Legal
Privacy Policy
What we do with personal data, whether you are a client booking an appointment or a member of salon staff running a diary: what we collect, who can see it, how long we keep it, and the rights you have.
1. The short version
YourSalon is a booking app. Clients use it to book with a salon they choose; salons use it to run their diary. We collect what the app needs to do that and nothing more.
We do not sell personal data, we do not use it for advertising, and we do not track you across other apps or websites. A salon only ever sees the clients who book with it.
You can delete your account in the app at any time.
2. Who is responsible for your data
The app and the website at yoursalon.uk are operated by Brand It Midlands Ltd, trading as YourSalon, a company registered in England and Wales under number 17365031. Registered office: The Tint Factory, Melton Road, Queniborough, Leicester LE7 3FP. Information Commissioner's Office registration: [ICO registration number].
We are the data controller for the personal data you give us when you create and use a YourSalon account, whether you are a client or a member of salon staff.
Contact: privacy@yoursalon.uk
3. Clients and salons: who controls what
When you book, the salon needs your details to look after you. The salon you book with (its manager and the stylist you booked) receives your display name, phone number, email address, profile photo and any notes you add to the booking. From that moment the salon is an independent data controller for the details it holds about you as its customer, in the same way it would be if you had phoned to book. The salon decides how it uses those details within the law, and it must have its own privacy notice.
For anything a salon types into YourSalon about its clients, we act as the salon's data processor: we hold that information on the salon's behalf and on its instructions, under the Data Processing Agreement in our Salon Terms. If you want to know what a salon holds about you, or want it corrected or deleted, contact the salon. If the salon is unresponsive, contact us and we will help.
4. What we collect
Clients
- Account: email address, password (stored only as a salted hash by our authentication provider), and the one-time sign-in codes we email you.
- Profile: display name, phone number, and an optional profile photo.
- Preferences: your chosen salon and, if you pick one, your preferred stylist.
- Bookings: the salon, stylist, service, date, time and price, any notes you add for the salon, the booking status, and any cancellation or decline messages exchanged.
- Notifications: the in-app alerts about your bookings, and a push notification token for each device you allow notifications on.
Salon staff (managers and stylists)
- Account: email address, password hash and sign-in codes, as above.
- Your name and an optional photo, shown to clients when they pick a stylist.
- The salon's business details: business name, address, postcode and map coordinates, business phone number and contact email, and a salon photo.
- Your services and prices, working hours, holiday dates and message, booking settings, and the names and email addresses of staff you invite.
- The bookings you receive, with the client details described above, and any client you block.
Everyone
- Security records kept by our hosting provider when you sign in or use the app: the time of the request, your IP address and basic device information. We do not use these to profile you.
What we do not collect
- Your location. When you search for salons the app asks your device for your position, works out the distances on your phone, and never sends your position to us or anyone else. You can decline the permission and search still works.
- Payment card details. The app takes no payments today. Salon subscriptions, when they launch, are billed by Apple or Google under their own privacy policies; we would receive only your subscription status, never card numbers.
- Health information. Please do not put health details in booking notes unless the salon has asked you to. Anything you write in a note is shared with the salon.
5. Why we use it and our lawful basis
| What we do | Lawful basis |
|---|---|
| Create your account, show salons to clients, make and manage bookings, and send booking alerts by push notification and email | Performance of our contract with you (our Terms of Service) |
| Email you sign-in and password reset codes | Performance of our contract |
| Keep the service secure, prevent abuse and investigate problems | Our legitimate interest in running a safe service |
| Keep a record of past bookings for the salon and for you | Our legitimate interest, and the salon's, in keeping business and purchase records |
| Handle support requests and complaints | Performance of our contract and our legitimate interest in resolving them |
| Comply with the law, for example accounting rules once subscriptions launch, or a lawful request from a regulator or court | Legal obligation |
Where we rely on legitimate interests we have checked that they are not outweighed by your rights. You can ask us for details or object at any time (see Your rights).
We do not send marketing. If that ever changes, it will be opt-in and every message will have an unsubscribe link.
We make no decisions about you by automated means that have legal or similarly significant effects. A booking request that a salon does not answer may be declined automatically after a response time the salon has set; that is the salon's setting, not a judgement about you, and you can book again.
6. Who can see what
- Signed-in clients can see every active salon's business profile: name, address, postcode, business phone and email, photo, and the names, photos and services of its stylists. Salon business details are not private.
- A salon sees only the clients who have booked with it, and only the details on those bookings. Salons cannot browse other clients, and clients cannot see each other. These limits are enforced in the database, not just in the app.
- A salon's manager can see every booking in the salon; a stylist sees only their own diary.
- Profile photos are stored on a public link so the app can show them without a sign-in. The links are not listed anywhere and are not guessable, but anyone who has a link can open it. Do not upload a photo you would not be comfortable sharing.
7. Our service providers
We use a small number of providers to run the app. They may only use your data to provide their service to us, and each is bound by a data processing agreement.
| Provider | What for |
|---|---|
| Supabase, Inc. (USA) | Our database, authentication, file storage, serverless functions and logs. Your data is stored in Amazon Web Services' London region (eu-west-2), in the United Kingdom. |
| Resend, Inc. (USA) | Sends our emails, including booking confirmations and updates and sign-in codes. Receives your email address, names and booking details. |
| Expo (650 Industries, Inc., USA) | Relays push notifications to your device. Receives your device's push token and the text of each alert, which can include names and service names. |
| Apple Inc. and Google LLC | Deliver push notifications to iPhones and Android devices, distribute the app, and will bill salon subscriptions. |
| Ideal Postcodes Ltd (postcodes.io, UK) | Converts a salon's business postcode into map coordinates. It receives the postcode only, never anything about clients. |
When you tap Get Directions the app opens the salon's address in your device's maps app, which is governed by that app's privacy policy.
We do not yet use analytics, crash reporting, payment processing or social sign-in providers. Before we add any, we will update this policy and, where the law requires, ask for your consent.
We may also disclose personal data where the law requires it, to our professional advisers under confidentiality, and to a buyer if our business is sold, with notice to you.
8. Where your data is stored
Your data is stored in the United Kingdom. Some of our providers are based in the United States and may access data from there, for example when giving us technical support or when relaying an email or push notification. Those transfers are protected by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with each provider's security commitments. You can ask us for a copy of the safeguards.
9. How long we keep it
| Data | Kept for |
|---|---|
| Your account, profile, preferences and settings | For as long as your account exists |
| Bookings | On the salon's side, 6 years after the appointment date, the period UK tax and accounting rules expect businesses to keep records, then deleted automatically. On your side, for as long as your account exists. |
| In-app notifications | 12 months, then deleted automatically |
| Push notification tokens | Until you sign out, delete your account, or the device stops responding, and in any case after 180 days without use |
| Support emails | 2 years from the last message |
| Security and access logs held by our hosting provider | Up to 7 days for request logs; sign-in records for the life of your account |
| Backups | Overwritten on a rolling cycle, normally within 30 days |
10. Deleting your account
Clients: Account, then Delete account. Salon staff: Settings, My account, then Delete account. A salon manager deletes the whole salon under Settings, Salon profile, Delete salon account, after removing any other staff from the Team screen. The app tells you what will be removed before you confirm.
When a client deletes their account we delete the profile, preferences, notifications, push tokens and photos, and we remove your name, contact details, photo and notes from every booking. The salon keeps only the service, date, time and price, like a line on an invoice, so its records still add up.
When a member of staff deletes their account we delete their login, photo and email address. Their name stays on the salon's past bookings as the salon's business record.
When a manager deletes a salon, the salon, its team, services, settings and blocked list are deleted. Clients keep their own booking history, showing the service, date and price.
Deleting your account does not cancel an app-store subscription; do that in your Apple or Google account settings. If you cannot get into the app, email privacy@yoursalon.uk from your registered address and we will delete it for you.
11. Keeping it safe
Data is encrypted in transit (TLS) and at rest. Passwords are never stored in plain text. Access to data is restricted row by row in the database so that each person can only reach what the app allows them to see. Server-to-server calls are signed with secrets held in a vault. Only the people who need access to run the service have it, protected by multi-factor authentication. Our providers hold recognised security certifications (Supabase is SOC 2 Type 2 audited).
No system is completely secure. If we discover a breach that is likely to put you at risk, we will tell you without undue delay and notify the Information Commissioner's Office within 72 hours where the law requires it.
12. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected. You can edit your profile in the app at any time.
- Have your data erased where there is no good reason for us to keep it. Deleting your account in the app does this as described above.
- Restrict or object to processing that relies on our legitimate interests.
- Receive the data you gave us in a portable, machine-readable format.
- Withdraw any consent you have given, for example by turning off notifications in your device settings.
Email privacy@yoursalon.uk. We may need to confirm your identity. We respond within one month and do not charge, unless a request is manifestly unfounded or excessive. For details a salon holds about you as its customer, contact the salon.
13. Children
You must be 18 or over to hold a YourSalon account. Appointments for children are booked by a parent or guardian from their own account. We do not knowingly collect personal data from anyone under 18; if you believe we have, email privacy@yoursalon.uk and we will delete it.
14. Changes to this policy
The version number and date at the top tell you which version you are reading. If we make a material change, we will tell you in the app before it takes effect.
15. Complaints
Email privacy@yoursalon.uk and we will acknowledge your complaint and tell you how we will resolve it. You also have the right to complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; 0303 123 1113; ico.org.uk/make-a-complaint.
Post: Brand It Midlands Ltd (YourSalon), The Tint Factory, Melton Road, Queniborough, Leicester LE7 3FP.