WhatsApp Business API & DPDP/GDPR Aligned

Privacy Policy

Last Updated: August 29, 2026

This Privacy Policy governs the collection, use, processing, and erasure of personal data by our Salon CRM platform, WhatsApp booking assistant, and client salons. We are committed to transparency, data minimization, and protecting your privacy.

1. Information We Collect

When you interact with our salon services, book an appointment through our WhatsApp Bot, or visit our salons, we may collect and process the following categories of personal data:

Contact Information: Full name, phone number, and WhatsApp mobile number.
Appointment & Service Records: Requested services, booked dates, times, preferred barbers, service duration, and appointment status.
Profile & Preferences: Gender, birth date (for birthday greetings and promotional offers), loyalty points, and notes regarding haircut/styling preferences.
Look Photos & Media: Hairstyle reference images or consultation photos uploaded voluntarily via WhatsApp or salon tablets to guide your stylist.
Feedback & Ratings: Ratings (1–5 stars) and optional feedback comments submitted following your service visit.

2. Purpose of Data Processing & WhatsApp Messaging

We process your personal information strictly for legitimate operational purposes:

Appointment Confirmations

Sending immediate booking confirmation codes, stylist assignment, and scheduled time details via WhatsApp.

Timely Arrival Reminders

Automated reminder alerts (24 hours, 2 hours, and 30 minutes before your slot) to minimize scheduling conflicts.

Loyalty & Birthday Rewards

Tracking points balance and delivering personalized birthday discounts or anniversary privileges.

Quality Assurance & Support

Customer satisfaction surveys and proactive support ticket creation for suboptimal experiences.

3. Data Security & Multi-Tenant Isolation

Your data is stored within hardened, SOC-2 compliant cloud infrastructure (Supabase PostgreSQL):

Row Level Security (RLS): Multi-tenant isolation guarantees that staff at Salon A can never view, access, or query customers belonging to Salon B.
Zero Public Table Access: Anonymous public keys are strictly prohibited from reading or modifying database tables. All access requires authenticated server-side validation.
Media Protection: Customer look photos stored in cloud storage are secured with strict upload constraints (10MB limit, image MIME verification, service-role-only write access).

4. Third-Party Service Providers

We partner with trusted third-party providers who adhere to rigorous data protection standards:

WhatsApp Business Platform (Cloud API / Meta): Inbound and outbound message transport, webhook delivery, and interactive appointment buttons.
Supabase: Encrypted managed database, authentication, and secure media storage.
Vercel: Cloud hosting, edge functions, and SSL delivery.
AI Providers (Google Gemini / Groq): Natural language understanding for bot message comprehension. Customer data is strictly processed per inference and never used for foundation model training.

5. Data Retention & Right-to-Erasure (Deletion)

You maintain complete ownership of your personal data. In accordance with applicable data privacy laws (including India's Digital Personal Data Protection Act and GDPR principles), you have the right to request the complete and permanent deletion of your data at any time.

What Happens When You Request Deletion:

Your customer record (name, phone number, birthday, loyalty points) is permanently erased or irreversibly anonymized.
All uploaded customer look photos are permanently deleted from Supabase Storage.
Your WhatsApp chat session history and bot conversation state are cleared.
Financial transaction totals may be retained in anonymized form solely to comply with statutory accounting and tax regulations.
A cryptographic audit log entry is preserved to record the fulfillment of your right-to-erasure request.

How to Request Deletion:

You can exercise your right to erasure through any of the following channels:

Via WhatsApp Bot: Simply message delete my data or forget me to our official business number.
At the Salon: Request the front desk or salon manager to delete your customer profile via the Salon CRM dashboard.
Via Email: Send an email to our Data Protection Officer at privacy@salonsaas.com with your registered WhatsApp phone number.

6. Contact Our Privacy Team

If you have questions, concerns, or grievances regarding this Privacy Policy or our data handling practices, please reach out to:

Data Protection Officer / Grievance Officer

Email: privacy@salonsaas.com

Official WhatsApp Helpline: +91 90053 00803