we”, “us”) is an online platform for small businesses such as salons, tradespeople and clinics. It brings together website hosting, a content management system, a customer list (CRM), bookings, invoicing, domain registration, business email and an AI assistant.
Olux CMS is run by Olux Studio, a trading name of [COMPANY LEGAL NAME], a company registered in England and Wales (company number [COMPANY NUMBER]), registered office [REGISTERED ADDRESS]. We are registered with the Information Commissioner’s Office (ICO), registration number [ICO REGISTRATION NUMBER].
Two kinds of people, two roles
We handle personal data about two different groups, and our legal role is different for each:
1. Our customers — the business owners and their team members who have an Olux CMS account. For this data we are the data controller: we decide how and why it is used, and this policy applies in full.
2. Our customers’ clients — the people who visit, book, buy, get invoiced by, or contact a business through a website hosted on Olux CMS. For this data the business is the data controller and we are its data processor: we only store and process it on the business’s behalf and on its instructions, under a data processing agreement. If you are one of these people, the business’s own privacy notice explains how it uses your data, and you should contact the business first to use your rights. We will help the business respond.
2. What data we collect
About our customers (account holders)
- Account details: your name, email address, phone number, password (stored only as a secure hash), business name and type, and profile picture.
- Billing details: your plan, billing address, payment history and invoices. Card details are entered directly with Stripe; we never see or store your full card number.
- Social login data: if you sign in with Google or Facebook (or another platform we offer, such as Instagram, X or TikTok), we receive your name, email address, profile picture and the platform’s user ID for you. See section 4.
- Domain and email details: if you buy a domain or business mailbox through us, the registrant contact details the domain registry requires (name, address, email, phone).
- Usage and device data: pages you open in the dashboard, actions you take (for example “site published”), log-in times, IP address, browser and device type. We keep a security log of sign-ins and important account changes.
- Support messages: anything you send us by email or through the app.
Content you put on the platform
- Site content: the text, images, files, products, services and settings you add to your websites.
- CRM, booking and invoice data: the details of your own clients that you or your website collect — for example names, contact details, booking times, form messages, orders, invoices and payments. We process this as your data processor (see section 1).
About visitors to sites hosted on Olux CMS
- What they choose to give: details entered into forms, bookings, checkouts, newsletter sign-ups, reviews and the AI assistant chat.
- Visit statistics: pages viewed, referring site, browser and device type, so the business can see how its site is doing.
- Approximate location from IP address: we look up the town and country an IP address belongs to using a MaxMind GeoLite2 database that runs on our own servers (the IP address is not sent to MaxMind). We use this for visit statistics and fraud and abuse prevention, not to track individuals.
Cookies
We use a small number of cookies. See section 11.
3. How and why we use it
UK data protection law says we need a “lawful basis” for each use of personal data. This table shows what we do with our customers’ data and the basis we rely on.
| What we do | Lawful basis |
|---|---|
| Create and run your account, host your sites, and provide the features you use (CRM, bookings, invoicing, domains, email, AI assistant) | Contract — we need it to provide the service you signed up for |
| Take payments, send receipts and manage your subscription | Contract |
| Register domains and set up business email in your name | Contract; registry rules also require some details |
| Let you sign in with a social account | Contract (it is how you chose to sign in) and consent (you approve it on the platform’s screen) |
| Send service messages: verification codes, security alerts, booking and payment notifications, changes to your plan | Contract |
| Keep the platform secure: sign-in logs, fraud and abuse checks, spam filtering on forms | Legitimate interests — protecting our customers and our service |
| Understand how the product is used and improve it | Legitimate interests — we use aggregated or minimal data where we can |
| Answer support requests | Contract or legitimate interests |
| Send product news and offers | Consent (or, for existing customers, the “soft opt-in” under PECR). You can unsubscribe at any time. |
| Keep accounting and tax records, and respond to lawful requests from authorities | Legal obligation |
For data we process for a business (its clients’ data), we only use it to provide our service to that business, as described in our data processing terms. We do not sell it, and we do not use it for our own marketing.
4. Signing in with social accounts
You can create an account or sign in using an account you already have with another platform instead of a password. Today we offer Google and Facebook. Where we offer Instagram, X (Twitter) or TikTok, the same rules apply.
When you choose this, the platform asks you to approve sharing some details with us. We receive:
| Platform | What we receive |
|---|---|
| Name, email address, profile picture, Google user ID | |
| Facebook (Meta) | Name, email address, profile picture, app-scoped Facebook user ID |
| Instagram (Meta) | Username, profile picture, Instagram user ID (Instagram does not share an email address) |
| X (Twitter) | Name, username, profile picture, X user ID, and email address if you allow it |
| TikTok | Display name, profile picture, TikTok user ID (open ID) |
- We use this information only to create your account, sign you in and keep your account secure (for example, linking it to an existing account with the same email address).
- We do not receive or store your password for that platform.
- We do not access your friends, followers, messages or posts.
- We never post anything on your behalf without your separate, explicit permission.
- We do not sell this data or use it for advertising.
You can disconnect us at any time from the platform’s settings, and you can ask us to delete the data we received. See How to delete your data.
5. The AI assistant
Businesses can switch on an AI assistant on their website and in their dashboard. To work, it sends information to a third-party AI provider (currently DeepSeek):
- the business’s site content (pages, services, prices, opening hours, FAQs) so it can answer questions accurately;
- the messages a visitor types into the chat; and
- where the visitor asks it to, the details needed to take an action such as making a booking or sending an enquiry (for example name, email, phone and preferred time).
The provider processes this only to generate the reply. Please don’t type sensitive information (such as health details or payment card numbers) into the chat. Answers are generated automatically and can be wrong; the assistant does not make decisions that have legal or similarly significant effects on anyone.
Businesses can turn the assistant off at any time. [CONFIRM: whether the AI provider keeps or trains on data, and where it processes it.]
6. Who we share data with
We don’t sell personal data. We share it only with trusted service providers (“sub-processors”) that help us run Olux CMS, under contracts that require them to protect it and use it only for the service they provide to us.
| Provider | What they do | Location |
|---|---|---|
| Stripe | Payments for Olux plans and domains, and payments businesses take from their clients | UK, EU, USA |
| Brevo | Sending emails (verification codes, notifications, receipts, newsletters) | EU (France) |
| Openprovider | Domain registration and business email mailboxes | EU (Netherlands) |
| Hostinger | Server hosting for the platform and its databases | [DATA CENTRE LOCATION] |
| Cloudflare | File storage, content delivery and protection against attacks | Global network |
| DeepSeek | The AI assistant (see section 5) | [CONFIRM — e.g. China] |
| Google, Meta (Facebook, Instagram), X, TikTok | Social sign-in, when you choose it (see section 4) | USA and other countries |
| WhatsApp Business and SMS providers | Booking reminders and notifications by text message, where a business turns this on [NAME SMS PROVIDER] | [LOCATION] |
We may also share data with professional advisers (such as accountants and lawyers), with a buyer if our business is sold (they would have to respect this policy), or with the police, HMRC or other authorities when the law requires it.
International transfers
Some providers process data outside the UK. When that happens we make sure it is protected by an approved safeguard: a UK “adequacy” decision for the country (for example the EU), the UK–US Data Bridge where the US provider is certified, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard for any transfer.
7. How long we keep data
- Account data: for as long as your account is open, then for up to [90 DAYS] after it closes (so we can restore it if closed by mistake and settle any final bills), after which it is deleted.
- Site content, CRM, booking and invoice data you store with us: until you delete it or close your account, then deleted within the same period. Backups are overwritten within [35 DAYS].
- Invoices and payment records: 6 years from the end of the financial year they relate to, because HMRC requires it.
- Security and sign-in logs: up to [12 MONTHS].
- Visit statistics: up to [26 MONTHS], after which they are kept only in anonymous, aggregated form.
- Support emails: up to [2 YEARS] after the conversation ends.
8. How we keep data safe
- All connections to Olux CMS and to hosted sites use encryption (HTTPS/TLS).
- Passwords are stored only as strong one-way hashes. Sign-up email addresses are verified with a one-time code.
- Platform administrators must use two-factor authentication.
- Each business’s data is kept separate from other businesses’ data, and team members only see what their role allows.
- Payment card details are handled by Stripe, which is certified to PCI DSS Level 1.
- We keep sign-in and account-change logs, limit staff access to what they need, and keep our software up to date.
- Regular backups protect against data loss.
No system is perfectly secure. If a personal data breach puts your rights at risk, we will tell you and the ICO as the law requires.
9. Your rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected. You can change most account details yourself in Settings.
- Erasure — have your data deleted (see section 10).
- Restriction — ask us to pause using your data while a concern is looked into.
- Portability — get data you gave us in a common, machine-readable format, or have it sent to another provider.
- Objection — object to uses based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where we rely on consent, you can withdraw it at any time. This doesn’t affect what we did before.
To use any of these rights, email privacy@oluxstudio.com. We will reply within one month, and it is free in most cases. We may need to confirm your identity first.
If you are a client of a business that uses Olux CMS, please contact that business first — it controls your data. If you contact us, we will pass your request on to the business.
Complaints. If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk or 0303 123 1113.
10. How to delete your data
You can delete your Olux CMS account and its data at any time. Choose whichever way suits you:
Option 1 — Delete your account yourself
- Sign in at cms.oluxstudio.com.
- Open Settings → Account Management.
- Click Delete account and confirm.
This permanently deletes your account, your sites and their content.
Option 2 — Ask us by email
Email privacy@oluxstudio.com from the email address on your account, with the subject “Data deletion request”. If you signed up with a social account, tell us which one (for example Facebook). We will confirm when it is done, within 30 days.
Option 3 — Remove Olux from Facebook
- In Facebook, go to Settings & privacy → Settings → Apps and websites.
- Find Olux and click Remove.
This stops Facebook sharing any more data with us. To also delete the data we already received, use Option 1 or 2. Other platforms have similar settings: Google (Google Account → Security → Your connections to third-party apps & services), Instagram (Settings → Website permissions → Apps and websites), X (Settings → Security and account access → Apps and sessions → Connected apps) and TikTok (Settings and privacy → Security → Apps and services permissions).
What we may have to keep
Some records must be kept by law even after you delete your account — for example invoices and payment records, which HMRC requires us to keep for 6 years. We keep only what is needed, use it for nothing else, and delete it once we no longer have to keep it. Backups containing your data are overwritten within [35 DAYS].
If you are a client of a business that uses Olux CMS and want your data deleted, please contact that business; we will act on its instructions.
11. Cookies
Cookies are small files stored in your browser. We only use cookies needed to run the service and remember your choices. We do not use advertising or cross-site tracking cookies.
| Cookie | What it’s for | How long |
|---|---|---|
| Session cookie | Keeps you signed in as you move between pages | Until you close your browser or sign out |
| XSRF-TOKEN | Security: protects forms against cross-site request forgery | Session |
| remember_web_* | Keeps you signed in if you tick “Remember me” | Up to 400 days, or until you sign out |
| theme | Remembers whether you chose light or dark mode | 1 year |
| Stripe cookies | Set by Stripe on payment pages to prevent fraud | See Stripe’s cookie policy |
Because these cookies are strictly necessary, the law does not require consent for them. If we ever add optional cookies (such as analytics), we will ask for your consent first. You can also block or delete cookies in your browser settings, but parts of the service may stop working.
Websites that businesses build on Olux CMS may use their own cookies; their own privacy notices explain these.
12. Children
Olux CMS is a service for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children to create accounts. If you think a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy when our service or the law changes. The “Last updated” date at the top shows when it last changed. If we make important changes, we will tell account holders by email or in the dashboard before they take effect.
Last updated: 10 October 2026
14. Contact us
Questions about this policy or your data? Get in touch:
- Email: privacy@oluxstudio.com
- Post: [COMPANY LEGAL NAME], [REGISTERED ADDRESS]