Your information.
Handled with care.

Soloona is software for salons. We hold two kinds of information: details you give us when you ask about the product, and the client records a salon brings into its own account. We sell neither. We run no advertising trackers. A salon's client data belongs to that salon, and we process it only to run the product for them.

If you request a demo we store what you type: your name, business name, phone, email, and your message. We use it to reply and for nothing else. There is no cross-site tracking and no advertising pixel on our sites.

A salon using Soloona creates and imports records about its clients. In full, that is:

• Name, phone number, email address and birthday.
• Appointment history, and which stylist was seen.
• Sales, what was bought, and lifetime spend.
• Notes the salon writes, and colour formulas recorded for future visits.
• Photographs the salon uploads to a client's record.
• Messages sent and received, and whether the client consented to marketing.

That data is the salon's. We process it to provide the product: showing the calendar, taking bookings, ringing up sales, and sending the messages the salon chooses to send. We do not use one salon's client list for anything outside that salon's account, and we never sell it.

A salon's client records are kept for as long as the salon has an account, because the product is the salon's working system of record. If a trial ends or a plan lapses, the account goes read-only and keeps its data until the salon deletes it or asks us to.

Deleting the salon from Settings removes its active database records, including sales and opt-out records. Export your client list first. Temporary import files expire after one day. Deleted records may remain in protected backup copies until the provider's retention period expires. Backups are used for recovery, and deletion requests must be reapplied after a restore.

Deleting a single client keeps two things on purpose. A record of somebody having replied STOP stays against the phone number, because deleting it would put that person back on a list they left. And their sales stay, because they are the salon's accounting records, but those rows no longer name anybody.

Demo enquiries are kept for two years, or until you ask us to delete yours.

Marketing texts and emails only go to people whose consent is recorded. Booking an appointment online is permission to contact you about that appointment; it is not permission to market to you, which is a separate, unticked box on the booking page.

Reply STOP to any text to opt out. The block is stored against the phone number itself, enforced on every send path, and nobody at the salon can lift it from inside the product. Only the person who opted out can opt back in, by replying START.

Card numbers never touch Soloona. Payments settle on the salon's own terminal, and we record only how something was paid, never the card itself. A salon pays for its own Soloona plan on Stripe's checkout page, so that card never reaches Soloona either.

Salon data is stored with Cloudflare and protected in transit and at rest. Access requires authentication, and each salon's records are scoped to its own account. We do not currently offer a contractual data-residency guarantee. Processing locations and provider retention terms should be reviewed before placing data subject to regional or industry restrictions in Soloona.

• Cloudflare (United States): database, file storage and hosting. All salon data lives here.
• Google Firebase (United States): signs people in. Receives the email address and password, or the Google or Apple sign-in, of anybody who signs in to a salon's account. Client records never go to it.
• Stripe (United States): takes payment for a salon's Soloona plan. Receives the paying owner's name, email, billing address and card. Soloona keeps only Stripe's reference to the customer and the plan's status.
• DeepSeek (China): powers the built-in assistant. When somebody at a salon asks the assistant a question about a client, the records needed to answer it are sent to DeepSeek's API. That can include a name, phone number, email, birthday, notes, colour formulas, visit and spend history, and the text of past messages. Nothing is sent unless the assistant is used, and the assistant can never message a client.
• Twilio (United States): delivers text messages. Receives the recipient's phone number and the message body.
• Resend (United States): delivers email. Receives the recipient's address and the message body.

The assistant and outbound messaging are disabled in the current launch configuration. When enabled, nothing goes to DeepSeek unless somebody at the salon uses the assistant. That use sends the information needed for the request to a provider in China. Photographs stay with Cloudflare and are never sent to any other sub-processor.

Under the CCPA as amended by the CPRA you may ask us to:

• Know what personal information we hold about you and where it came from.
• Correct anything inaccurate.
• Delete it. Salon staff can erase a client outright from inside the product, and doing so removes the record, notes, formulas, photographs, message history, appointments and waitlist entries. Sales are kept as accounting records but stop naming the person, and any STOP stays on the number.
• Receive a copy in a portable format.
• Opt out of sale or sharing. We do neither, so there is nothing to opt out of, and we do not sell or share the personal information of anyone under 16.

You will never be treated differently for exercising any of these. If your data sits in a salon's account we route the request to that salon, which is the controller of its own client list. Write to [email protected] and we will respond within 45 days.

Some browsers send a Do Not Track signal. There is no agreed standard for what a site should do with it, so we do not respond to it specifically. It makes no difference here: we run no advertising trackers and follow no visitor across other sites, so there is nothing for the signal to switch off.

Soloona is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 13. A salon may hold a record for a minor client; that record is the salon's, held under the salon's own relationship with that family.

If this policy changes materially we will say so on this page with a new date, and notify salon accounts directly.