Privacy Policy

1. Our role: controller and processor

Our responsibilities depend on whose data is involved:

• For a Professional’s own account data (and for our own operational and product-improvement purposes), we act as the business responsible for that data — the “controller” or “business” under applicable privacy laws.
• For an End Client’s data that a Professional enters or collects through the Services (such as a customer profile or appointment history), the Professional is the controller and we act as a “processor” or “service provider” on their behalf, as described in our Data Processing Addendum. If you are an End Client and want this data corrected or deleted, contact the salon you did business with; we will help them honour your request.

2. Information we collect

a. Information you provide directly

• Account information — name, email address, phone number, and password when you create an account.
• Business information (Professionals) — salon name, address, phone, business hours, services, durations, pricing, cancellation rules, staff details, and portfolio photos or videos.
• End Client and booking data — names, contact details, appointment history, notes, and preferences for the customers of a salon, entered by the salon and its staff or provided by End Clients when they book.
• Customer-portal data — if an End Client creates a login to view their appointments, the information needed to authenticate and serve that portal.
• Payment information — billing details for Professional subscriptions, and the payment details End Clients use to pay a salon, collected and processed by our payment processor (Stripe). We do not store full payment-card numbers.
• Content you submit — website-builder content, uploads, support messages, and anything else you choose to provide.

b. Information from other sources

• Payment processor — Stripe provides us with limited transaction and payment-status information (for example, authorization results and the last four digits of a card), but not full card numbers.
• Connected accounts — if a Professional connects an Instagram account, we receive data from that integration as described in Section 3.
• Fraud-prevention and verification sources — we may receive information to help verify identity and protect against fraud and abuse.

c. Information collected automatically

• Device and usage data — IP address, browser and device type, operating system, referring and exit pages, pages viewed, access times, and similar log data.
• Cookies and similar technologies — we and our providers use cookies and similar technologies as described in Section 6.

d. Information we infer

We may derive limited inferences from the information above — for example, an approximate city from an IP address — to operate, secure, and improve the Services.

3. Instagram data

When a Professional connects an Instagram account to SalonHub360, we use the Instagram Graph API to read the Instagram username and user ID and to cache up to 12 of the most recent public posts (image URLs, video thumbnails, captions, and permalink URLs) to display the feed on the salon’s public website.

We do not post to the account, read messages, or access any data beyond what is listed above. The access token is encrypted at rest. Cached post data is refreshed periodically and is deleted when the account is disconnected (Website Builder → Social Feed → Disconnect) or the SalonHub360 account is deleted. You can also request deletion of Instagram data by emailing support@salonhub360.com.

4. How we use information

• To provide, operate, maintain, and secure the Services.
• To enable Professionals to manage bookings, customers, services, staff, marketing, and their public salon website.
• To facilitate appointments and transactions between Professionals and End Clients.
• To process subscription payments and detect and prevent fraud.
• To send service-related communications (such as account, booking, and billing notices) and, where permitted, promotional messages.
• To respond to support requests and verify identity.
• To analyze, troubleshoot, and improve the Services and develop new features.
• To comply with legal obligations and enforce our Terms.

5. Email and text-message communications

We may contact you by email, text message (SMS/MMS), and push or in-app notification. Service-related messages (about your account, bookings, and billing) are part of using the Services. Promotional messages are optional, and you can opt out at any time by following the unsubscribe instructions in the message or contacting us; you may still receive essential service messages. Standard message and data rates may apply.

If a Professional uses the Services to message their own End Clients (for example, appointment reminders or marketing), the Professional is responsible for obtaining the consent required by law — including the Telephone Consumer Protection Act (TCPA) and CAN-SPAM — and for honouring opt-out requests, as described in our Terms. We do not sell or share text-messaging consent or opt-in data with third parties for their own marketing.

6. Cookies, analytics, and tracking

We use cookies and similar technologies that are necessary for authentication and to keep the Services working, and we may use limited analytics to understand and improve how the Services are used. We do not use third-party advertising cookies, and we do not sell your data or share it for cross-context behavioural (“targeted”) advertising. You can control cookies through your browser settings and we honour legally recognized opt-out preference signals (such as Global Privacy Control) where required; disabling essential cookies may break parts of the Services.

7. Payment data

Payments — both Professional subscriptions and payments End Clients make to a salon — are processed by our third-party payment processor (Stripe). Stripe collects and handles full payment-card details under its own terms and privacy policy. We receive only limited payment information, such as authorization results and a truncated card identifier, and we do not store full card numbers. Your use of payment features is also subject to Stripe’s terms.

8. When we share information

We do not sell your personal information. We share it only as described here:

• With the salon you interact with — if you are an End Client, the information you provide when booking or transacting is shared with the Professional you booked, who uses it to provide their services and is responsible for it as the controller.
• Service providers — companies that help us run the Services, such as hosting (Vercel), our database (Railway), payment processing (Stripe), and messaging and email providers, under contracts that limit how they may use the data.
• Affiliates — companies under common ownership with us, for the purposes described in this Policy.
• Legal and safety — when required by law, legal process, or government request, or to protect the rights, property, or safety of our users, the public, or us, including to investigate fraud or enforce our Terms.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• Professional advisors — legal, accounting, insurance, and similar advisors, as needed to run and protect our business.
• Aggregated or de-identified information — information that cannot reasonably be used to identify you.

9. AI features

Some features may use artificial-intelligence tools to help generate content (such as website copy or marketing text) from inputs you provide. These tools may rely on third-party providers who process your inputs and outputs to deliver the feature. We do not use End Clients’ personal information to train third-party AI models, and you are responsible for reviewing any AI-generated content before using it, as described in our Terms.

10. Website-builder content is public

Content a Professional publishes through the website builder — such as business details, services, prices, photos, and a connected Instagram feed — is displayed on a public salon website and is intended to be seen by anyone. Do not publish information you do not want to be public, and do not include another person’s personal information without their permission.

11. Your choices

• Account information — review and update it by signing in to your account.
• Promotional messages — opt out using the unsubscribe link or message instructions; service messages continue.
• Cookies — control them through your browser; disabling essential cookies may affect functionality.
• Notifications — manage push and device notifications in your device settings.

12. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, email us at support@salonhub360.com. We will not discriminate against you for exercising your rights.

U.S. state residents (including California). If you live in a U.S. state with a comprehensive privacy law, you may have additional rights to:

• Know and access the personal information we hold about you, and how we use and share it.
• Request correction or deletion of your personal information.
• Obtain a portable copy of your personal information.
• Opt out of the “sale” or “sharing” of personal information and of targeted advertising — note that we do not sell or share your personal information in this way.
• Limit the use of sensitive personal information.
• Appeal a decision we make about your request, and not be discriminated against for exercising any right.

We may need to verify your identity before responding, and you may use an authorised agent (with proof of authorisation) where the law allows. If you are an End Client whose data a salon entered, we may direct your request to that salon, who is responsible for it as the controller. If we deny a request, you may appeal by replying to our response, and you may also contact your state attorney general.

13. Health and beauty-service information

The Services are not intended to store sensitive health information. Some states regulate “consumer health data,” which can include information that identifies a person’s past, present, or future physical or mental health. Professionals are responsible for determining whether information they collect qualifies as consumer health data or protected health information and for complying with the laws that apply, and they should not enter such information into free-text fields such as appointment notes. As described in our Terms, the Services are not configured for protected health information under HIPAA unless we have agreed otherwise in writing.

14. Children’s privacy

The Services are intended for businesses and adults and are not directed to children. You must be at least 18 to create an account. We do not knowingly collect personal information from children under 13 (or the minimum age in your jurisdiction). If you believe a child has provided us with personal information, contact us at support@salonhub360.com and we will delete it.

15. Data retention

We retain personal information for as long as your account is active or as needed to provide the Services. When an account is closed, we delete or de-identify the associated data within a reasonable period, except where we are permitted or required to retain it for legal, tax, financial-compliance, dispute-resolution, or fraud-prevention purposes. Instagram data (cached feed and tokens) is deleted immediately when the Instagram account is disconnected. End Client data that a Professional controls is retained according to that Professional’s instructions and our agreement with them.

16. Security

We use industry-standard security measures, including HTTPS, encrypted token storage, and access controls, to protect personal information. No method of transmission or storage is completely secure; we encourage you to use a strong password and to contact us immediately if you suspect unauthorised access to your account.

17. U.S. operations

SalonHub360 is operated from the United States by an Oregon-based business, and the Services are intended for use within the United States. We store and process information in the United States. If you access the Services from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your country.

18. Links to other sites

The Services and salon websites may link to third-party sites and services (such as Instagram or a payment provider). We are not responsible for the privacy practices of those third parties; we encourage you to review their privacy policies.

19. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or the law. Material changes will be communicated by email or a notice in the Services, and we will update the “Last updated” date above. Continued use of the Services after changes take effect constitutes acceptance of the revised Policy.

20. Contact

Questions or requests about this Privacy Policy? Email us at support@salonhub360.com.