2026-09-06
This policy explains how [COMPANY NAME] ("we") handles personal data in the Salon Calendar service: the master's admin panel and the client booking widget.
Two groups of people are covered: beauty professionals who run a calendar (the “masters”), and their clients who book appointments.
For a master's own account data, we are the data controller.
For a salon's client data (people who book with that salon), the master is the controller and we act as a processor on the master's behalf. The master is responsible for informing their clients and for having a lawful basis to process their data.
From masters: email address, business name, hashed password, booking-page address, optional website and social links, working hours and booking rules.
From clients: name, phone number, optional email, an optional free-text note (e.g. allergies or preferences), and appointment history (service, date, time, price, status).
Technical data needed to run the service: request logs and, temporarily, the IP address used for abuse prevention (rate limiting).
To provide the service and manage the contract with the master (performance of a contract).
To let clients book and to let masters manage those bookings (the master's legitimate interest / performance of a contract between master and client; client consent is recorded at booking).
To keep the service secure and prevent abuse (legitimate interest).
We do not use tracking or advertising cookies.
The apps store a small amount of data in your browser for functional reasons only: your chosen interface language, and, in the admin panel, your login session token. This does not require consent.
Hosting and database providers located in the EU, acting as our sub-processors.
When online payment is enabled in future, a payment provider will process payment data. When email or SMS notifications are enabled in future, a messaging provider will process contact details for that purpose. This policy will be updated before those features go live.
We do not sell personal data.
Master account data is kept while the account is active and for a reasonable period afterwards, then deleted.
Client data is kept for as long as the master keeps it. A master can export or permanently delete any client's record at any time from the client's page.
Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing.
Clients: contact the salon you booked with first — they control your data. Masters and anyone unable to reach a salon can contact us.
Requests: [privacy@example.com]. You also have the right to complain to your local data protection authority.
Passwords are stored only as salted hashes. Traffic is served over HTTPS in production. Access to production data is limited to what is needed to operate the service.
We may update this policy. Material changes will be communicated through the service. The date above shows the last revision.
[COMPANY NAME], [privacy@example.com].