Privacy policy

LoSalon sells booking sites to salons and studios. That puts us in two positions at once, and which one applies decides who answers to you.

For the account of a salon that signs up with us, we are the controller: we decide what we collect and why. That is what this page is about.

For the appointment a client books on a salon's own site, the salon is the controller and we only store and transmit the data on its instructions. Those bookings are covered by that salon's own privacy notice, linked in the footer of its site — if you booked an appointment, that is the page you want.

To create an account: an email address and a password. Passwords are stored hashed by our authentication provider; we never see them.

To run your site: the business name, subdomain, contact details, opening hours, services, prices, photos and page copy you enter — plus the appointments your clients book.

To bill you: your subscription status and invoice history. Card details go straight to Stripe and never reach our servers.

We keep ordinary server logs (IP address, request time, browser) for security and debugging.

Almost all of it is needed to provide the service you signed up for — GDPR Art. 6(1)(b), performance of a contract.

Server logs and abuse prevention rest on our legitimate interest in keeping the service running and secure (Art. 6(1)(f)).

Invoices and payment records are kept because tax and accounting law requires it (Art. 6(1)(c)).

We do not use your data to train models, we do not profile you, and we send no marketing you did not ask for.

Only the providers we need to run the product, each acting on our instructions under a data-processing agreement: Vercel (hosting), Supabase (database, authentication and image storage), Stripe (subscription payments and invoices) and Resend (transactional email).

If you use the optional AI assistant in the dashboard, the questions you ask and the site data needed to answer them are sent to Anthropic, our AI provider. Do not paste anything into it you would not want processed that way.

Some of these providers operate outside the EEA. Transfers rely on the European Commission's standard contractual clauses.

We do not sell your data and we do not share it with advertisers.

Account and site data is kept while your account exists. Delete a site and its content goes with it; close your account and we remove the rest.

Invoices and payment records are kept for as long as accounting law requires, which is longer than the account itself.

Server logs are short-lived.

Under the GDPR you can ask, free of charge, to see the data we hold about you, to have it corrected, to have it deleted, to restrict or object to how it is used, to receive a copy in a portable format, and to withdraw any consent you gave.

Write to official@losalon.com and we will answer within one month.

If you believe we have mishandled your data you can complain to your national data-protection authority. In Romania that is ANSPDCP (dataprotection.ro).

We set no advertising or analytics cookies. The only cookies we use are the ones the product cannot work without: the session cookie that keeps you signed in, and a cookie remembering your language choice.

If this policy changes, the updated version appears on this page with a new date.