Data Processing Terms

These terms form part of The Hairdresser’s Diary subscription agreement. They apply when an account holder uses the service to store personal information about salon clients. In these terms, the salon account holder is the controller and Joe Walsh, trading as The Hairdresser’s Diary, is the processor.

1. Processing details

2. Documented instructions

We process salon client records only to provide, secure, maintain and support the diary in line with the controller's documented use of the service and lawful written instructions. We will tell the controller if, in our reasonable view, an instruction infringes applicable data-protection law, unless the law prevents us from doing so.

3. Confidentiality and access

Anyone authorised to access salon client records on our behalf must be bound by confidentiality and may access only what is necessary for their role. Platform-owner reporting is designed not to display client names, private notes, formulas, allergy information or photographs.

4. Security measures

We use encrypted connections, authenticated accounts, row-level database controls, private photo storage, time-limited photo links, restricted administrative access, revision checks to reduce accidental overwrites and service-provider backup controls. We review these measures as the service and risks develop.

5. Sub-processors

The controller gives general authorisation for the specialist providers needed to run the service. Current providers include Supabase for database, authentication and private storage, and OpenAI's Sites service and its contracted infrastructure for application hosting, Cloudflare R2 for separate encrypted photo-backup storage, and Brevo for transactional account emails. Stripe processes website subscription payments; Google Play processes Android store payments where available, with RevenueCat verifying and managing store subscription access and analytics. Payment verification does not send private salon client notes or photographs to Stripe, Google Play or RevenueCat.

We will require sub-processors that handle salon client records to protect them under written terms. Material additions or replacements will be communicated through the service, this page or email, allowing the controller to raise a reasonable data-protection objection before the change takes effect where practicable.

6. International processing

Where a provider processes records outside the European Economic Area or the United Kingdom, we will use an applicable adequacy decision or approved contractual safeguards and any additional measures reasonably required for the transfer.

7. Assistance and incidents

Taking account of the nature of the service and information available to us, we will reasonably help the controller respond to client data-rights requests and meet relevant duties concerning security, breach notification, impact assessments and regulator consultation. We will notify the controller without undue delay after becoming aware of a personal-data breach affecting that controller's salon records.

8. Return and deletion

The diary provides backup and deletion controls. When the service ends, the controller may request return or deletion of salon client records unless the law requires limited retention. Active copies will then be deleted. Database recovery copies follow the current rolling seven-day backup schedule. Separate encrypted photo copies, where held, are scheduled to expire 45 days after creation and are protected against alteration or deletion for the first 35 days. Provider expiry runs asynchronously. Completed deletion requests must be reapplied before restored data is put back into use. Cancellation alone does not immediately delete records. See the deletion request page for the request process and separate Google Play cancellation instructions.

9. Information and audits

On reasonable request, we will provide information needed to demonstrate these processor commitments. If that information is not sufficient, the controller may request a proportionate audit by an independent, confidential auditor with reasonable notice, provided it does not expose another salon's records or create an avoidable security risk.

10. Controller responsibilities

The controller is responsible for giving lawful instructions, telling salon clients how their information is used, limiting entries to what is relevant, keeping records accurate, protecting account credentials and obtaining any consent required for photographs or sensitive treatment information.

11. Contact and priority

Data-processing questions can be sent to hello@thehairdressersdiary.com. If these terms conflict with the general subscription terms about our processing of salon client records, these Data Processing Terms take priority for that processing.