Privacy policy

Who we are

MySalon.me ("we", "our", "us") provides a salon management platform including website hosting, online booking, client management, and marketing tools. We are based in Montreal, Quebec, Canada. This policy explains how we collect, use, disclose, and safeguard personal information when you use our platform. References to "you" mean salon owners, staff, and visitors to salon sites hosted on our platform.

Information we collect

Account information: name, email address, salon name, billing details, and password when you create an account. Client data: when your clients book appointments or submit forms through your salon site, we store the information they provide on your behalf (name, contact details, appointment history, preferences, consent records). Usage data: page views, session duration, browser type, device information, and referring URLs collected automatically. Communication data: emails, support tickets, and survey responses you send us. Payment data: payment method, billing address, and transaction identifiers (full payment details are handled by Stripe and are not stored on our servers).

Legal bases for processing (GDPR)

If you are in the European Economic Area, we process your personal information under the following legal bases: Contract performance — to provide the platform services you have subscribed to. Legitimate interests — to improve our services, ensure platform security, and send service-related communications. Consent — where you have given explicit consent for marketing communications or cookie placement. Legal obligation — to comply with applicable laws and regulations. You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

How we use your information

We use your information to: operate and maintain your account and salon site; process bookings, payments, and appointment reminders; send service-related communications (confirmations, reminders, invoices); send marketing communications where consent has been given; improve and personalise the platform experience; detect, prevent, and address technical issues and fraud; comply with legal obligations; and generate anonymised aggregate analytics. Client data is processed only as necessary to provide the services you have configured for your salon. We never use client data for our own marketing or analytics without separate consent.

Data sharing and disclosure

We do not sell your personal information or your client data. We do not share personal information for cross-context behavioural advertising. We may share data with trusted third-party service providers who help us operate the platform, including: Supabase (cloud database and authentication), Stripe (payment processing), Resend (email delivery), Vercel (hosting infrastructure), and Upstash (caching and rate limiting). These providers are contractually bound by data processing agreements that require them to protect your data and use it only for the specified purposes. We may disclose information if required by law, court order, or governmental regulation, or to protect our rights, property, or safety.

International data transfers

Your information may be transferred to and processed in countries other than your own, including Canada and the United States. When we transfer data from the European Economic Area, the United Kingdom, or Switzerland, we rely on adequacy decisions, Standard Contractual Clauses, or other recognised transfer mechanisms approved by applicable authorities. For transfers from Canada, we rely on equivalent protection assessments as required by PIPEDA and Quebec Law 25.

Data retention

We retain your account information for as long as your account remains active. If you close your account, we will delete or anonymise your data within 90 days unless we are required by law to retain it (e.g., tax records). Client booking data is retained according to the retention period you configure in your salon settings, or until your account is terminated. Usage analytics data is retained for 26 months. Backup data is retained for 30 days and securely deleted thereafter.

Security

All data transmitted between your browser and our servers is encrypted using TLS 1.3. Data at rest is encrypted using AES-256. Our infrastructure is hosted in SOC 2-compliant data centres with physical access controls, 24/7 monitoring, and redundant power and connectivity. We perform regular security audits, vulnerability assessments, and penetration testing. Access to production data is restricted to authorised personnel through role-based access controls, multi-factor authentication, and audit logging. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

Your rights (GDPR, PIPEDA, Quebec Law 25, CCPA)

Depending on your jurisdiction, you may have the following rights: Right to access — request a copy of the personal information we hold about you. Right to rectification — request correction of inaccurate or incomplete information. Right to erasure — request deletion of your personal information, subject to legal retention requirements. Right to restrict processing — request that we limit how we use your information. Right to data portability — request a structured, machine-readable copy of your information. Right to object — object to processing based on legitimate interests or direct marketing. Right to withdraw consent — withdraw consent at any time where processing is based on consent. Right to non-discrimination (CCPA) — we will not discriminate against you for exercising your privacy rights. To exercise any of these rights, contact us at privacy@mysalon.me. We will respond within 30 days (or 45 days under Quebec Law 25). We may need to verify your identity before processing your request.

Cookies and similar technologies

We use cookies and similar tracking technologies to operate and improve the platform. Essential cookies are required for authentication, security, and platform functionality. Analytics cookies help us understand how the platform is used. Marketing cookies enable personalised content where you have consented. You can manage your cookie preferences through our cookie consent banner, which provides granular control over each category. Disabling certain cookies may affect platform functionality. For a detailed list of cookies we use, see the Cookie Table below.

Cookie table

Automated decision-making

We do not use your personal information for automated decision-making that produces legal or similarly significant effects. Booking waitlist matching uses automated logic to notify clients when slots open, but this does not constitute automated decision-making under applicable laws.

Do Not Track

Our platform does not currently respond to Do Not Track (DNT) signals. You may set your browser to send a DNT signal, but we process it in accordance with the cookie consent preferences you set through our banner.

Children's privacy

Our platform is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at privacy@mysalon.me and we will take steps to delete such information.

Data Protection Officer

We have appointed a Data Protection Officer who oversees our compliance with data protection laws. Our DPO can be reached at dpo@mysalon.me. For Quebec Law 25 matters, our designated Privacy Officer can be reached at the same address.

Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or operational considerations. Material changes will be communicated via email to account holders or through a notice on the platform at least 30 days before they take effect. Continued use of MySalon.me after changes take effect constitutes acceptance of the updated policy.

Contact

If you have questions, concerns, or complaints about this privacy policy or how your data is handled, please contact us at privacy@mysalon.me or write to: MySalon.me, Attn: Privacy Officer, 123 Rue de la Paix, Montreal, Quebec, H2X 1Y6, Canada. You also have the right to lodge a complaint with a supervisory authority in your jurisdiction, including the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your local EU data protection authority.