draft-2026-10-10
Privacy notice
Draft for Mohamed’s review. Not approved legal advice or an effective agreement.
Status and contact
This is a review draft for Mohamed, not an approved notice. The platform operator’s legal name, registered address and privacy contact must be confirmed before this notice is approved.
Our roles
The salon is the controller of its clients’ appointment records and decides why they are used. The platform processes those records on the salon’s documented instructions. The platform is a separate controller for business account administration, billing, fraud prevention and service security. Stripe’s role depends on the payment service and its own notices.
Information and purposes
The service handles business and staff contact details, sign-in and security records, appointment details, client contact details, consent choices and payment references. Card numbers and bank onboarding details are handled by Stripe, not collected by the platform. The platform uses account data to provide the service, manage subscriptions and protect accounts. It does not sell appointment records or use salon client data for its own advertising.
Lawful bases and sensitive information
The platform proposes contract for providing business accounts and legitimate interests for proportionate security and abuse prevention, subject to a documented assessment. Legal obligations may apply to financial records. Each salon must identify its own lawful bases, including any additional condition for special-category data. Health information should not be added until the relevant safeguards and instructions have been approved. Marketing choices must remain separate from appointment administration.
Recipients and international transfers
Authorised service providers may receive data only as necessary for hosting, payment processing, email and approved integrations. The actual sub-processor list, hosting and backup locations, access arrangements and any international transfer safeguards must be verified and published before approval. Connecting an optional provider may send data under that provider’s terms.
Retention and security
Records are kept only for the documented purposes and applicable legal obligations. Exact periods for appointments, inactive accounts, financial records, logs and backup expiry require approval. Access controls, tenant boundaries, encrypted provider credentials and backup/recovery controls support security; they are not a guarantee that incidents cannot happen.
Your choices and rights
Clients should contact their salon for appointment access, correction, deletion or marketing requests. Business account holders should use the approved platform privacy contact. Rights can include access, rectification, erasure, restriction, portability and objection, subject to applicable conditions. Consent can be withdrawn where it is the basis used. Individuals may complain to the Information Commissioner’s Office at ico.org.uk.
Cookies and automation
The service uses necessary sign-in cookies and local preferences such as the chosen theme. Turnstile is used to protect business registration. No non-essential analytics or advertising cookies are authorised by this draft. Booking and security rules are automated; material disputes should be reviewed by a person.