This Privacy Policy explains how SalonRadar ("we", "us", "our") collects, uses, and protects the personal data of visitors, customers, and salon owners ("you") who use the SalonRadar marketplace and platform at salonradar.com and app.salonradar.com.
Who we are
SalonRadar is operated by Codesomelabs, a company registered in the Republic of Lithuania. Contact: [email protected].
For the purposes of the EU General Data Protection Regulation (GDPR), Codesomelabs is the data controller for personal data processed through SalonRadar.
What data we collect
We collect the following categories of personal data:
Account data
When you create a customer or salon-owner account, we collect:
- Email address
- First and last name
- Phone number (optional for customers; required for salon owners)
- Password (stored as a salted hash; we never store the plain-text password)
- Locale preference
Social login data
If you sign in with Google, Google shares with us your email address, name, profile picture URL, and a stable user identifier. We do not request access to your contacts, calendar, drive, or any other Google service. The complete list of scopes requested is shown to you on Google's consent screen at the moment of authorisation.
Booking data
When you book an appointment, we record the salon you booked, the staff member, the service(s), the appointment date and time, and any free-text notes you provided. We share this data with the salon you booked so they can fulfil the appointment.
Payment data
Payments are processed by Stripe. We do not see or store your full card number, CVV, or bank details. We do receive and store the last four digits of the card, the card brand, the country, and a Stripe customer/charge identifier so we can match payments to bookings.
Technical data
We log IP addresses, user-agent strings, requested URLs, and response codes for security, abuse prevention, and debugging. These logs are retained for up to 90 days.
Cookies
See our Cookie Policy for the cookies SalonRadar sets.
Why we collect data (lawful basis)
| Purpose | Lawful basis (GDPR Art. 6) | | ---------------------------------------------------------------- | -------------------------------------------------------------- | | Create and operate your account | Contract | | Fulfil bookings and notify the salon | Contract | | Send transactional emails (booking confirmation, password reset) | Contract | | Send transactional SMS (booking confirmation, reminders) | Contract (implicit consent on booking; STOP keyword withdraws) | | Send marketing emails | Consent (opt-in; you can withdraw at any time) | | Fraud prevention, abuse mitigation, request logging | Legitimate interest | | Compliance with Lithuanian and EU law (tax, accounting) | Legal obligation |
Who we share data with
We share data only with sub-processors required to operate the service:
- Stripe Payments Europe Ltd (payment processing) — Ireland / EU.
- Resend (transactional email delivery) — EU region.
- Vonage Holdings Corp (transactional SMS delivery — booking confirmation, cancellation, reschedule, and 24h / 2h pre-appointment reminders). We have signed Vonage's GDPR Data Processing Addendum. Consent to receive SMS is implicit in the act of providing your phone number when making a booking; you can opt out at any time by replying STOP to any SMS, after which we permanently flag your account and stop sending. We will never send marketing SMS.
- Google LLC (only if you choose to sign in with Google) — see Google's privacy policy.
- Hosting provider in the European Union.
We never sell your data. We never share it with advertising networks or data brokers.
The salons you book with receive only the data they need to fulfil your appointment (name, contact details, service, date/time, your notes). Each salon is an independent data controller for the data they receive from us.
How long we keep data
| Data | Retention | | ------------------------- | ------------------------------------------------------------------ | | Account data | Until you delete your account, then up to 30 days in soft-deletion | | Booking history | 7 years (required by Lithuanian accounting law) | | Payment records | 10 years (required by Lithuanian accounting law) | | Request logs | 90 days | | Marketing consent records | Until withdrawn + 12 months |
Your rights
Under GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectify — correct inaccurate data.
- Erase — request deletion of your data ("right to be forgotten"), subject to legal retention requirements above.
- Restrict processing — ask us to pause processing in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Object — to processing based on legitimate interest, including direct marketing.
- Withdraw consent — at any time, where consent is the lawful basis.
- Complain to the supervisory authority — the Lithuanian State Data Protection Inspectorate (VDAI).
To exercise any of these rights, email [email protected]. We respond within 30 days.
International transfers
Our infrastructure and sub-processors operate within the European Economic Area. If a sub-processor transfers data outside the EEA, the transfer is governed by Standard Contractual Clauses approved by the European Commission.
Children
SalonRadar is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe we have, please contact [email protected] and we will delete the data.
Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. We will notify you of material changes by email or via a banner in the app.
Contact
For any privacy-related question or to exercise your rights:
- Email: [email protected]
- Postal: Codesomelabs, Lithuania (full address available on request)