Privacy

Data collected

We collect strictly what is necessary to operate the service: salon account identity (name, email, phone), salon customer data entered by the salon itself (name, phone, visit history, notes), billing data (plan, payments), technical data (IP address, security logs, browser type).

Purposes

Data is used to: provide access to the service, manage appointments and billing, prevent fraud and ensure security, improve the product in aggregate, communicate with the salon (support, updates). No data is sold or resold.

Legal basis

Processing relies, depending on the case, on the performance of the service contract (account management, billing), on legitimate interest (security, fraud prevention) or on your explicit consent (analytics cookies).

Sub-processors and hosting

To deliver the service, Salloni relies on trusted providers: OVH (hosting, France), Resend (transactional email), Sentry (technical monitoring), PostHog (optional product analytics) and Google Analytics (optional public-page visitor measurement), with analytics subject to your consent. Google operates global infrastructure, and analytics data may be processed outside Morocco and the European Union. Each is bound by contractual confidentiality and security commitments.

Optional public-page visitor measurement

Google Analytics loads only with your consent to measure the public pages visited, using browser and device information and pseudonymous cookie identifiers. We do not send it form contents, private booking-token URLs or account identifiers. Advertising personalization is disabled. The _ga and _ga_* cookies are limited to the host you visit and expire after 365 days without extending that period on each visit. You can withdraw consent on the Cookies page; your choice is requested again after 365 days. Do Not Track and Global Privacy Control signals disable analytics.

How Google uses data from partner sites

Retention

Account data is kept while the account is active, then archived for legally required retention periods before destruction. Salon customer data can be deleted at the salon's request at any time. Technical logs are retained for 12 months.

Your rights

Under loi 09-08 you have rights of access, rectification, erasure, objection and portability over your data. To exercise these rights, write to privacy@gosalloni.com. You may also lodge a complaint with the CNDP (Moroccan data protection authority): www.cndp.ma.

Security

Passwords are stored hashed, sessions are protected by an encrypted token, communications are encrypted in TLS, infrastructure access is restricted and logged. Salloni notifies any security incident affecting personal data within the legal deadlines.

Changes

This policy may evolve to reflect legal developments or new features. Account holders are notified of any material change by email before it takes effect.