Privacy Policy

YallaSalon is the salon-management software service operated by the contracting entity identified in the Legal Notice. The Legal Notice publishes the operator's bilingual legal identity, commercial-licence details, and support contact. Send privacy, legal, security, support, and complaint requests to support@yallasalon.me.

For most salon-client records, the salon decides why and how the information is used, and YallaSalon processes it to provide the service under the salon's instructions. YallaSalon may act for its own purposes for account administration, platform billing, security, fraud prevention, support, website operations, legal compliance, and service improvement.

The exact controller/processor role depends on the processing purpose. This policy does not transfer YallaSalon's own responsibilities to a salon.

• Account and staff data: names, business contact details, roles, permissions, authentication and access events, and venue membership.
• Salon data: profile, address, hours, services, prices, staff, policies, images, booking settings, and salon-provided tax fields.
• Client and booking data: contact details, appointments, selected services, notes, status, cancellation or no-show information, consent evidence, and communication preferences.
• Financial workflow data: receipt or invoice identifiers, totals, salon tax fields, deposits, payment status, payment links, refunds, disputes, and processor identifiers. Payment providers handle full card details and security codes.
• Messaging, AI, and support data: message content needed for the feature, templates, delivery events, opt-in or opt-out records, support requests, safe diagnostic context, and human-handoff records.
• Website and security data: cookies or local storage, pages and referral context, device/browser details, IP-derived security data, logs, rate-limit events, and abuse indicators.

• Provide and maintain accounts, booking, calendars, client and staff tools, checkout, receipts or invoice fields, reports, imports, exports, and customer links.
• Deliver operational communications and, only with the required authority, marketing communications.
• Process platform billing and support salon payment workflows through configured providers.
• Provide support, investigate errors, improve reliability, and develop safer product and AI-assisted features.
• Prevent fraud, abuse, unauthorized access, spam, provider misuse, and security incidents, and comply with applicable legal duties.

The applicable authority may include performing a contract, taking requested pre-contract steps, complying with law, protecting legitimate security and service interests subject to required balancing, or obtaining valid consent. The exact basis depends on the purpose and role.

Marketing consent must be affirmative, channel-specific, recorded, and withdrawable. A booking, imported contact, or missing opt-out is not itself a marketing opt-in. A later rejection or withdrawal overrides an earlier grant for that scope.

Configured messaging providers may process recipient details, approved templates, message content, delivery events, and opt-out evidence for booking and support workflows. Marketing communications are sent only where the required channel consent, suppression, and opt-out controls apply.

AI-assisted features may send the minimum context needed to a configured AI provider, such as sanitized message text, public salon/service context, booking state, and safe diagnostics. Sensitive actions require authorized product workflows and human review or deterministic controls where appropriate.

Configured payment providers may process card, identity, bank, deposit, subscription, hosted Checkout, refund, dispute, and payout information. YallaSalon stores only the identifiers, states, amounts, metadata, and evidence needed for the applicable workflow, reconciliation, support, security, and legal records; it does not intentionally collect full card numbers or raw security codes in its own forms.

Information may be shared, as needed for the relevant purpose, with the salon and its authorized users; infrastructure, database, storage, payment, messaging, email, analytics, security, support, maps, and AI providers; professional advisers and auditors; authorities where lawfully required; and a transaction successor subject to appropriate safeguards.

Provider and processing arrangements may change as the service evolves. Contact support@yallasalon.me to request available information about current providers or data-processing terms relevant to your account.

Providers may process information in more than one country. Where information is transferred across borders, YallaSalon applies the transfer basis and contractual, technical, and organizational safeguards required by applicable law. YallaSalon does not represent that all information remains in the UAE.

Retention depends on the data category and purpose. Account and operational data may remain while the account is active; payment, invoice, tax, dispute, and commercial records may be kept for applicable legal or accounting periods; and messaging, support, security, webhook, and diagnostic records should be kept only as long as needed for their documented purposes.

Deletion may be limited by identity verification, another person's rights, payment or dispute evidence, fraud and security needs, tax or accounting duties, backups, and a scoped legal hold. YallaSalon must not use one generic period for all categories.

YallaSalon uses layered safeguards designed for authentication, authorization, venue isolation, validation, webhook verification, rate limiting, restricted service credentials, safe logging, monitoring, and incident response. No system can be guaranteed completely secure.

Authorized YallaSalon personnel may access account data only for an assigned support case, security or abuse review, billing or legal request, or another documented service purpose. Sensitive access is restricted by role and scope and is logged by the applicable workflow; it must not be used for unrelated purposes.

Necessary cookies or storage support sign-in, session security, preferences, and core workflows. Where enabled, Vercel Analytics and Speed Insights help measure public-site usage and performance. Tokenized customer links, private account and admin routes, API paths, and sensitive query values should be excluded from public analytics and replay.

Browser controls can block or delete cookies, but blocking necessary storage may prevent sign-in or core workflows. Optional analytics or marketing storage must follow the applicable consent posture and actual runtime configuration.

With a user's separate affirmative choice, the YallaSalon Business mobile app may send Amplitude an opaque random analytics subject, normalized screen and feature interactions, approximate foreground dwell, workflow outcomes, bounded performance measurements, privacy-safe error codes, and coarse app, platform, operating-system, locale, network, role, plan, and scope categories. Amplitude does not receive the user's YallaSalon account identifier or salon, staff, customer, appointment, invoice, payment, Meta, Stripe, email, phone, message, note, search, media, token, URL, or precise location values through this optional product-analytics design.

Product analytics begins off, is not required to use YallaSalon, and can be refused, disabled, or withdrawn in Profile. The selected Amplitude project processes in the United States. Product events are retained for no more than 24 months, subject to a shorter configured provider limit. An authenticated user may request deletion of the opaque Amplitude subject through the mobile privacy controls. Essential first-party security and reliability telemetry is separate from this optional choice.

Amplitude Session Replay and interaction-recording collection are not part of this release and remain disabled. Enabling them later requires a separate reviewed release, a fresh affirmative choice, conservative masking and route restrictions, a short-lived server switch, provider-retention controls, and physical iOS and Android privacy testing.

Subject to the applicable law and verified identity, a person may request information or access, correction, erasure, restriction, portability, objection, withdrawal of consent, a stop to direct marketing, or review of qualifying automated processing. Some salon-client requests should begin with the salon because the salon controls the relevant booking record; YallaSalon will assist as required for its role.

Send privacy and data-processing requests to support@yallasalon.me. Describe the account, salon, booking, or contact context without emailing unnecessary identity documents, passwords, OTPs, full card data, secrets, or private exports.

YallaSalon is business software and is not directed to children. If a salon records a minor's information for a legitimate appointment, the salon must establish the appropriate lawful basis and any required parent or guardian authority, while YallaSalon applies the safeguards required for its role.

A material update receives a new immutable release identifier and any notice or reacceptance required by applicable law or the nature of the change. Contact support@yallasalon.me for privacy matters, support@yallasalon.me for security reports, support@yallasalon.me for legal notices, and support@yallasalon.me for general support or complaints. You may also contact a competent regulator where applicable.