Privacy Policy

1. Our role: controller and processor

Our responsibilities depend on whose data is involved:

• For a Professional’s own account data (and for our own operational and product-improvement purposes), we act as the business responsible for that data — the “controller” or “business” under applicable privacy laws.
• For an End Client’s data that a Professional enters or collects through the Services (such as a customer profile or appointment history), the Professional is the controller and we act as a “processor” or “service provider” on their behalf, as described in our Data Processing Addendum. If you are an End Client and want this data corrected or deleted, contact the salon you did business with; we will help them honour your request.

2. Information we collect

a. Information you provide directly

• Account information — name, email address, phone number, and password when you create an account.
• Business information (Professionals) — salon name, address, phone, business hours, services, durations, pricing, cancellation rules, staff details, and portfolio photos or videos.
• End Client and booking data — names, contact details, appointment history, notes, and preferences for the customers of a salon, entered by the salon and its staff or provided by End Clients when they book.
• Customer-portal data — if an End Client creates a login to view their appointments, the information needed to authenticate and serve that portal.
• Payment information — billing details for Professional subscriptions, and the payment details End Clients use to pay a salon, collected and processed by our payment processor (Stripe). We do not store full payment-card numbers.
• Content you submit — website-builder content, uploads, support messages, and anything else you choose to provide.

b. Information from other sources

• Payment processor — Stripe provides us with limited transaction and payment-status information (for example, authorization results and the last four digits of a card), but not full card numbers.
• Connected accounts — if a Professional connects an Instagram account, we receive data from that integration as described in Section 3.
• Fraud-prevention and verification sources — we may receive information to help verify identity and protect against fraud and abuse.

c. Information collected automatically

• Device and usage data — IP address, browser and device type, operating system, referring and exit pages, pages viewed, access times, and similar log data.
• Cookies and similar technologies — we and our providers use cookies and similar technologies as described in Section 6.
• Mobile app information — if you use the SalonHub360 mobile app, we also collect your device platform (iOS or Android), the app version, and an installation identifier that the app generates for your device so we can keep you signed in and let you sign out of a device remotely. That identifier is created by the app itself — it is not your device’s advertising ID or hardware serial number. The app does not use analytics, crash-reporting, or advertising services. If you choose to add a booking to your device calendar, the app asks your permission and writes that single event on your device; we do not collect or read your calendar.
• Push tokens (mobile apps) — if you install one of our mobile apps and allow notifications, the operating system issues a push token. A push token is a device identifier tied to that app install; we store it so we can route notifications to that device, and we deactivate it when the device stops accepting them or the app is uninstalled.

d. Information we infer

We may derive limited inferences from the information above — for example, an approximate city from an IP address — to operate, secure, and improve the Services.

3. Instagram data

When a Professional connects an Instagram account to SalonHub360, we use the Instagram Graph API to read the Instagram username and user ID and to cache up to 12 of the most recent public posts (image URLs, video thumbnails, captions, and permalink URLs) to display the feed on the salon’s public website.

We do not post to the account, read messages, or access any data beyond what is listed above. The access token is encrypted at rest. Cached post data is refreshed periodically and is deleted when the account is disconnected (Website Builder → Social Feed → Disconnect) or the SalonHub360 account is deleted. You can also request deletion of Instagram data by emailing support@salonhub360.com.

4. How we use information

• To provide, operate, maintain, and secure the Services.
• To enable Professionals to manage bookings, customers, services, staff, marketing, and their public salon website.
• To facilitate appointments and transactions between Professionals and End Clients.
• To process subscription payments and detect and prevent fraud.
• To send service-related communications (such as account, booking, and billing notices) and, where permitted, promotional messages.
• To respond to support requests and verify identity.
• To analyze, troubleshoot, and improve the Services and develop new features.
• To comply with legal obligations and enforce our Terms.

5. Email and text-message communications

We may contact you by email, text message (SMS/MMS), and push or in-app notification. Service-related messages (about your account, bookings, and billing) are part of using the Services. Promotional messages are optional, and you can opt out at any time by following the unsubscribe instructions in the message or contacting us; you may still receive essential service messages. Standard message and data rates may apply.

If a Professional uses the Services to message their own End Clients (for example, appointment reminders or marketing), the Professional is responsible for obtaining the consent required by law — including the Telephone Consumer Protection Act (TCPA) and CAN-SPAM — and for honouring opt-out requests, as described in our Terms. We do not sell or share text-messaging consent or opt-in data with third parties for their own marketing.

6. Cookies, analytics, and tracking

We use cookies and similar technologies that are necessary for authentication and to keep the Services working, and we may use limited analytics to understand and improve how the Services are used. We do not use third-party advertising cookies, and we do not sell your data or share it for cross-context behavioural (“targeted”) advertising. You can control cookies through your browser settings and we honour legally recognized opt-out preference signals (such as Global Privacy Control) where required; disabling essential cookies may break parts of the Services.

7. Payment data

Payments — both Professional subscriptions and payments End Clients make to a salon — are processed by our third-party payment processor (Stripe). Stripe collects and handles full payment-card details under its own terms and privacy policy. We receive only limited payment information, such as authorization results and a truncated card identifier, and we do not store full card numbers. Your use of payment features is also subject to Stripe’s terms.

8. When we share information

We do not sell your personal information. We share it only as described here:

• With the salon you interact with — if you are an End Client, the information you provide when booking or transacting is shared with the Professional you booked, who uses it to provide their services and is responsible for it as the controller.
• Service providers — companies that help us run the Services, such as hosting (Vercel), our database (Railway), payment processing (Stripe), push-notification delivery for our mobile apps (Expo), and messaging and email providers, under contracts that limit how they may use the data.
• Push-notification delivery — notifications sent to our mobile apps are routed through Expo (Expo/Exponent, the Expo Application Services push infrastructure). Your device push token and the notification’s title, body, and identifiers pass through Expo’s servers on the way to Apple’s Push Notification service (APNs) and Google’s Firebase Cloud Messaging (FCM), which deliver the message to your device. Separately, when you allow notifications the app itself contacts Expo to obtain that push token: it sends the device token that Apple or Google issued for this install, the app’s bundle identifier, and an installation identifier, and it re-registers periodically so the routing stays current. That happens on your device, without passing through our servers, whether or not we ever send you a notification.
• Affiliates — companies under common ownership with us, for the purposes described in this Policy.
• Legal and safety — when required by law, legal process, or government request, or to protect the rights, property, or safety of our users, the public, or us, including to investigate fraud or enforce our Terms.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• Professional advisors — legal, accounting, insurance, and similar advisors, as needed to run and protect our business.
• Aggregated or de-identified information — information that cannot reasonably be used to identify you.

9. AI features

Some features may use artificial-intelligence tools to help generate content (such as website copy or marketing text) from inputs you provide. These tools may rely on third-party providers who process your inputs and outputs to deliver the feature. We do not use End Clients’ personal information to train third-party AI models, and you are responsible for reviewing any AI-generated content before using it, as described in our Terms.

10. Website-builder content is public

Content a Professional publishes through the website builder — such as business details, services, prices, photos, and a connected Instagram feed — is displayed on a public salon website and is intended to be seen by anyone. Do not publish information you do not want to be public, and do not include another person’s personal information without their permission.

11. Your choices

• Account information — review and update it by signing in to your account.
• Promotional messages — opt out using the unsubscribe link or message instructions; service messages continue.
• Cookies — control them through your browser; disabling essential cookies may affect functionality.
• Notifications — manage push and device notifications in your device settings.
• Account deletion — delete your SalonHub360 customer account as described in Section 13.

12. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, email us at support@salonhub360.com. We will not discriminate against you for exercising your rights.

U.S. state residents (including California). If you live in a U.S. state with a comprehensive privacy law, you may have additional rights to:

• Know and access the personal information we hold about you, and how we use and share it.
• Request correction or deletion of your personal information.
• Obtain a portable copy of your personal information.
• Opt out of the “sale” or “sharing” of personal information and of targeted advertising — note that we do not sell or share your personal information in this way.
• Limit the use of sensitive personal information.
• Appeal a decision we make about your request, and not be discriminated against for exercising any right.

We may need to verify your identity before responding, and you may use an authorised agent (with proof of authorisation) where the law allows. If you are an End Client whose data a salon entered, we may direct your request to that salon, who is responsible for it as the controller. If we deny a request, you may appeal by replying to our response, and you may also contact your state attorney general.

13. Account and data deletion (customer accounts)

This section explains how End Clients delete their SalonHub360 customer account — the account you use to sign in to SalonHub360 as a customer. Professional, staff, and salon business accounts are handled separately: if you are a Professional and want to close your account, contact us using the details in Section 21.

How to delete your account

• Signed in on the web — open Your profile and choose “Delete account” at the bottom of your personal details.
• On the web without signing in — go to salonhub360.com/account/delete. You do not need the app installed to use it.
• By email — contact us at support@salonhub360.com.

We confirm it is really you before anything is deleted. If you are signed in, we ask you to re-enter your current password. If you are not signed in, we email a single-use confirmation link to the address on the account; it expires one hour after it is sent, and nothing is deleted until you open it and confirm.

What is deleted

When you confirm, we immediately and irreversibly:

• Delete your customer account profile — your name, email address, phone number, address, photo, and password.
• Sign you out everywhere, and remove every mobile device registered to the account.
• Delete the salons, professionals, and looks you saved, together with your private notes.
• Disconnect your account from every salon you have visited.

Reviews you wrote stay published, with your name replaced by “Anonymous”.

We keep a minimal record that the account existed and when it was deleted — an internal reference number and the dates, with none of the personal information above. We keep it so we can show the deletion was carried out, and it cannot be used to identify you.

What each salon keeps

Deleting your SalonHub360 account does not delete the record a salon keeps about you as its client. Each salon you visited keeps its own record — your appointments (including upcoming ones), payments, receipts and refunds, gift cards, memberships and packages, rewards balances, notes your stylist made, and messages you exchanged with the salon. Those are the salon’s business records, and some must be kept by law, such as payment and tax records. As explained in Section 1, each salon is responsible for the records it keeps about its own clients: to ask a salon about its records, contact that salon directly. Deleting your SalonHub360 account is separate from the legal privacy rights you may have — including rights to access, correct, or delete information held about you, and to appeal a decision. Those are described in Section 12 and remain available to you whether or not you delete your account.

Timing

Deletion happens immediately when you confirm it. There is no waiting period, and it cannot be undone. We confirm on screen as soon as it is done. Copies of data may persist for a limited time in routine system backups before those are cycled out, and we may keep limited records where the law requires it — for example transaction, tax, fraud-prevention, or security records. Anything we keep is limited to those purposes and is no longer used for marketing or for ordinary account activity.

What deletion does not do

Deleting your account does not cancel an upcoming appointment. If you have one booked, contact the salon to cancel or change it. It also does not remove transaction records that a salon or SalonHub360 is required to keep.

If you sign up again later with the same email address, a salon that already knows that address may reconnect its existing record of you to your new account, the same way it did the first time.

14. Health and beauty-service information

The Services are not intended to store sensitive health information. Some states regulate “consumer health data,” which can include information that identifies a person’s past, present, or future physical or mental health. Professionals are responsible for determining whether information they collect qualifies as consumer health data or protected health information and for complying with the laws that apply, and they should not enter such information into free-text fields such as appointment notes. As described in our Terms, the Services are not configured for protected health information under HIPAA unless we have agreed otherwise in writing.

15. Children’s privacy

The Services are intended for businesses and adults and are not directed to children. You must be at least 18 to create an account. We do not knowingly collect personal information from children under 13 (or the minimum age in your jurisdiction). If you believe a child has provided us with personal information, contact us at support@salonhub360.com and we will delete it.

16. Data retention

We retain personal information for as long as your account is active or as needed to provide the Services. When an account is closed, we delete or de-identify the associated data within a reasonable period, except where we are permitted or required to retain it for legal, tax, financial-compliance, dispute-resolution, or fraud-prevention purposes. If you create an account but never verify your email address, we email a reminder to that address after 25 days. If the account is still unverified five days after that reminder, we remove it. Instagram data (cached feed and tokens) is deleted immediately when the Instagram account is disconnected. End Client data that a Professional controls is retained according to that Professional’s instructions and our agreement with them. For what happens when you delete a SalonHub360 customer account, see Section 13.

17. Security

We use industry-standard security measures, including HTTPS, encrypted token storage, and access controls, to protect personal information. No method of transmission or storage is completely secure; we encourage you to use a strong password and to contact us immediately if you suspect unauthorised access to your account.

18. U.S. operations

SalonHub360 is operated from the United States by an Oregon-based business. We store and process information in the United States. If you access the Services from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your country.

19. Links to other sites

The Services and salon websites may link to third-party sites and services (such as Instagram or a payment provider). We are not responsible for the privacy practices of those third parties; we encourage you to review their privacy policies.

20. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or the law. Material changes will be communicated by email or a notice in the Services, and we will update the “Last updated” date above. Continued use of the Services after changes take effect constitutes acceptance of the revised Policy.

21. Contact

Questions or requests about this Privacy Policy? Email us at support@salonhub360.com.