Privacy notice

Who is responsible

Joe Walsh, trading as The Hairdresser’s Diary, is responsible for the personal information used to create accounts, provide the platform, administer subscriptions and support users. Contact: hello@thehairdressersdiary.com. Full identification details are in the Legal Notice.

Account information

We use the salon owner's email address, salon name, subscription status, referral code and basic account activity to create and secure the account, provide the diary, administer subscriptions, prevent misuse and respond to support requests.

Why we use account information

Account and subscription information is used because it is necessary to provide the service you request and manage our agreement with you. Security, service improvement and fraud prevention are based on our legitimate interests in operating a safe and reliable platform. Billing and transaction records may also be retained where required by law.

Salon client records

The salon account holder decides which client details, notes, colour formulas, appointments and photographs to record. For that information, the salon professional is responsible for deciding why the information is used, while The Hairdresser’s Diary stores and processes it only to provide the diary. Platform-owner reporting does not display client names, colour formulas, private notes, allergy information or photographs.

Our contractual commitments when processing those records are set out in the Data Processing Terms.

Your responsibilities to salon clients

Salon professionals must tell their clients how their information is used, keep entries relevant and accurate, avoid recording unnecessary sensitive information and obtain any consent required for photographs or treatment-related details. Requests from a salon client about their salon record should normally be directed to the salon that created it.

Service providers

We use Supabase for authentication, the database and private file storage; OpenAI Sites and its infrastructure providers for website hosting; Cloudflare R2 for separate encrypted photo-backup storage; and Brevo for transactional account emails and, when enabled, booking emails. Booking emails contain appointment details and a private management link, not private diary notes or photographs. Stripe processes website subscriptions. For purchases through the Android or iPhone app, where available, Google Play or Apple processes the payment and RevenueCat verifies and manages subscription access. These providers process information needed for their roles. Payment providers also act under their own privacy notices.

Optional diary helper

Where enabled for your account, AI assistant uses Google's paid Gemini API to interpret the question you choose to submit, together with the previous search intent for a follow-up (topic, date filters and requested calculation, without a client ID or name). Only the last search is kept in memory while the assistant window is open. Your question may include a client name if you type one. Saved client files, notes, photographs and the diary's answer are not sent to the model. The diary reads authorised records itself and returns saved information without changing it. AI can misunderstand a question; check the original record.

Do not paste sensitive health information or private notes into a question. We do not save questions or answers as a chat history. Google does not use paid API prompts or responses to improve its products, but retains them for 55 days for abuse monitoring and required legal disclosures. Processing may take place outside the EEA under Google's data-processing terms. Usage counters contain account/salon identifiers and request counts, provider success/failure and token counts for estimating usage costs, not questions or answers. Using the helper is optional; the diary remains available without it.

The notice beside the question explains this transfer. Pressing Ask AI assistant acknowledges the notice for that question only. Opening the assistant, typing or selecting a suggested question does not send anything to Gemini. You can stop using the assistant at any time; further questions are sent only when you press Ask again.

Google Gemini API terms · Google abuse-monitoring information

Photographs, booking pages and messages

Camera and photo-library actions start when you choose them. Selecting an image does not give the diary unrestricted access to your phone's photo library. Client and visit photographs are private. Stylist profile photographs, introductions, services and published reviews may be visible to people who open a public booking page that you enable. Booking requests also collect the contact and appointment details needed to arrange the visit.

WhatsApp messages are drafts: you choose to open them, check the recipient and text, and send them in WhatsApp. Opening a draft does not mean it has been sent or delivered. Optional phone reminders depend on your notification permission and device settings. The app does not need access to your phone's address book to store client details you enter yourself.

International processing

Some technical providers may process information outside Spain or the European Economic Area. Where this happens, we rely on recognised legal safeguards such as an adequacy decision or approved contractual protections, where required.

Secure storage

Unfinished client and visit notes can have an encrypted recovery copy on your device, tied to your signed-in account. Note drafts are offered for up to seven days; expired drafts are removed when the diary is next opened. Pending website saves also have a device recovery copy until the online save is confirmed or you explicitly discard it. These copies are not proof of an online save. Clearing browser data or losing the device can remove them, so wait for confirmation that your changes are saved online. Keep your device and browser profile secure.

Each signed-in salon account is separated from other salon accounts using database access controls. Client photographs are held in private storage and opened through time-limited links. We use encrypted connections and restricted administrative access, although no online service can promise absolute security.

Payments

We use account identifiers, purchase and subscription references, product details, payment status, renewal and expiry dates to provide paid access, prevent misuse, handle support and understand subscription performance. RevenueCat processes store purchase history for access verification and subscription analytics. Private salon client notes and photographs are not sent to RevenueCat as part of that verification. We do not receive or store complete payment-card numbers; Apple, Google Play and Stripe handle payment details under their own policies.

Technical and security information

Our infrastructure may process IP addresses, request and account identifiers, device or browser information, error details and timing information to operate the service, investigate faults and prevent abuse. We do not sell salon client records or use their photographs to advertise other businesses. Encrypted connections and private storage are not end-to-end encryption.

How long information is kept

To request deletion without the app or an active subscription, use our account deletion page. Opening the page does not delete your account.

Account and salon diary information is retained while the account remains in use. Cancelling a subscription does not immediately delete salon records. The account holder can download a backup and permanently delete the account from the privacy controls inside the diary. That action removes the salon diary, client records, photographs, booking page and sign-in account and cancels an attached Stripe subscription. Google Play subscriptions are managed separately in Google Play: deleting an account or uninstalling the app does not itself stop store renewal. Apple subscriptions are also managed separately through your Apple Account: deleting an account or uninstalling the app does not itself stop Apple renewal. Our deletion page explains how to cancel and request help with associated RevenueCat records. Necessary transaction records may be retained for security, dispute resolution, legal or tax obligations, rather than for continued use of the diary.

Database recovery copies use Supabase's current Pro daily-backup schedule, with a rolling seven-day recovery window. Separate encrypted photo-backup copies, where held, are scheduled to expire 45 days after creation; the backup store protects copies against alteration or deletion for their first 35 days. Provider expiry runs asynchronously, so physical removal may occur after the scheduled expiry. Recovery copies are not part of the active diary. Any recovery must reapply completed deletion requests before restored records are put back into use.

Delete particular information without closing your account

You can remove individual client records and photographs using the controls in the diary. For another deletion or correction request, email hello@thehairdressersdiary.com from your account email address with your salon name and a brief description of what you want removed. You do not need an active subscription to ask. Do not include passwords, payment-card details or copies of private client notes or photographs. We verify identity and the scope of the request before acting. For a salon client's record, contact the hairdresser responsible for it.

Your data rights

Depending on the circumstances, you may ask to access, correct, delete or restrict use of your personal information, receive a portable copy or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time. To make a request, email hello@thehairdressersdiary.com. We may need to confirm your identity before acting on a request.

Complaints

Please contact us first so we can try to resolve your concern. You also have the right to complain to the Spanish Data Protection Agency (AEPD) or, where applicable, the data protection authority in the country where you live or work.

Changes to this notice

This notice may be updated when the service or legal requirements change. The latest version and its update date will always be available on this page. Material changes will be brought to account holders' attention.