Privacy Policy

VanIersel Development, trading as Salonnare, registered office: Pieter Vreedestraat 2, 5142 SE Waalwijk, the Netherlands. Contact: info@salonnare.com. Phone: +31 6 36035292.

Dutch Chamber of Commerce (KvK) number: 42050725. VAT ID: NL005457538B24.

Salonnare has a dual role under the GDPR. For our own customers (salon owners with a Salonnare subscription), we act as controller - we determine the purposes for which their account, billing and usage data are used.

For the client data a salon owner enters into Salonnare (their own salon clients, appointments, invoices, messages, photos), we act solely as processor. The salon owner remains the owner and controller of that data. We process it only in accordance with the instructions in the data processing agreement (see section 10).

Visitor data (all visitors to salonnare.com): pseudonymised IP address, user agent, referring page, click path and device category via Google Analytics 4 and - after consent - Microsoft Clarity (heatmaps and session replay).

Account and billing data (salon owners): name, email, phone number, salon name, business address, Chamber of Commerce number, VAT ID, chosen plan, invoice history and payment details (processed by Stripe; we never see full card/IBAN numbers).

Usage data (salon owners): login times, login IP, action logs for audit (create/update/delete records), feature flag activity.

Content data: everything you create in Salonnare - clients, appointments, services, products, inventory, invoices, payments, messages and reviews. This data is owned by your salon; we only process it to make Salonnare function.

Client photos (regular): visual content your salon captures or uploads, such as hairstyle results, product showcases or event photos. Stored in the standard uploads volume with TLS in transit and AES-256 at rest. See section 17 for the full camera and photo flow.

Client photos (health context): visual content with medical context, such as skin analysis, allergy reaction or treatment progress for a skin condition. Deliberately marked by the salon as a health note and stored in the Article 9 encrypted vault (section 12).

Optional communication data: if you enable WhatsApp integration or email campaigns, we process phone numbers / email addresses of your salon clients solely to deliver the messages you send.

Delivering the Salonnare software (account creation, authentication, multi-tenant isolation, backups).

Billing and collection of subscriptions (statutory retention: 7 years for tax records).

Transactional communication (registration confirmation, invoices, security alerts).

Improving the application based on aggregated product metrics and (with consent) heatmaps.

Fraud prevention and security (rate limiting, IP blocking, anomaly detection).

Complying with legal obligations (tax filings, regulator requests).

Performance of a contract (Article 6(1)(b)) - for account management, billing and service delivery.

Legitimate interest (Article 6(1)(f)) - for security, fraud prevention and aggregated product improvement. This balancing test is documented and available on request.

Consent (Article 6(1)(a)) - for analytical and UX cookies (GA4, Microsoft Clarity). You may withdraw consent at any time without any negative impact on service delivery.

Legal obligation (Article 6(1)(c)) - for statutory tax retention and bookkeeping.

Salonnare.com uses three categories of cookies and storage technologies, in accordance with Article 11.7a of the Dutch Telecommunications Act and the ePrivacy Directive:

Strictly necessary (no consent required): login session cookie, CSRF token, language and theme preference, cookie consent status (salonnare_cookie_consent in localStorage).

Analytics (only after consent): _ga and _gid from Google Analytics 4 - anonymised site statistics, 14-month retention, IP anonymisation enabled, ad_storage default denied via Google Consent Mode v2.

UX / product experience (only after consent): _clck, _clsk and MUID from Microsoft Clarity - heatmaps and session replay with automatic PII masking (text inputs and payment details are obfuscated by default), 1-year retention. Details: learn.microsoft.com/clarity/setup-and-installation/privacy-disclosure.

No advertising, retargeting, Meta, LinkedIn, TikTok or affiliate pixels are placed.

The Salonnare app (the web app and the iOS and Android app) has its own consent question and its own measurement, separate from the cookie banner on salonnare.com: see section 21.

You can revise your choice at any time via the cookie settings at the bottom of the page or by clearing the cookies for salonnare.com in your browser.

We work with carefully selected sub-processors. A data processing agreement (DPA) with EU Standard Contractual Clauses (SCCs) is in place with each sub-processor where applicable. The current list:

Cloudflare, Inc. (USA) - CDN, WAF, DDoS protection. Processes IP addresses and request metadata. DPA with SCCs; certified under the EU-US Data Privacy Framework (DPF). Cloudflare EU data localization suite enabled where active.

Stripe Payments Europe Ltd. (Ireland) - subscription payments, card processing and Stripe Connect (salon payments). PCI-DSS Level 1 certified. Processes payment details under its own privacy policy; Salonnare never sees full card numbers.

Mollie B.V. (Netherlands) - alternative payment provider for salon payments via Mollie Connect (iDEAL, Bancontact, SEPA). Processor under Dutch law.

SumUp Limited (Ireland) - card payments via SumUp terminal, optional per salon tenant. Processes transaction amount, payment status and terminal ID; card data is encrypted by SumUp. PCI-DSS certified.

Resend, Inc. (USA) - transactional email (confirmations, invoices, password reset). DPA with SCCs; sending servers in the EU where possible.

Anthropic, PBC (USA) - AI help with mapping columns in an import file. Optional: only when the salon itself clicks "Let the AI suggest a mapping". Column names and a type profile per column (for example "email address" or "date") are sent. For client files no value from the file is sent; for product and service files three sample rows from which email addresses, phone numbers, IBANs, postcodes, old dates and free text longer than 40 characters have been removed. A file without a header row is not sent to the AI. Anthropic does not use this data to train models and deletes it within 30 days; only a request flagged by Anthropic's automated safety checks may be kept for up to 2 years. Stored in the USA; the processing itself may also take place in other countries outside the EEA. Anthropic is not certified under the EU-US Data Privacy Framework; transfer based on the EU Standard Contractual Clauses (module 3) in Anthropic's data processing addendum.

Microsoft Ireland Operations Ltd. (Ireland) - Microsoft Clarity for optional UX analytics. DPA via the Microsoft Online Services Terms; Microsoft Corporation (USA) certified under DPF. Only loads after consent.

Google Ireland Ltd. (Ireland) - Google Analytics 4 with anonymised IPs (for salonnare.com and, only after consent in the app, in a separate property for the Salonnare app, see section 21); Google Ads conversion tracking (only after marketing consent, default ad_storage=denied via Consent Mode v2); Google Places API for salon address lookup; Google Reserve (optional, for bookings via Google Maps). Google LLC (USA) certified under DPF.

Meta Platforms Ireland Ltd. (Ireland) - WhatsApp Business Cloud API, optionally enabled per salon tenant for WhatsApp notifications to salon clients. Meta Platforms, Inc. (USA) certified under DPF.

MJML.io (France) - server-side rendering of HTML for email campaigns. Processes template markup only, no personal data.

Backblaze, Inc. (USA) and/or Amazon Web Services EMEA Sàrl (Luxembourg) - optional encrypted backups of your data. Only enabled on explicit request; DPA with SCCs.

Hetzner Online GmbH (Germany, EU) - our primary database (MariaDB) and application servers run on Hetzner infrastructure within the EU. ISO 27001 certified; DPA with SCCs.

We never sell personal data to third parties and do not send data to advertisers, data brokers or governments, except as required by law.

Primary storage and processing takes place within the EU/EEA. Transfers to the United States only take place via sub-processors certified under the EU-US Data Privacy Framework (Cloudflare, Google, Microsoft, Meta, Resend where applicable) that have additionally signed EU Standard Contractual Clauses.

Exception: Anthropic, PBC (USA), for the optional AI help with imports (see section 7), is not certified under the Data Privacy Framework. That transfer relies on the EU Standard Contractual Clauses (module 3) in Anthropic's data processing addendum, combined with data minimisation: no value from a client file is sent.

Where relevant, we perform a Transfer Impact Assessment (TIA) in line with the Schrems II guidance of the European Data Protection Board.

Account data: for the duration of the subscription, plus 90 days for reactivation. Then fully deleted, except data subject to statutory tax retention.

Billing and bookkeeping data: 7 years (statutory tax retention).

Backups: encrypted, 30-day rolling retention.

Audit logs (login and mutation history): 12 months.

Analytics data (GA4), from salonnare.com and from the Salonnare app: 14 months.

Microsoft Clarity session replays: 1 year.

AI help with imports (Anthropic): deleted by Anthropic within 30 days, up to 2 years if their safety checks flag a request. Salonnare itself only keeps the suggestion (which column belongs to which field) and the number of tokens used; the import file is deleted after completion or rejection, at the latest after 30 days.

On subscription end, the salon has 30 days to export data (Article 20 GDPR), after which all tenant data is removed from production and rotated out of backups within a further 30 days.

For the salon client data where Salonnare acts as processor, we enter into a standard data processing agreement (DPA) with every customer, in accordance with Article 28 GDPR. The DPA is an integral part of our terms of service - the stand-alone version is available free of charge at privacy@vaniersel.dev.

The DPA covers: (a) subject, duration, nature and purpose of the processing; (b) categories of data subjects and personal data; (c) rights and obligations of the controller; (d) our obligations on confidentiality, security, breach notification and assistance with GDPR requests; (e) authorisation procedure for sub-processors; (f) audit rights; (g) return or deletion of data at contract end.

Sub-processors are announced at least 30 days before they are engaged; you have the right to object on reasonable grounds.

Technical measures: TLS 1.3 for all traffic, AES-256 encryption at rest, HSTS preload, least-privilege production access via encrypted SSH keys and 2FA, row-level tenant isolation at database level, automatic rate limiting, IP geofencing for admin endpoints, shielded audit logs.

Organisational measures: dedicated security reviews before each deployment, single-owner access control, encrypted off-site backups, incident response plan with runbook, annual penetration test (from 2027).

Breach procedure: incidents are reported to the Dutch Data Protection Authority within 72 hours in accordance with Article 33 GDPR; where there is high risk to data subjects they are informed within the same window (Article 34 GDPR).

For the safety of a treatment, salons may record health-related notes against a client profile, such as allergies (for example to hair-colour or nail products), medication that may affect the result, skin conditions, pregnancy or contra-indications. These qualify as special-category personal data under Article 9 GDPR and may only be processed under a specific exemption. Salonnare relies on Article 9(2)(a) GDPR: explicit, documented consent from the client to the salon. Without recorded consent the salon cannot create health notes; consent withdrawal is captured in the audit trail.

How it is stored - Health data lives in a dedicated encrypted "vault", physically and logically separated from regular client notes. We use AES-256-GCM in an envelope architecture: a platform master key (HEALTH_DATA_MASTER_KEY) wraps a per-tenant data key (tenants.health_data_key_enc), which in turn encrypts every individual note and attachment with a random 12-byte IV and 16-byte authentication tag. Attachment filenames are also stored encrypted to prevent directory-listing leaks. The master key lives only in the production environment and is double-backed-up outside production infrastructure (1Password vault + sealed envelope in a physical safe); the server refuses to start without a valid master key.

Attachments include both uploaded documents and photos you capture via the camera or file picker on a health note; they follow the same encryption, retention and access rules. See section 17 for the camera and photo flow details.

Access control - Only tenant users with the explicit RBAC permission can_view_health_notes can decrypt and read notes. Platform-admin impersonation of a tenant is hard-blocked at endpoint level: even Salonnare staff with super-admin privileges cannot view health notes after impersonation. Every read, write and download event is recorded in client_health_notes_access_log with user id, IP, timestamp and note id, and is provably traceable.

Retention - Health notes are automatically deleted 12 months after the client's last appointment, with a 30-day grace period. The prune job runs daily at 02:00 UTC (worker/prune_health_notes.py). When a client withdraws consent the notes and attachments are hard-deleted on the next prune cycle and made logically inaccessible immediately on withdrawal. Encrypted backup tarballs of the vault rotate on the same 30-day schedule and are unreadable without the master key.

Withdrawing consent & data export - You can withdraw consent at any time via the salon you are a client of (for health data, the salon is the controller; Salonnare acts solely as processor). A GDPR Article 15 access request or Article 20 portability request runs through the salon, which can use our GDPR export API to generate a structured JSON export including health notes. For complaints about Salonnare's processing as a processor, you may email privacy@vaniersel.dev directly.

See also our sub-processors section (above, 7), the general retention periods (9) and the security chapter (11) for the broader context. The full technical runbook for the vault - including key rotation and disaster recovery - is available at docs.vaniersel.dev/docs/compliance/art9-health-data-vault.

You have the right to: (a) access your personal data (Article 15), (b) rectification (Article 16), (c) erasure / right to be forgotten (Article 17), (d) restriction of processing (Article 18), (e) data portability (Article 20), (f) object to processing based on legitimate interest (Article 21), (g) withdraw previously given consent (Article 7(3)), and (h) not be subject to fully automated decision-making (Article 22).

Salonnare does not use automated decision-making or profiling with legal effects for data subjects.

Requests can be sent to privacy@vaniersel.dev. We respond within 30 days (extendable by 2 months for complex cases, with reasoning). If you disagree with our response, you may lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

Salonnare is not directed at children. We do not knowingly process personal data of persons under 16 years (GDPR Article 8(1), Dutch implementation: age 16) without parental consent. If a salon owner records contact details of minor salon clients, the salon owner is responsible for obtaining appropriate consent.

We update this privacy policy when our services or applicable law require it. The date of the most recent change is shown at the top of this page. Material changes are announced at least 30 days before they take effect via email and an in-app banner.

In addition to email/password, Salonnare offers three optional single sign-on (SSO) methods: Sign in with Google, Microsoft Entra ID and Sign in with Facebook. You choose whether to use SSO. When you do, we request only the basic OpenID Connect scopes: openid, email and profile. We do not request access to Gmail, Google Calendar, Google Drive, Outlook mailboxes, OneDrive, your Facebook timeline or any other service of these providers.

From these scopes we receive and store only: (a) your email address - to identify your account and send transactional notifications; (b) your name and (optional) profile picture - to personalize your dashboard; (c) a unique account identifier (the OIDC sub claim) - so we can recognize you on return sign-ins without storing a password. We do not retain long-lived access tokens or refresh tokens after authentication completes.

Salonnare's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not sell, rent or share Google user data with third parties for advertising, marketing or any other purpose, and we do not use this data to train AI or machine-learning models. The same principle applies to data we receive via Microsoft and Facebook SSO.

Retention: SSO data is retained for as long as your Salonnare account exists. When you delete your account (or your salon administrator removes you), the email address, name, profile picture and SSO account ID are deleted within 30 days, except where Dutch tax law requires us to retain billing-related records.

Revoking access: you can disconnect Salonnare from your Google account at any time at myaccount.google.com/permissions, from Microsoft at myapps.microsoft.com or from Facebook at facebook.com (Settings → Apps and Websites). To fully delete your Salonnare account, open Settings → Account inside app.salonnare.com and choose Delete account, or email privacy@vaniersel.dev.

Salonnare uses your device camera for two clearly scoped purposes: (a) scanning QR codes on physical gift cards at the point of sale (POS), and (b) capturing a single photo to attach to a client profile or treatment note. We only request permission at the moment you tap the "Scan QR" or "Take photo" button - never in the background or when a page loads.

What we do and do not do - We request video access only, never audio (the microphone is never accessed). We do not store the video stream or any live frames: for QR scanning we only use the decoded text string and discard the imagery immediately; for photo capture you consciously save a single still image. As soon as you close the scanner or photo dialog, Salonnare stops the camera stream and the device indicator light turns off. We do not perform face recognition, biometric identification, automated skin analysis, or AI/machine-learning training on your photos.

What happens to your photo - Before upload, two privacy steps run inside your browser: (1) the photo is converted locally to JPEG via a canvas for universal readability; (2) we strip all EXIF metadata, including GPS coordinates, camera model and exact capture time. The image is then resized for storage and compressed. Only then does your browser upload the photo to our servers within the EU over an encrypted TLS connection. The original version with EXIF never leaves your device.

Storage routing - When you attach a photo to a regular client profile (e.g. a hairstyle result or product showcase), it is stored in our standard uploads volume, protected by TLS in transit and AES-256 disk encryption at rest. When you deliberately choose a health note (see section 12 - Article 9 health-data vault) and attach a photo inside it - for example skin analysis, allergy reaction, or treatment progress with medical context - the photo lands in the encrypted vault with per-object AES-256-GCM envelope encryption and strict RBAC. The salon staff member chooses the correct context; Salonnare cannot infer this from the image content.

Libraries that run inside your browser - We use @zxing/browser (BSD-3 license) for QR decoding. Photo conversion and compression are handled by your browser's built-in canvas. Everything runs entirely inside your browser and does not transmit imagery or metadata to any external party. No new sub-processor is introduced for the camera feature - all uploads follow the existing routes (see section 7).

Cookies and consent - Camera access falls outside the cookie consent banner (section 6). The browser itself asks at the operating-system level via a native permission popup the moment you tap "Scan QR" or "Take photo". No tracking cookies are set and no local storage is used for camera purposes beyond a short-lived session flag that remembers your permission choice during your work session.

Revoking permission - You can revoke camera access for salonnare.com at any time via your browser settings: tap the padlock icon in the address bar -> Site settings -> Camera -> Block. On iOS Safari: Settings -> Safari -> Camera -> "Ask" or "Deny". After revocation, previously captured photos remain in the client file until your salon deletes them; only future scans/captures become impossible.

No camera or denied permission - On a laptop without a webcam or after a denied permission prompt, Salonnare always offers a fallback: manually type the gift-card code, or pick an existing photo from your device library via the standard file picker.

After a completed appointment a salon may email you asking for a review. If you leave one, it is published on that salon's page on salonnare.com. We publish your first name and the first letter of your surname (for example "Beau V."), your rating, your comment if any, and the date. Your email address, phone number, address and the treatment itself are never published.

Publishing anonymously - the review form has a checkbox "Publish my review anonymously". If you tick it, no name is shown with your review and it is left out of the structured data that search engines read. Your rating still counts towards the salon average.

Why we publish - the legal basis is your consent (GDPR article 6(1)(a)), which you give by submitting the review after reading the notice about publication. The display name is frozen at the moment you submit and does not change with your customer record afterwards.

Who can do what - the salon may reply publicly to your review and may report it to us. The salon cannot delete or hide a review itself: only Salonnare decides on a report, and records that decision with a justification. This keeps the picture on the salon page complete rather than filtered down to positive responses only.

Retention and your rights - a published review stays online for as long as the salon is active on the marketplace. If you ask us to erase your data, the review remains but the link to your customer record is cut and the name is replaced with "Verified customer"; the salon average stays correct without any personal data left in it. Email privacy@vaniersel.dev or contact the salon.

Through the signup form at salonnare.com/early-access you can join the waitlist to try Salonnare early. We process: your name, email address, phone number (optional), salon name, city, your salon's segment (for example hair salon, nail studio or barbershop), your current software (optional) and any free-text notes you add.

Legal basis for contact - we email you about Salonnare on the basis of your consent (Article 6(1)(a) GDPR), given by submitting the form. You can withdraw this consent at any time via the unsubscribe link in any email or by emailing info@salonnare.com; this does not affect the lawfulness of processing carried out before withdrawal.

Campaign data - if you reached us through an advertisement or a tagged link, submitting the form also sends us which campaign that was: UTM parameters (source, medium, campaign, content and term), a click ID from the ad platform, the page you landed on and the referring page. This happens on every submission, even without consent for marketing cookies - the legal basis is our legitimate interest (Article 6(1)(f) GDPR) in measuring which advertisements lead to a signup. See the Cookie Policy (section 6, Marketing category) for the separate, consent-gated storage of that same data in sessionStorage during your visit, before you submit the form.

Sharing with Google Analytics - when a platform administrator marks your signup as 'active tester' or 'converted', we send an event to Google Analytics 4 containing the campaign data (source, medium, campaign name), the landing page, the salon segment, the language and a unique signup identifier (for example early_access_42) - so we can see which advertisement leads to a successful signup. Your name, email address and phone number are never included. If you additionally consent to the marketing category, on a successful signup we do send a hashed (unreadable) email address and phone number to Google Ads as an Enhanced Conversion, so we can see which advertisement led to a signup.

Retention - we keep waitlist signups for the duration of the early-access programme. You can ask us to erase your data at any time by emailing privacy@vaniersel.dev.

What it is - A limited group of users has a "Give feedback" button in the app: testers and members of the early-access programme. Only for them does the app keep, in the device's working memory, a recording of the last 2 minutes on screen (a reconstruction of the page structure and your clicks, no video and no audio), plus the last 100 lines from the browser console. For all other users this is switched off entirely.

When anything is sent - Only when you open the feedback form yourself (via the button, the keyboard shortcut or by shaking your phone) and submit it. The recording, the console lines, your comment, the chosen category and severity, the page you were on, the app version, your browser and your screen size are then sent to Salonnare. If you send nothing, the recording never leaves your device and is continuously overwritten. Without an internet connection, a submitted report is kept on your device temporarily until the connection is back.

Masking - Client data (names, email addresses and phone numbers of the salon's clients) is marked in the app. All text inside such a marking is replaced by asterisks in the recording, and the same applies to the invisible texts that can contain a name, such as a text for screen readers, a tooltip or the alternative text of an image. Links that contain a phone number or email address (call, email, text message and WhatsApp) are masked everywhere in the recording, including outside a marking. The content of every input field (including notes and passwords) is not captured, and the health-data vault, intake answers and client photos are skipped entirely. This happens on your device, before anything is sent. The masking settings come from our server; if the app does not receive them, or not in full, it masks with the strictest setting. A residual risk remains: the masking works on what is marked. Personal data shown as plain text in a place without a marking, for example a name someone typed into a description or comment themselves, can end up in a recording. To avoid that, close the screen in question before you send feedback.

Security, access and retention - The recording is stored encrypted (AES-256-GCM, with a dedicated key) on Salonnare's servers within the EU. No additional sub-processor is involved; storage follows the existing routes (see section 7). Only a limited number of Salonnare platform administrators can play back a recording, solely to investigate the reported issue. After 30 days the recording and the report are deleted automatically and permanently.

Legal basis and role - For data about your own use of the app (clicks, page, console lines) the legal basis is our legitimate interest in a working application (Article 6(1)(f) GDPR). For the salon's client data visible on screen, Salonnare acts as processor on behalf of the salon, under the Data Processing Agreement (section 10). To have a recording deleted earlier, or to have the feedback button switched off for your account, email privacy@vaniersel.dev.

What it is - In the Salonnare app (the web app on your salon's domain and the iOS and Android app) we ask you once whether we may measure how you use the app. We measure this with Google Analytics 4, in a separate property used only for the app and kept apart from the measurement on salonnare.com. This concerns the staff and owners who work with the app. We do not measure the public booking page, intake forms, review pages or payment pages for the salon's clients. The registration wizard and the demo salon fall under the measurement of salonnare.com and the cookie banner there (section 6).

What is measured - Which screens you open, with a cleaned-up address: numbers, codes and email addresses in the address are replaced by a fixed placeholder, and search terms or other additions are not included. In addition, a fixed list of actions: an appointment, client or service created, a checkout completed, a campaign sent, an import completed and a step of the getting-started checklist completed. Such an action only carries general characteristics, such as the payment method, the import source or the channel of a campaign. We also record the platform (web, iOS or Android) and the plan and role of your account (for example Pro and owner).

What is not measured - No names, no email addresses, no client data, no amounts and nothing that identifies your salon: the address of every salon is replaced by app.salonnare.com in the measurement. We do not send a user ID (user_id), and Google signals and ad personalisation are switched off. Google Analytics does work with a random measurement ID per browser or device. That is why this measurement is pseudonymised and not anonymous.

Cookies and storage - In the web app, after your consent, Google Analytics sets the cookies _ga and _ga_<container> (lifetime up to 2 years). The iOS and Android app use no cookies: there, after your consent, the app keeps a random measurement ID in the app's local storage. Your choice itself is kept in local storage and with your account, so it applies on all your devices. The full list is in the Cookie Policy.

Without consent - If you say no, or close the question without choosing, the app sets no cookies and keeps no measurement ID. Google Analytics then only receives signals without a cookie and without a measurement ID (Google Consent Mode), which Google uses to estimate overall usage. Even then no names, client data or salon data are included.

Legal basis, withdrawal and retention - The legal basis is your consent (Article 6(1)(a) GDPR; for the cookies and the measurement ID on your device, article 11.7a of the Dutch Telecommunications Act). You can change your choice at any time in the app under Settings > My account > Measure usage. Withdrawing has no consequences for your use of the app. Google Analytics keeps the data for 14 months and does not store IP addresses (IP anonymisation is standard in GA4). Google Ireland Ltd. processes the data as a processor (section 7).