Privacy policy

Who we are

SporaQuest is operated by ZERIE INSIGHT, a sole proprietorship (enkeltpersonforetak), organisation number 933 272 427. ZERIE INSIGHT is the controller for the personal data described here.

Your account

Clerk runs sign-in for SporaQuest. You sign in with Google or with a link sent to your email address. Clerk stores your email address and sign-in details. If you use Google, Google shares your name, email address and profile picture with Clerk.

SporaQuest stores an account ID from Clerk and links your profile, and any searches you saved before 3 November 2026, to it.

Age confirmation

We record your confirmation that you are 18 or older, when you confirmed it, and the versions of the terms you accepted. We do not collect your date of birth.

Legal basis: legitimate interests (GDPR Article 6(1)(f)), so that accounts are held by adults. We keep the record while your account exists and delete it when you erase your account.

Public profile

A published professional profile shows your name, username, city, workplace, languages, services, portfolio work and contact routes. You can edit or unpublish it at any time.

If you say where you work by place, your profile shows those towns or areas and the cities you make trips to, by name. We keep each as the rounded centre of that town or area, never an address, and use it to show how far away you are.

For a place clients come to, you can choose to show its exact address. Your profile then shows that address with a small map and directions, and the city map shows a pin there. We keep the address and its point only while you show it: switching it off deletes it. Nothing else creates a pin. A workplace address you entered before places is no longer public; only you see it, until you show it as a place’s address or say no, and then it is deleted.

Username

Your username is your public address, sporaquest.com/your-username. When you change it, the old username is held for 30 days. During that time the old address redirects to your profile and no one else can take it. After 30 days it is released. Each earlier username is held for 30 days from when you changed it, up to five at a time. A sixth change releases the oldest.

Portfolio photos

Photos you upload are stored in Cloudflare R2. Location, camera and other metadata are removed before storage. You confirm that you have permission to publish each photo.

When you delete a photo or your account, the stored file is queued for deletion.

A client can ask for a photo of themselves to be removed using the Report content page or by emailing support@sporaquest.com. Photos of identifiable children are not allowed.

Contact routes

Your profile shows the contact or booking routes you add, such as a phone number, Instagram or a booking site.

When someone continues to one of your routes, SporaQuest records the profile, the work item, the channel and whether it opened. It does not record the contact value in analytics. What happens on the other service is covered by that service’s own terms.

Searches saved before 3 November 2026

SporaQuest no longer saves searches, posts requests or takes replies from stylists. If you saved a search or posted a request before 3 November 2026, it is no longer shown to anyone: professionals cannot see it and its link no longer opens. Its city, hair group, hairstyles, places, photos and any contact route you added stay private in your account, with any photos stylists sent you.

You can download these records with your account data, and erasing your account deletes them and queues their photos for deletion. We will delete the remaining records when we retire this storage, and update this policy when we do.

Looking for a hairstylist and messages

When you tap Looking for a hairstylist, we save your city, hair type, who it is for and the category or hairstyle you selected. It is public with your name unless you make it private.

Messages are private between the two people. We keep them so the chat works and look at them only if someone reports the chat. Chat text is never used in analytics.

When a message is waiting we can email your verified sign-in email. Erasing your account deletes your requests and your chats, for both people.

Reports and support

Photo and profile reports use set reasons. A report is linked to your account to prevent abuse but is never shown publicly. Operator decisions are recorded with a reason. When we restrict a professional’s content, we show them the reason.

Anyone can report content on the Report content page. We store the type of report, the page address, the explanation, the sender’s name and email address (optional for child sexual abuse material), and the outcome. The sender can see the outcome on the report status page with their reference and email, and we may also email it to them. We use the email address only to handle the report and tell the sender the outcome. We delete a closed report three years after it was closed.

Support requests store the topic and message you send, linked to your account. Email to support@sporaquest.com is handled in our email inbox.

Location

Cloudflare tells us the approximate city and country of your connection. We use it only to suggest a city. We do not store it.

If you choose Use my location, your browser asks for your permission and gives your position to the page. The page uses it on your device only to pick the nearest city. Your position is not sent to us or stored.

When you search for a place, SporaQuest sends the text you type to Photon, a place search run by komoot using OpenStreetMap data. The request comes from our servers, not your browser.

Maps use Apple MapKit JS. Your browser loads the map from Apple, so Apple receives your IP address and the map area you view. The portfolio list works without the map.

When you search for an address for a place you work, your browser sends the text you type to Apple. When you save it, our servers ask Apple Maps to look it up again. We do not log addresses.

SporaQuest in ChatGPT, Claude and Gemini

When you use SporaQuest inside an AI assistant, the assistant sends us only what the request needs: a city, a hairstyle, a hair type you named, or a stylist's username. We do not receive your conversation, your account with that assistant or your location, and you do not need a SporaQuest account.

We answer with public profile information: names, usernames, towns or areas by name, hairstyles and photos of published work, and links. Contact opens the stylist's own channel through a SporaQuest link, as on our website. We count which tool was used and how many results it returned, without the request's contents. The assistant's provider handles your conversation under its own privacy policy.

Analytics

We use Cloudflare Web Analytics to count page views. It sets no cookies and does not track you across sites.

We use cookieless analytics and masked session replays from PostHog in the EU to understand what helps and what fails. Replays hide text, inputs and images. We do not collect contact details, request or message text, private locations or image metadata. Signed-in activity uses a hashed account ID.

Abuse protection

To limit spam and abuse, we count requests per account or IP address. The account ID or IP address is turned into a keyed hash before it is stored. A count expires 8 days after it was last updated. Expired counts are deleted the next time our cleanup runs, which happens when a protected request is handled.

Legal bases

Contract: to run your account, profile, portfolio, saved searches and support requests.

Legitimate interests: to keep SporaQuest safe, record age confirmations, handle reports and notices of illegal content, prevent abuse, suggest a city and count page views.

Consent: where we ask for it. You can withdraw consent at any time.

Legal obligation: where the law requires us to keep or share data.

How long we keep data

We keep your account data until you erase it. You can erase it on the Account data page.

Erasure hides your public work and contact routes at once. It deletes or pseudonymises your profile, portfolio, searches, support requests, contact routes and age confirmation, and queues stored photos for deletion.

After erasure we keep limited pseudonymised safety and result history, a hold that stops the account from being recreated, and abuse counts until they expire. We keep these for as long as needed for safety and legal claims, and at most five years.

Erasure does not delete your Clerk sign-in. To close it, email support@sporaquest.com.

Server logs are kept for up to 30 days. Support emails are kept for up to 12 months after the request is resolved.

Service providers and transfers

Cloudflare: hosting, database, photo storage, connection location and Web Analytics.

Clerk: sign-in and account security.

Google: sign-in, only if you choose Google.

Apple: maps.

komoot: Photon place search.

Some providers process data outside the EEA, including in the United States. These transfers rely on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.

Your rights

You can ask for access to your data, correct it, export it, erase it, restrict it or object to its use. Export and erasure are on the Account data page. For anything else, email support@sporaquest.com.

You can complain to Datatilsynet, the Norwegian Data Protection Authority, at datatilsynet.no, or to the authority where you live.

Free and unpaid

SporaQuest is free. No one can pay for a higher place in search results. We do not sell personal data.

Changes

We will update this page when our processing changes and show the new date below.