Privacy Policy
SalonFlow (the “Service”)
Effective date: 2026-00-00
1. Two kinds of information
SalonFlow handles personal information in two different roles, so we explain them separately.
- Account information — information about the businesses that sign up and their logins. For this information, we decide how it's used and this policy describes our practices.
- Client Data — information a salon, spa or other business enters about its own clients. The business controls that data; we only store and process it on the business's behalf as a service provider. We don't access it without the business's instructions, use it for our own purposes, or sell it.
2. Information we collect and why
2-1. Account information
| Required |
Business name, owner name, mobile number and email, business address and phone number, username,
and password (stored only as a one-way hash) Why: to identify you, provide the Service, send plan and billing notices, and respond to support requests Kept: until your account is closed, then deleted without delay (unless the law requires us to keep it longer) |
|---|---|
| Optional |
Staff login names, dates of birth, phone numbers and emails Why: to give each staff member their own login and permissions |
| Automatic |
Sign-in times, login history and activity logs Why: to prevent misuse and troubleshoot problems We don't store IP addresses. We count sign-in attempts briefly in memory to block password guessing; the count is cleared when the server restarts. |
2-2. Client Data (stored on behalf of the business)
Businesses may store the following. Each business is responsible for deciding what it collects, how long it keeps it, and for giving its clients any required notice and obtaining consent (including consent to receive text messages).
| Clients | Name, phone number, date of birth, gender, service notes, photos (if the business uploads them), visit and service history, payments, prepaid balances and packages, tier, and referral or family links |
|---|---|
| Staff | Name, title, photo, work hours, time punches, days off, and service performance |
| Integrations | Booking details from connected booking channels (such as Reserve with Google) and caller phone numbers |
3. How we share information
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only:
- with your consent or at your direction;
- to the service providers listed in Section 4, who process it for us under contract; or
- when required by law or valid legal process.
Sharing client information between locations in a multi-location group is off by default. It's only turned on when both the main location and each location turn on sharing in Settings. Because sharing between separate businesses may require client consent, please obtain it before turning sharing on.
4. Service providers and international transfers
| Provider | What they do · data involved |
|---|---|
| Supabase Inc. / Render Inc. (update to match the providers you use) |
Database storage and server hosting · all data stored in the Service Storage location: (selected region) · Kept until the account is closed |
| OpenAI, L.L.C. (USA) |
Only when you use AI insights, AI chat or AI message drafts with ChatGPT, the data needed for the analysis is sent to OpenAI.
|
The Service is operated from (country of operation — e.g. the Republic of Korea), and your information may be processed in countries other than the one where you live. We protect it as described in this policy wherever it's processed.
5. Retention and deletion
- We delete personal information without delay once the retention period ends or it's no longer needed.
- When a business deletes a client, that client's name and contact details are also removed from sales, appointments, prepaid balances, packages, message history, call history, search history and on-screen alerts.
- Electronic files are deleted in a way that can't be recovered.
- Verification codes are deleted as soon as they're used or expire.
6. Your rights
You can access, correct or delete your account information at any time in Settings, or by contacting us. Depending on where you live (for example, California), you may have additional rights, such as the right to know what personal information we hold, to request deletion or correction, and not to be discriminated against for exercising these rights. We'll verify your request and respond within the time required by law.
If you're a client of a business that uses SalonFlow, please contact that business directly to access, correct or delete your information. We'll assist the business in responding.
To stop receiving text messages from a business, reply STOP to any message.
7. Security
- Passwords are stored using a one-way hash (scrypt) with a unique random salt. Even we can't see your original password.
- Access control — each business's data is fully separated. Staff can only see what the owner allows, and staff without phone-number permission see masked numbers.
- Encryption in transit — the Service is only available over HTTPS.
- Sign-in protection — sign-in attempts are limited and temporarily locked after repeated failures. Session cookies are HttpOnly, so scripts in the browser can't read them.
- Data minimization — we collect only what's needed to provide the Service.
8. Children
The Service is intended for businesses and isn't directed to children under 16. We don't knowingly collect personal information from children for our own purposes.
9. Contact us
| Company | (Company name) |
|---|---|
| Address | (Address) |
| Privacy contact | (Name · title) |
| (Privacy email) |
10. Changes to this policy
If we update this policy, we'll post the changes and the effective date in the Service in advance. For changes that are materially adverse to you, we'll give at least 30 days' notice.
← Back to SalonFlow