Privacy Policy

1. Who is responsible for which data

KBSalonBook holds two different kinds of personal data, and our role is different for each. This matters, because it decides who you should ask when you want something done with your data.

• Account data — we are the controller. This is the data of the salon owners and the clients who create a KBSalonBook login: names, emails, phone numbers, passwords, subscription status. We decide how it is used, and this policy governs it.
• Salon client records — the salon is the controller, we are the processor. When a salon stores its clients' details, appointments and notes in KBSalonBook, the salon decides what to collect and why. We only process it on their behalf, to run the software. See section 6.

So if you are a salon's client and want your record corrected or deleted, ask the salon first. If you cannot reach them, contact us and we will help.

2. What we collect

If you are a salon owner: your name and email, a securely hashed password (if you did not sign in with Google), your salon settings (salon name, opening hours, lunch break, time zone, services, your public booking-page address), your subscription status and add-ons, and the customer and subscription identifiers that Paddle gives us. We never receive or store your card number.

If you are a client with a KBSalonBook login: your name, email, phone number, and either a securely hashed password or your Google account identifier, plus the bookings linked to your account.

Client records held by a salon: name, phone number, email, birthday (if the salon records it), free-text notes the salon writes, appointment history, waiting-list preferences, and a log of messages sent to that client. The salon decides what goes in here.

Technical data: we keep server logs (IP address, browser, time and page requested) for security and debugging, and we store a session cookie so you stay signed in.

We do not knowingly collect special-category data (such as health information). Please do not put it in the free-text notes.

3. Why we use it, and our legal basis

• To provide the service — creating your account, showing your calendar, taking bookings, storing client records. Legal basis: performance of a contract.
• To take payment — subscriptions and add-ons through Paddle. Legal basis: performance of a contract, and legal obligation for tax and invoicing.
• To send transactional messages — booking confirmations, reminders, password resets. Legal basis: performance of a contract (for the person booking), or the salon's legitimate interest in an appointment being kept.
• To send marketing or promotional messages to a salon's clients — only if the salon has the client's consent. The salon is responsible for having it. Legal basis: consent.
• To keep the service secure and working — logs, abuse prevention, backups. Legal basis: our legitimate interest in a safe and reliable service.
• To comply with the law — accounting, tax, answering lawful requests. Legal basis: legal obligation.

We do not sell personal data, we do not use client records for advertising, and we do not profile anyone.

4. Cookies

We only use cookies that are strictly necessary to run the site — there is no advertising or third-party tracking on KBSalonBook, which is why you are not being nagged by a cookie banner.

• Session cookie — keeps you signed in. Deleted when you sign out.
• Language cookie — remembers which language you chose.
• Paddle — sets its own cookies during checkout, to process the payment and prevent fraud.

5. Signing in with Google

If you sign in with Google, Google tells us your name, email address and the identifier of your Google account, so that we can create or find your KBSalonBook account. That is all we ask for. We do not get access to your Gmail, your contacts, or your Google Calendar. Google's own privacy policy applies to what happens on their side.

6. Who we share data with (processors and sub-processors)

We do not sell or rent personal data. We share it only with the suppliers we need in order to run KBSalonBook, each of them bound by a contract to use it only on our instructions:

• Paddle — payments. Acts as Merchant of Record: it takes the payment, issues the invoice and handles VAT. It receives the billing details of salon owners. Clients are never charged and their data is never sent to Paddle.
• Meta Platforms Ireland (WhatsApp) — delivers your WhatsApp messages, but only when a salon has bought the messaging add-on. It receives the recipient's phone number and the message. With the add-on off, no client phone number ever leaves KBSalonBook.
• Google — identity only, when someone chooses to sign in with Google.
• Our CDN and network security provider — sits in front of our servers to speed up delivery and filter malicious traffic; it processes connection data (IP address, request headers) for that purpose only.
• Our hosting and database provider — stores the data that runs the service.
• Our email provider — sends transactional emails such as password resets.

When we act as a salon's processor (section 1), we process client records only on that salon's documented instructions, keep them confidential, apply the security measures in section 10, help the salon answer its clients' data requests, and delete or return the data when the salon's account ends. We will tell salons before we add or change a sub-processor. Our full Data Processing Agreement governs this relationship; a countersigned copy is available on request.

We may also disclose data if the law requires it, or to protect our rights, our users, or the safety of others.

7. Where your data lives

Our servers and database are in the European Union.

Some of our suppliers (such as Paddle, Meta and Google) may process data outside the EU. When that happens, the transfer is covered by the safeguards the GDPR requires — typically the European Commission's Standard Contractual Clauses, or an adequacy decision.

8. How long we keep it

• Your account — for as long as it exists.
• After an account is closed, or a subscription stays inactive — we may delete the data permanently after 30 days. Ask us for an export before then if you need one.
• Client records — for as long as the salon keeps them, or until the salon's account ends.
• Invoices and tax records — for as long as tax law requires (usually up to 10 years). These are held by Paddle as Merchant of Record.
• Server logs — a short period, then deleted.
• Password reset links — they expire quickly and are then unusable.

9. Your rights

Under the GDPR you can ask to: access your data, correct it, delete it, restrict or object to how it is used, get a portable copy, and withdraw consent at any time (which does not undo what was done before you withdrew it).

To exercise any of these, write to [email protected]. We will reply within one month. We may need to confirm who you are first.

If you are a client of a salon, the salon controls your record, so start with them — but if that goes nowhere, we will step in and help. You also have the right to complain to a supervisory authority: in our case, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or the authority in the country where you live.

10. How we protect it

Passwords are stored hashed with bcrypt — we cannot read them, and neither can anyone who steals the database. Traffic is encrypted in transit with HTTPS. Every salon's data is isolated from every other salon's, and each request is checked against the account that made it. Access to production data is restricted to the people who need it to run the service.

No system is perfectly secure. If a breach ever puts your data at risk, we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.

11. Children

KBSalonBook is not intended for children. A salon account requires you to be 18 or over. A parent or guardian may book an appointment on behalf of a child. If you believe we hold data about a child that should not be there, tell us and we will remove it.

12. Automated decisions

We do not make decisions about you by purely automated means with legal or similarly significant effects, and we do not profile you. The waiting list offers open slots in the order the salon configured — a person still decides everything that matters.

13. Changes to this policy

When we change this policy we will update the date at the top. If a change matters to you, we will tell you by email or in the app before it takes effect.

14. Contact

Kevin & Bruno Solutions, Lda., Rua Eusébio Exposto N17 2DC 4720-078 Braga, Portugal. Privacy questions: [email protected]. Everything else: [email protected].