1. Scope and duration
This DPA forms part of the agreement between the salon/customer and Salon Revenue AI FZE where Salon Revenue AI processes personal data on the salon's behalf. The salon is Controller for salon-controlled client, staff and operational data and Salon Revenue AI is Processor. Processing lasts for the enabled service plus documented retention/deletion periods.
2. Documented instructions and purpose
Salon Revenue AI processes salon-controlled data only on documented service instructions, to provide, secure and support the enabled functions, and as required by applicable law. We do not independently repurpose salon CRM, client or staff data for unrelated advertising or general-model training.
3. Data and people covered
Data may include account details, staff records, client CRM data, appointments, services, prices, messaging, integration identifiers, AI inputs/outputs, migration records, Recovery evidence and operational audit/security records. Data subjects may include salon owners, authorized users, staff, clients and prospective clients.
4. Confidentiality and access
Access is limited to authorized personnel and systems with a business need. Support access should be scoped, time-limited where feasible and auditable. Secrets and production customer data must not be exposed in ordinary logs, CI evidence or public storage.
5. Security
Salon Revenue AI maintains reasonable safeguards appropriate to the service, including tenant/Location isolation, least privilege, authentication/session controls, auditability, idempotency/concurrency controls where relevant, secure development checks, private storage controls and incident handling.
6. Subprocessors and international processing
The current list of active subprocessors is published at /subprocessors. A planned provider is not described as active before relevant production data flows through it. Processing may occur outside the UAE depending on the active provider/configuration; we do not promise UAE-only residency unless verified for every relevant flow.
7. Data-subject requests
Where the salon is Controller, the salon normally receives and decides requests from its clients or staff. Salon Revenue AI will provide reasonable assistance with access, correction, deletion, restriction or export requests where technically and legally applicable.
8. Security incidents
Salon Revenue AI will maintain an incident-handling process and notify the salon without undue delay after becoming aware of a confirmed personal-data breach affecting salon-controlled data where notification is required under the agreement or applicable law. Information will be provided as reasonably available, without delaying containment merely to complete a report.
9. DPIA and regulatory assistance
Taking into account the nature of processing and information reasonably available to Salon Revenue AI, we will provide reasonable assistance with legally required data-protection impact assessments, regulator consultations and privacy/security enquiries that relate to the services we process for the salon.
10. Accountability and audit cooperation
We will maintain appropriate records and evidence of material processor safeguards and, subject to confidentiality, security and reasonable scope controls, provide information reasonably necessary to demonstrate compliance with this DPA. Audit cooperation must not expose other tenants, secrets or unrelated confidential information.
11. Deletion and return
At account closure, current policy provides a 60-day read-only/export recovery window followed by ordinary operational deletion or irreversible anonymization, except for justified financial, audit, security, legal-hold or other lawful retention. Specific temporary artifacts have shorter limits described in the Privacy Policy.
12. Contact
Data-protection questions can be sent to support@salonrevenue.ai.