Privacy Policy

2. Our privacy roles

For salon-controlled client, staff, appointment, service, messaging and operational data, the salon normally acts as Controller and Salon Revenue AI acts as Processor, processing that data to provide the salon-selected service. For our own account administration, SaaS billing facts, security, anti-abuse, platform administration and support records, Salon Revenue AI may act as Controller as applicable.

3. Data we may process

• Salon owner and account information.
• Staff profiles, bookability, services, working configuration and operational permissions.
• Client CRM information supplied or collected for salon operations.
• Appointments, services, prices, booking and calendar information.
• Instagram and WhatsApp integration identifiers and messages when a salon connects those channels.
• Membership, package, billing, entitlement and subscription facts where the relevant feature is active.
• Revenue Recovery case, outreach, booking and VERIFIED revenue evidence.
• AI inputs and outputs used to provide enabled AI features.
• Migration files and reconciliation records when a salon imports data.
• Security, audit, IP/device and anti-abuse records.
• Support communications.
• Analytics only when an analytics product is actually activated under the applicable privacy and security gate.

4. Why we process data

We process data to provide salon management, booking, CRM, messaging, migration, Revenue Recovery, AI, billing, support, security, fraud prevention, auditing and legally required administration. We do not sell salon client or staff personal data. We do not build third-party advertising profiles from salon client data.

5. AI and training

Salon Revenue AI does not use salon client, staff or message content to train public or general-purpose AI models. First-party training on identifiable customer content is not enabled by default. Where an AI provider is used, only the minimum context needed for the enabled function should be sent, subject to the active production configuration.

6. Meta, Instagram and WhatsApp data

If a salon connects a Meta channel, we may process account identifiers, integration state, messages, delivery/status information and other Platform Data needed for the requested integration. We process Platform Data only for the disclosed service purpose, security, support and compliance. Users have a clearly accessible deletion path below.

Meta-specific deletion or deauthorization is not the same as closing the entire Salon Revenue AI business account.

7. Data sharing and subprocessors

We use service providers only as needed to operate the platform and apply contractual, security and access controls appropriate to their role. The current public list is available at /subprocessors. Planned providers are not represented as active subprocessors before production data actually flows through them.

8. International processing

Some providers may process or store data outside the UAE. We do not claim UAE-only data residency unless it is verified for every active provider and relevant data flow.

9. Retention

• Successful raw migration file: delete within 24 hours after successful reconciliation.
• Failed, cancelled or abandoned raw migration file: delete within 7 days maximum.
• Owner export artifact: private and available for no more than 24 hours.
• After account closure: 60 calendar days of read-only/export recovery access, then ordinary operational data is deleted or irreversibly anonymized, except where financial, audit, security, legal hold or other lawful retention remains justified.
• Expired unpaid trial recovery window: 30 days under the current product policy.
• Messages and AI conversations are not retained indefinitely; a final production retention period will not be invented before the production retention matrix is approved and implemented.

10. Security

We use reasonable technical and organizational safeguards designed for the sensitivity and purpose of the data, including tenant/Location isolation, least privilege, audit controls and security testing. No online service can guarantee absolute security. Security reports can be sent through our security contact page.

11. Your rights and deletion

To request access, correction, export, restriction or deletion where applicable, email support@salonrevenue.ai. You do not need to pay a fee just to submit a deletion request. We may need enough non-secret information to identify the relevant salon/account and protect other users from unauthorized requests. Do not send passwords, OTPs or API keys.

For Meta/Instagram deletion, see Data Deletion Instructions.

12. Children and sensitive data

The product is not designed as a medical-record system and salons should not use it to collect diagnoses, medical records, identity documents, biometrics or excessive sensitive information. For under-13 booking flows where age routing is necessary, the design is guardian-first and should avoid unnecessary date-of-birth collection or child profiling.

13. Essential cookies and local preferences

The authenticated service uses a strictly necessary first-party session cookie to maintain the secure server-managed session. The public/app interface may store non-sensitive preferences such as theme, language or a displayed billing market in browser storage. These preference values are not authorization and do not replace server-side account, role, Location or billing truth. Non-essential analytics or replay cookies are not enabled merely because analytics tooling is planned.

14. Payments boundary

At launch, Salon Revenue AI charges salons for its own SaaS and eligible Revenue Recovery fees. Salon Revenue AI does not receive, hold, escrow or settle salon-client service payments. POS/payment-method fields may record operational facts, while the salon remains responsible for collecting client money through its own external payment method or provider.

15. Changes

We may update this policy as the product, providers or legal requirements change. The current version and effective date are shown at the top. Material changes will be published before they are relied on for new processing where required.