Privacy Policy

SalonFlow (the “Service”)

Effective date: 2026-00-00

Highlighted fields are placeholders that the operator will complete. This is a draft and should be reviewed before it is published.

1. Two kinds of information

SalonFlow handles personal information in two different roles, so we explain them separately.

Account information — information about the businesses that sign up and their logins. For this information, we decide how it's used and this policy describes our practices.
Client Data — information a salon, spa or other business enters about its own clients. The business controls that data; we only store and process it on the business's behalf as a service provider. We don't access it without the business's instructions, use it for our own purposes, or sell it.

2. Information we collect and why

2-1. Account information

Required	Business name, owner name, mobile number and email, business address and phone number, username, and password (stored only as a one-way hash) Why: to identify you, provide the Service, send plan and billing notices, and respond to support requests Kept: for 180 days after your service period ends (because you cancelled or did not pay), then deleted. We keep it so you can pick up where you left off if you choose a plan in that time, and we notify you from 30 days before deletion.
Optional	Owner date of birth; staff login names, dates of birth, phone numbers and emails Why: to verify identity and to give each staff member their own login and permissions Kept: same as required information
Identity verification	Result of the owner's mobile phone identity verification at sign-up (Korea only) — name, mobile number, date of birth and duplicate-registration information (DI) Why: to confirm the owner's identity and to check whether the same owner signs up more than once Kept: same as required information — we don't store the original DI, only an irreversibly transformed value. We don't receive connecting information (CI)
Automatic	Sign-in times, login history and activity logs Why: to prevent misuse and troubleshoot problems We store IP addresses only in security records (such as failed sign-ins, administrator sign-ins and data exports) to detect and respond to intrusions, and delete them automatically after 90 days. We don't store IP addresses for other visits.
Client record access log	A record of who viewed, added, edited, deleted or exported client information (account, time, client, action, IP address) Why: to keep access records for security and to check for misuse Kept: 1 year, then deleted automatically — as a legally required record, it is kept for 1 year even if the business deletes the client or the contract ends (client number only, no name)

2-2. Client Data (stored on behalf of the business)

Businesses may store the following. Each business is responsible for deciding what it collects, how long it keeps it, and for giving its clients any required notice and obtaining consent (including consent to receive text messages).

Clients	Name, phone number, date of birth, gender, service notes, photos (if the business uploads them), visit and service history, payments, prepaid balances and packages, tier, and referral or family links
Staff	Name, title, photo, work hours, time punches, days off, and service performance
Integrations	Booking details from connected booking channels (such as Reserve with Google) and caller phone numbers

3. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only:

with your consent or at your direction;
to the service providers listed in Section 4, who process it for us under contract; or
when required by law or valid legal process.

Sharing client information between locations in a multi-location group is off by default. It's only turned on when both the main location and each location turn on sharing in Settings. Because sharing between separate businesses may require client consent, please obtain it before turning sharing on.

4. Service providers and international transfers

Provider	What they do · data involved
Amazon Web Services, Inc. (AWS Lightsail · Seoul region)	Server hosting and daily backups · all data stored in the Service Storage location: Republic of Korea (Seoul) · Kept until the account is closed (backup files are deleted 14 days after they're made)
Supabase, Inc. (database · Seoul region)	Database storage · all data stored in the Service Storage location: Republic of Korea (Seoul) · Kept until the account is closed
Korea PortOne Co., Ltd. (PortOne · Korea)	Connecting card payments for subscription plans and mobile phone identity verification · order number, amount, owner's name, mobile number and email, verification result Kept: for the period required by law
KG Inicis Co., Ltd. (Korea)	Credit card payment processing · order number, amount, owner's name, mobile number and email (card numbers are handled directly in the payment window; we never receive or store them) Kept: for the period required by law (such as the Korean E-Commerce Act)
NHN KCP Corp. (mobile phone identity verification · Korea)	Owner's mobile phone identity verification at sign-up · name, date of birth, gender, mobile number, carrier Kept: according to the policies of NHN KCP and the identity verification agencies (mobile carriers) and applicable law
Cloudflare, Inc. (USA)	Domain name service (DNS) and secure connections · data you send and receive while using the Service passes through in encrypted form and is not stored. Location: the Cloudflare location nearest to you
OpenAI, L.L.C. (USA)	Only when you use AI insights, AI chat, AI message drafts or image generation with the OpenAI key you entered yourself in Settings > AI, the data needed for the analysis is sent to OpenAI. Sent: business name, client names, visit and service history, visit frequency, amounts, and birthday month and day (not year) Never sent: phone numbers, emails, addresses, service notes, photos or birth year — these are removed before sending. If you don't enter an OpenAI key, nothing is sent (only the Service's built-in analysis is used). You can remove your key at any time in Settings > AI.
Telegram FZ-LLC (United Arab Emirates · Telegram)	Operator notifications — when there is a new sign-up, a plan request or cancellation, a support request, an unpaid bill or a security warning, we are notified instantly in Telegram. Sent: business name, salon code, business type, business address, owner name, mobile number and email, the subject and part of a support request, remote support contact, and IP addresses in security warnings Never sent: client information entered by the business (client names, phone numbers, service records, etc.) or passwords Where · when · how: Telegram servers (outside your country) · each time such an event happens · encrypted over the internet Kept: until we delete the message in Telegram (we delete it once we have handled it) If you don't want this, please contact us. As these notices are needed to handle sign-ups and requests, opting out may delay our response.

The Service is operated from the Republic of Korea, and your information may be processed in countries other than the one where you live. We protect it as described in this policy wherever it's processed.

5. Retention and deletion

We delete personal information without delay once the retention period ends or it's no longer needed.
When a business deletes a client, that client's name and contact details are also removed from sales, appointments, prepaid balances, packages, message history, call history and on-screen alerts. The client record access log, however, is kept for 1 year by law with only the client number, then deleted automatically.
Account deletion: the business owner can request account deletion in the Service (More > Delete account or Settings > Plan) or at https://salonflow.co.kr/delete-account. 7 days after the request (you can cancel before then) we delete the business's data and all of its accounts. Payment and billing records (business name, registration number, owner name and contact, invoice amounts, dates and payment methods) are kept for 5 years under the Korean E-Commerce Act, and client-data access logs for 1 year, then deleted.
Electronic files are deleted in a way that can't be recovered.
Verification codes are deleted as soon as they're used or expire.

6. Your rights

You can access, correct or delete your account information at any time in Settings, or by contacting us. Depending on where you live (for example, California), you may have additional rights, such as the right to know what personal information we hold, to request deletion or correction, and not to be discriminated against for exercising these rights. We'll verify your request and respond within the time required by law.

If you're a client of a business that uses SalonFlow, please contact that business directly to access, correct or delete your information. We'll assist the business in responding.

To stop receiving text messages from a business, reply STOP to any message.

7. Security

Passwords are stored using a one-way hash (scrypt) with a unique random salt. Even we can't see your original password.
Access control — each business's data is fully separated. Staff can only see what the owner allows, and staff without phone-number permission see masked numbers.
Encryption in transit — the Service is only available over HTTPS.
Sign-in protection — sign-in attempts are limited and temporarily locked after repeated failures. Session cookies are HttpOnly, so scripts in the browser can't read them.
Data minimization — we collect only what's needed to provide the Service.

8. Children

The Service is intended for businesses and isn't directed to children under 16. We don't knowingly collect personal information from children for our own purposes.

9. Contact us

Company	Floneer (플로니어) · CEO: 백광현
Address	#304, 12 Samhaksa-ro 12-gil, Songpa-gu, Seoul, Republic of Korea
Privacy contact	백광현 · CEO
Phone	1551-5269 (within Korea)
Email	help@salonflow.co.kr

10. Changes to this policy

If we update this policy, we'll post the changes and the effective date in the Service in advance. For changes that are materially adverse to you, we'll give at least 30 days' notice.

← Back to SalonFlow