Privacy Policy.

Last updated: October 27, 2026

This page explains what happens to your information when you use shanails.com: what I collect, why, who helps me with it, and how you stay in control. I’ve tried to keep it in plain English.

Who I am.

This website is Sha Nails (“Sha Nails”, “I”, “me”), run by Sharaf Farahat as a sole proprietor. I’m a hard gel nail technician and educator based in British Columbia, Canada, and I teach nail techs in North America and Europe.

I’m the person responsible for your personal information on this site: Sharaf Farahat, owner of Sha Nails. You can reach me at hello@shanails.com or through the contact page. My mailing address is 4350 St Marys Ave, North Vancouver, BC V7N 1Y7, Canada.

What I collect, and why.

When you join the newsletter or a waitlist

The sign-up forms on this site (the newsletter, The Foundations of Nail Extensions waitlist and the Nails Foundations waitlist) ask for your name and email address. I also note which list you joined (for example the Nails Foundations waitlist), so I only send you what you asked for. Giving me this information is always your choice; without it I just can’t send you emails.

The form sends your details to MailerLite, the service I use to send emails. When you sign up, the website also makes a small record of the signup in its own database (see “My own record of your signup” below). I use double opt-in: MailerLite emails you to confirm your address, and until you click the link you are not on my list. When you confirm, MailerLite may record the date, time and IP address of your confirmation, and it tells me whether you open my emails and click their links, which helps me see what’s actually useful.

I use this to send you the free guide, my newsletter (practical hard gel tips, new articles, product insights) and news about The Foundations of Nail Extensions and Nails Foundations. I only do this because you agreed to it, and you can change your mind at any time with the unsubscribe link at the bottom of every email.

Which link or ad brought you here

When you sign up, I note how you got to the form: the campaign tags in the page address (the bits after a question mark, like utm_source=instagram), the site you came from (for example instagram.com) and the page the form was on. I do this whatever you chose in the cookie banner, because it is part of your signup and not a cookie. It tells me which post or ad is worth doing again. If you came from a Meta ad and said yes to Marketing cookies, I also keep Meta’s ad click code (the _fbc cookie value) so the signup can be linked to the ad.

My own record of your signup

Besides MailerLite, my website’s server keeps a short record of each signup. It holds:

• a scrambled version of your email address (a “hash”: a fixed code made from the email, so I can recognise the same person without storing the address itself),
• your MailerLite ID,
• the date, the form you used, and the campaign tags and referring site from above,
• what you agreed to in the cookie banner and which version of the sign-up wording you saw,
• what happened next: confirmed your email, downloaded the guide, unsubscribed, and whether a report about it was sent to Google or Meta,
• if you said yes to the matching cookies: the Google Analytics and Meta browser IDs from your cookies.

It does not hold your email address, your name or your IP address. A scrambled email is still personal information about you, so everything in this policy applies to it, including your right to see it and to have it deleted. It lives on my own server (see “Who helps me”), and it is how I know how many people signed up and where they came from, even if they said no to cookies.

When you sign up through an Instagram or Facebook form

If you sign up for the free guide through a form inside Instagram or Facebook, Meta collects your first name and email first, and shows you a box asking if I may email you. Meta’s own privacy policy covers that step. If you tick the box and send the form, Meta passes your name, your email, the ad and form you used and your answer to the box straight to my website, and I add you to MailerLite. No other company handles them on the way. I keep your answer to the box and the time you gave it as my proof that you agreed. This policy covers everything from that point on.

When you email me

There is no contact form on this site, just my email address. If you write to me, I get your email address, your name if you include it, and whatever you tell me. I use it to answer you. I keep the conversation for as long as it’s useful and for up to two years after our last message, then delete it.

Visit statistics (Google Analytics), only if you allow Analytics cookies

If you choose “Analytics” in the cookie banner, I load Google Tag Manager, which runs Google Analytics 4. It tells me which pages and articles people read, roughly where visitors come from (country or city), what device and browser they use, and how they found the site, including which post or ad link brought them. It works with a random ID stored in a cookie, not your name or email. I never send your email, name or MailerLite ID to Google. Google keeps this data for 14 months and then deletes it. I use it to improve the articles and the site. If you don’t choose Analytics, none of this loads.

If you said yes to Analytics when you signed up, my website’s server can also tell Google Analytics about the steps that come after, such as confirming your email or downloading the guide from my email, using the same random cookie ID so it can match your visit. It does not send your email.

Ad measurement (Meta Pixel and Conversions API), only if you allow Marketing cookies

When I advertise on Instagram and Facebook, this site can load the Meta Pixel, a small piece of code from Meta. It lets Meta tell me how many people who saw an ad then visited the site or signed up, and it helps Meta show my ads to people who may be interested. It receives your browser ID, your IP address, the page you visited and what you did on it, and Meta may match that to your Facebook or Instagram account if you have one. When you send a signup form, the Pixel also sends Meta a scrambled version of the email address and first name you typed, so the signup can be matched to the ad you saw; nothing else from the form. It loads only if you choose “Marketing” in the cookie banner.

If you said yes to Marketing when you signed up, my website’s server also sends Meta a report that you signed up, and later that you confirmed your email. This is Meta’s “Conversions API”. The report contains the type of step (signed up, confirmed), the time, a scrambled version of your email address, your IP address and browser details, and your Meta cookie IDs (_fbp, and _fbc if you came from an ad). It is used to measure my ads and to help Meta find people like the ones who sign up. I send the report once for each step. If you are in the EU, Meta and I are jointly responsible for sending this information to Meta, and Meta’s own use of it is covered by Meta’s privacy policy.

Reports after you sign up (Google and Meta)

Confirming your email and downloading the guide happen after you have made your cookie choice, and my server cannot see it if you change that choice later. So I base these reports on the choice you made when you signed up, and I send them for up to 180 days after the signup. They stop earlier if you unsubscribe. To stop them at any time, unsubscribe from my emails or write to me at hello@shanails.com and I will switch them off for you.

Links in my emails

The links in my emails carry campaign tags, so Google Analytics can tell me which email brought a visit (if you allowed Analytics). The guide button in the welcome email goes through shanails.com first: the link holds a private code (not your email) so I can count the download once, and then takes you to the PDF. MailerLite also tells me whether you click links in my emails. I don’t track whether you open them.

Server logs

Like every website, the server that hosts this site automatically records each request: your IP address, the date and time, the page you asked for, the browser and device information your browser sends, and the page you came from. I use this only to keep the site running and secure, and to spot abuse. It is kept for 14 days and then deleted.

Embedded and linked content

• Instagram. The site shows my public Instagram posts and links to @shanails.education. Depending on how the feed is set up, the pictures are either copied to this site or loaded from Instagram’s servers, which would share your IP address with Meta. Following a link to Instagram, Facebook, TikTok or YouTube takes you to that service, and its own privacy policy applies from there.
• YouTube videos. Where a page has a video, YouTube (Google) loads only after you press play, using YouTube’s privacy-enhanced mode. Until then, nothing is requested from YouTube.
• Fonts and images. The fonts and images on this site are hosted on my own server, not by Google Fonts or a similar service.

What I don’t collect

There are no accounts, no comments, no online shop and no payments on this website, so I don’t collect payment details or passwords from visitors. I don’t knowingly collect sensitive information, and I don’t use your information to make automated decisions about you.

My legal reasons for using your information.

In Canada, I rely on your consent (under British Columbia’s Personal Information Protection Act and the federal PIPEDA), and I only email you with marketing if you have agreed to receive it (as Canada’s anti-spam law requires). For visitors in the European Economic Area, the UK and Switzerland, the GDPR asks me to name the legal basis:

What	Legal basis (GDPR)
Newsletter, guide and waitlist emails	Your consent (Article 6(1)(a)). You can withdraw it at any time.
Google Analytics and the Meta Pixel (cookies)	Your consent (Article 6(1)(a)), which is also what the EU cookie rules require.
Reports to Google and Meta about your signup and later steps	Your consent to Analytics and Marketing (Article 6(1)(a)), given when you signed up.
My own record of your signup (the scrambled email, source, steps)	My legitimate interest in knowing how many people sign up, where from, and that I have your consent on file (Article 6(1)(f)). You can object at any time.
Anonymous reports in Google Cloud and Data Studio	My legitimate interest in understanding what works (Article 6(1)(f)); no names or emails are in them.
Answering your emails	My legitimate interest in replying to people who write to me (Article 6(1)(f)), or taking steps you asked for before a purchase.
Server logs and keeping the site secure	My legitimate interest in running a secure, working website (Article 6(1)(f)).

Who helps me, and where your information goes.

I use a few service providers who handle information on my behalf. They may only use it to provide their service to me.

Who	What they do for me	What they receive	Where
MailerLite	Sends my emails and stores the sign-up lists	Name, email, the list you joined, which link or ad brought you (campaign tags), signup and confirmation details, email clicks	MailerLite, Inc. (USA), with data stored in the European Union
Google (Tag Manager, Analytics)	Shows me how the site is used	Random ID, pages visited, device and browser, approximate location, campaign tags; and, for people who said yes to Analytics at signup, reports of steps after signup. Only with your Analytics consent	Google LLC (USA); Google Ireland Limited for visitors in the EEA and UK
Meta (Pixel, Conversions API, Instagram, Facebook)	Measures my ads; runs the Instagram and Facebook forms I use	Browser ID, IP address, page and actions on the site; a scrambled email and first name typed into a signup form (Pixel, Marketing cookies only); a scrambled email and step reports for people who said yes to Marketing at signup; the form answers, if you use an Instagram or Facebook form	Meta Platforms, Inc. (USA); Meta Platforms Ireland Limited for visitors in the EEA
Hetzner	Hosts this website and my signup record	Server logs (IP address, time, pages requested, browser details) and the signup record described above	Hetzner Online GmbH, Nuremberg, Germany
Google Cloud (BigQuery, Data Studio)	Holds anonymous reporting data and shows my reports	Google Analytics export, ad results from Meta, MailerLite totals, and a copy of the signup record without any scrambled email or browser ID (an anonymous contact number, dates, steps and campaign tags)	Google LLC (USA); data stored in Montreal, Canada
YouTube (Google)	Plays a video if you press play	IP address and device details, once you press play	Google LLC (USA); Google Ireland Limited

I don’t sell your personal information. I may disclose it if the law requires me to, for example in response to a valid court order.

I don’t use your email address to build advertising lists, and I don’t upload it to Meta or Google for ads. If I ever want to do that, I will ask you first and update this page.

Moving information across borders.

I’m in Canada, this website is hosted in Germany, my email service stores its data in the European Union, my anonymous reports sit in Google Cloud (Montreal, Canada) and some of my providers (Google, Meta, MailerLite) are in the United States. So your information can be stored or handled in Canada, the EU and the US. While it is in another country, it can be accessed by courts, law enforcement and national security authorities there under that country’s laws.

If you’re in the EU, UK or Switzerland and your information is sent outside those areas, I make sure there is a recognised safeguard in place. For the US providers above, that is the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Information that reaches me in Canada is covered by the European Commission’s decision recognising Canada’s privacy law for commercial organisations as adequate. You can ask me for details of these safeguards at hello@shanails.com.

How long I keep it.

• Newsletter and waitlists: until you unsubscribe or ask me to delete you. If you unsubscribe, I mark you as unsubscribed so you don’t get emailed again; if you’d like to be erased completely, just ask. If you haven’t clicked any link in my emails for 24 months, I may remove you from the list.
• My own record of your signup: the scrambled email and the other items that point to you are removed 30 days after you unsubscribe, and at once if you ask me to delete you. Otherwise they are removed 24 months after your last activity (a signup, a confirmation, a download). One exception: the proof that you agreed to my emails (the scrambled email, the date, the form and the version of the consent text) is kept for 3 years after you unsubscribe, because Canadian anti-spam law expects me to be able to show your consent, and so I can defend myself if a complaint is ever made. If you ask me to delete you, it goes at once with the rest. What stays is an anonymous row (the date, the form, the steps and the campaign tags), so my counts stay right.
• Emails you send me: up to two years after our last message.
• Google Analytics data: 14 months, then Google deletes it automatically. The copy in Google Cloud is kept for 25 months.
• Anonymous reports (Google Cloud): the totals and anonymous rows are kept as long as they are useful. They contain nothing that points to you.
• Instagram and Facebook form answers: the same as the signup record above; Meta keeps its own copy under Meta’s rules.
• Server logs: 14 days.
• Cookies: each cookie has its own lifetime. They’re listed in the Cookie Policy.

Your rights and choices.

You can, at any time:

• Ask what I hold about you and get a copy.
• Correct anything that’s wrong or out of date.
• Ask me to delete your information.
• Withdraw your consent to emails or cookies. Unsubscribe with the link in any email, or change your cookie choices with “Cookie settings” in the footer of this site. Withdrawing doesn’t affect anything I did before you withdrew. To stop the reports to Google and Meta about your signup, unsubscribe or write to me (see “Reports after you sign up”). If you ask me to delete you, I delete you in MailerLite and my own signup record, and I remove the identifiers that point to you in the reports I keep.
• If you’re in the EEA, UK or Switzerland, you can also ask me to restrict how I use your information, object to it, or receive it in a portable format.

To use any of these, email hello@shanails.com. I may need to confirm it’s really you first. I’ll reply within 30 days. There’s no charge, unless a request is clearly excessive.

If you’re unhappy with how I’ve handled your information, please tell me first so I can put it right. You also have the right to complain to a privacy regulator: in Canada, the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia; in the EU, your local data protection authority (for example, in Italy, the Garante per la protezione dei dati personali; the full list is on the European Data Protection Board website).

Cookies.

This site asks before it uses any cookie that isn’t strictly necessary. The Cookie Policy lists every cookie and explains how to change your choice.

Keeping your information safe.

The site is served over HTTPS, and only I and the people who help me run the site can log in to it or to my email list. No system is perfectly secure, but I choose providers who take security seriously and I only ask for the information I need.

Children.

This site is written for nail professionals and people training to become them. It isn’t aimed at children, and I don’t knowingly collect information from anyone under 16. If you think a child has signed up, email me and I’ll delete it.

Changes to this policy.

If I change how I handle your information, I’ll update this page and the date at the top. If the change matters for how I use your email address, I’ll let newsletter subscribers know directly.

Contact.

Questions about any of this? Email hello@shanails.com, or use the details on the contact page. My mailing address is 4350 St Marys Ave, North Vancouver, BC V7N 1Y7, Canada.