Privacy Policy

Salonoid ("Salonoid," "we," "us," or "our") provides online booking, team scheduling, and payment tools for beauty salons and barber shops. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit salonoid.com, use app.salonoid.com, embed or interact with our booking widgets, or otherwise use our services (collectively, the "Services").

By using the Services, you acknowledge the practices described in this Policy. If you do not agree, please do not use the Services.

Salonoid is a multi-tenant platform. How privacy responsibility is allocated depends on how you use the Services:

• Platform accounts: When you create an account as a business owner, team member (provider), or customer on Salonoid, we act as a controller of that account information.
• Salon client data: When a salon or barber shop collects client details through bookings, intake forms, or the booking widget, that business typically decides why and how client data is processed for its appointments. In that case, the business is the controller and Salonoid processes data on its behalf to provide the Services.
• Payments: Platform subscription billing and client payments are processed by Stripe. Stripe’s privacy practices apply to payment card data handled by Stripe.

If you are a salon or barber shop using Salonoid, you are responsible for providing your clients with any notices required by law about how you use their information, and for collecting only what you need for appointments and your business. Intake questions are written by each business: you decide what to ask (including whether any questions are health-related), you are responsible for having a lawful basis and any required consents for what you collect, and Salonoid processes the answers solely on your behalf to provide the Services.

Salonoid operates as a B2B SaaS platform for beauty salons, spas, and barbershops. We describe the technical and organizational measures we use to help protect personal information in Section 10 of this Policy. We do not currently hold third-party security certifications (such as SOC 2 or ISO 27001), and this Policy does not promise specific uptime levels.

We may collect the following categories of information:

• Account and profile data: name, email address, password or authentication credentials, role (owner, provider, or customer), organization membership, and profile settings.
• Business and shop data: salon or barber shop name, location details, services, schedules, chairs/workstations, team invitations, and branding used in booking experiences.
• Booking and client data: appointment details, service selections, client name and contact information, notes, intake form responses, and related communications needed to run bookings.
• Payment and billing data: subscription plan, seat counts, billing status, invoices, and Connect onboarding status. Payment card numbers are handled by Stripe; we do not store full card numbers on our servers.
• Technical and usage data: session records (including IP address and browser information) kept for security and troubleshooting, pages viewed on our marketing pages, referring URLs, and diagnostic logs needed to operate and secure the Services.
• Communications: messages you send to us (for example support requests) and transactional emails we send about accounts, invitations, bookings, or billing.

We collect information:

• Directly from you when you sign up, update settings, book appointments, invite teammates, or contact us.
• From salon businesses when they enter or import client and booking information, or when clients book through a salon’s widget or booking flow.
• Automatically through cookies, local storage, and similar technologies needed for authentication, security, preferences (such as theme), and basic product operation.
• From service providers such as Stripe (payments and Connect) and our hosting, database, and email infrastructure providers when they process data to deliver the Services.

We use personal information to:

• Provide, maintain, and improve the Services, including booking, scheduling, intake forms, notifications, and organization administration.
• Authenticate users, manage sessions, and protect accounts against unauthorized access, fraud, and abuse.
• Process platform subscriptions and seat changes, and enable client payment flows through Stripe Connect for participating businesses.
• Send transactional messages (invitations, booking confirmations, intake links, billing notices, and security alerts).
• Communicate product updates or service-related announcements where permitted by law; you may opt out of non-essential marketing emails.
• Analyze aggregate usage to improve reliability and features, and to generate operational metrics (for example booking activity shown on marketing pages in anonymized or aggregated form where applicable).
• Comply with legal obligations, enforce our Terms, and resolve disputes.

We do not sell personal information. We may share information in these circumstances:

• With your organization: Owners and authorized team members can access booking, client, and team data within their salon or barber shop workspace as needed to operate the business.
• With service providers: Stripe (billing, payouts, Connect onboarding, and payment processing), Resend (email delivery), Cloudflare R2 (file storage), Hostinger (the infrastructure our systems run on), and — only where you have consented — Google and Meta for analytics and advertising measurement. Each processes data under contractual obligations to protect it.
• For legal and safety reasons: When required by law, regulation, legal process, or to protect the rights, safety, or property of Salonoid, our users, or the public.
• Business transfers: In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and continuity of privacy protections.
• With your direction: When you or your salon authorize sharing (for example embedding a booking widget on your website).

We use essential cookies and similar technologies to keep you signed in, maintain session security across salonoid.com and app.salonoid.com where configured, remember preferences such as theme, and operate the Services. Because these technologies are required for core functionality, the Services may not work correctly if they are blocked.

With your consent, we also use optional analytics and marketing cookies on our public pages (not inside the salon app, admin, or booking widgets) to understand how salonoid.com is used and to measure the performance of our own advertising:

• Analytics (Google Analytics 4): page views, approximate location, device, and referral information, used to improve our marketing site. Handled under Google's contractual data-processing terms.
• Marketing (Meta Pixel and Conversions API): conversion events such as sign-ups and newsletter subscriptions, used to measure and optimize our Facebook and Instagram campaigns.
• Measurement infrastructure: these requests pass through our own first-party subdomain (analytics.salonoid.com) so the data is collected under our control rather than loaded from third-party servers.
• Your choice: the cookie banner on our public pages lets you accept or decline optional analytics and marketing cookies. Essential cookies are always active. Declining never limits Salonoid's product features.

You can change your choice at any time by clearing your browser cookies for salonoid.com, which re-shows the banner on your next visit. Where required by law (for example in the EEA/UK), optional cookies only load after you opt in.

We retain personal information only for as long as needed to provide the Services, fulfill the purposes described in this Policy, meet legal, tax, and accounting requirements, resolve disputes, and enforce our agreements. We do not run fixed deletion schedules: what we keep, and for how long, is driven by these purposes and by the deletion requests described below.

Account data: You may request deletion of your account and personal information at any time by contacting us (Section 16). We will remove your personal information from active systems and confirm when the deletion is complete. Where a specific record cannot be deleted because we must keep it for legal, billing, tax, fraud-prevention, or dispute-resolution purposes (for example basic billing records), we will tell you which records we kept and why, keep only the minimum required, and stop using them for any other purpose. Where a business record must be kept but your identity does not need to be part of it, we may instead anonymize the personal information (for example removing name and contact details) so it no longer identifies you.

Client booking data: Client records are controlled by the salon or barber shop that collected them and are retained according to that business’s instructions and applicable record-keeping rules. Salons may request deletion of their workspace data by contacting us, and clients may ask us or the salon to delete their client records.

Backups: We maintain backups for recovery purposes. Deletions are reflected in backup copies when those backups are replaced during normal rotation.

Third parties: Where applicable, we use commercially reasonable efforts to forward deletion requests to service providers. Those providers process data under their own contracts, and their retention practices govern data they process on our behalf.

Legal holds: We may retain information for longer than this Policy would otherwise allow where required by law, regulation, or legal process, or where necessary to establish, exercise, or defend legal claims.

The Services do not currently include AI-assisted features that transmit your data to third-party AI providers. If we introduce such features, we will update this Policy and identify the categories of providers involved before the features become available.

Any future AI-assisted features would rely on independent third-party AI providers whose use, retention, storage, and security practices are governed by their own terms and privacy policies, not ours. We do not control and cannot guarantee how such providers handle data transmitted to them, and Salonoid is not liable for their acts or omissions.

We implement administrative, technical, and organizational measures designed to protect personal information appropriate to our systems, including: encrypted transport (HTTPS); role-based access controls with organization- and location-level permissions; audit logging of sensitive actions; server-side validation of payment amounts and deployment configuration; and separation between production and development environments. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for safeguarding your credentials and for configuring your organization (including teammate access) appropriately. We recommend using strong passwords, enabling MFA when available, and regularly reviewing access permissions.

While we take reasonable measures to protect personal information, no method of transmission or storage is completely secure. To the maximum extent permitted by law, Salonoid and its developers are not liable for any loss, corruption, or damage of or to data arising from the use of the Services, and Salonoid’s total liability for any privacy- or security-related claim is limited to the platform subscription fees you paid for your current monthly billing cycle at the time the claim arose. This limitation is in addition to, and consistent with, the Limitation of Liability in our Terms of Service, and does not affect rights that cannot be waived under applicable law.

We store personal information on infrastructure we operate in the United States. Our service providers (Stripe, Resend, Cloudflare, and — with your consent — Google and Meta) may process data in the United States and other countries under their own transfer practices. If you access the Services from outside the United States, your information is transferred to and stored in the United States.

Depending on where you live, you may have rights to access, correct, delete, or export personal information; to object to or restrict certain processing; and to withdraw consent where processing is based on consent. You may also have the right to appeal a decision or lodge a complaint with a supervisory authority.

To exercise rights related to your Salonoid account, contact us at the email below. If your request concerns data a salon collected about you as a client (for example an appointment booked at a specific shop), we may direct you to that business, or work with them, because they often control that client relationship.

We will not discriminate against you for exercising privacy rights available under applicable law. We may need to verify your identity before fulfilling a request.

To exercise these rights, email [email protected] (see Section 16). We will respond within 30 days and confirm when a deletion request has been completed. Where we process data on behalf of a salon — for example booking and intake records — we will work with that business to fulfill your request where we are able.

The Services are intended for business users and adults booking salon or barber services. We do not knowingly collect personal information from children under 13 (or under 16 where that higher age applies). If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

Booking widgets and links may appear on third-party salon websites. Those sites have their own privacy practices. Payment pages and Connect onboarding may be hosted or branded by Stripe. We are not responsible for third-party privacy practices outside our Services.

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the effective date. Material changes may also be communicated by email or in-product notice where appropriate. Continued use of the Services after an update means you acknowledge the revised Policy.

For privacy questions or requests, email [email protected]. For general product support, email [email protected].

If you are a salon or barber shop customer with questions about how a specific business uses your appointment data, please also contact that business directly.