Privacy policy
Last updated 15 October 2026
This policy explains how Salonly uses personal data: what we collect, why, who we share it with, how long we keep it and the rights you have. It covers visitors to salonly.co.uk, salons and other businesses that use Salonly and their teams, and anyone who contacts us. If you booked with, or called, a salon that uses Salonly, read section 2 first.
1. Who we are
We are AI Programs Holdings Ltd, a company registered in England and Wales with company number 17516543, whose registered office is at 128 City Road, London, EC1V 2NX, trading as Salonly. We are the controller of the personal data described in this policy, except where section 2 says otherwise.
You can contact us about anything in this policy at hello@salonly.co.uk or by post at 128 City Road, London, EC1V 2NX. We have not appointed a data protection officer, as the law does not require one for a business like ours; the same email address reaches the person responsible.
2. If you are a client of a salon that uses Salonly
Salons, barbers, beauty businesses and clinics use Salonly to take bookings, keep client records, send messages and answer their phone. When you book with one of them, or call them, the salon decides how your information is used and is its controller. We handle it for the salon, as its processor, under a contract that only lets us use it to provide our service to that salon. We never contact you for our own purposes and never sell your information.
What this means in practice:
- When you book online, your name, mobile number, email address and booking go to the salon. If the salon asks for a deposit, you pay it on a secure Stripe page into the salon's own Stripe account; we never see your full card number.
- Messages: the salon sends you booking confirmations, reminders, changes and cancellations by text and email. When you book, you can say no to anything else. If you do not, the salon may also tell you when you are due back and about offers, and every one of those messages has a way to stop them. After your visit you may be asked for a review.
- Your record: the salon keeps your visits, notes and preferences, and may keep colour formulas and allergy (patch) test results. Health information, such as allergies or skin conditions, should only be recorded with your explicit consent.
- If you call: the salon's AI front desk may answer. It normally tells you at the start that calls are recorded. The call is recorded and turned into text, and the AI uses what you say to answer you, book an appointment or take a message. The salon receives a summary and the transcript. The recording, and our voice provider's copy of the transcript, are deleted 90 days after the call.
- How long: the salon keeps your record for as long as it uses Salonly, unless it deletes it sooner; we delete it 90 days after the salon stops using us.
For anything about your information, including to see it, correct it or have it deleted, please contact the salon and read its own privacy notice. If you contact us, we will pass your request to the salon.
3. What we collect, why, and our lawful basis
| Whose data | What we collect | Why | Lawful basis |
|---|---|---|---|
| Website visitors | Internet address, browser and device details, the pages you ask for | To run the website, keep it secure and find faults | Our legitimate interests in running a secure website |
| Website visitors | Visit counts: the page, the site or advert that sent you, the type of device, and a code made from your internet address and browser that changes every day (we do not keep the address itself, and set no cookie for this) | To count visits and see which pages and adverts work | Our legitimate interests in understanding how our website is used |
| Website visitors who allow analytics cookies | How you use the site, through the tools listed in our cookie policy | To understand how the site is used and improve it | Your consent, which you can withdraw at any time |
| Website visitors who allow marketing cookies | Which of our adverts brought you here, and your visit, through the tools listed in our cookie policy | To measure our advertising and show our adverts to people who have visited | Your consent, which you can withdraw at any time |
| Website visitors who try the live call demo | Your voice and what you say to the sample salon's AI front desk, for as long as the call lasts | To run the demo you asked for. We save no booking, message or transcript, and the demo records no audio; our voice provider deletes its own copy of the transcript within a day | Your consent, given when you press the button under the notice that tells you this |
| People who contact us | Your name, email address, phone number, salon name and message | To reply to you | Our legitimate interests in answering enquiries, or taking steps you asked for before a contract |
| People who start signing up | The details you enter on the sign-up page, if you do not finish | To keep your sign-up together and, unless you ask us not to, send one reminder | Our legitimate interests in helping you finish what you started |
| Customers | Your name, salon name, email address, mobile number, address, website, the kind of salon and team size, and the details you enter about your business | To set up and provide the service, and to contact you about your account | Our contract with you |
| Customers' team members | Name, email address and role, given to us by the account owner who invited you | To give you access to the account | Our legitimate interests in providing the service the business asked for |
| Customers | Plan, payments, invoices and the details needed for them (Stripe handles your card; we never see the full number) | To bill you and keep accounting records | Our contract with you, and our legal obligation to keep tax records |
| Customers | What you agreed to at sign-up (which versions of our terms), when, your internet address and browser | To have a record of our contract | Our legitimate interests in being able to show what was agreed, and to defend legal claims |
| Customers | Sign-in records, sessions and a log of important account actions | To keep accounts secure and prevent fraud | Our legitimate interests in keeping the service secure |
| Customers | Your email address, to send tips, product news and offers about Salonly | To tell you about our service | Our legitimate interests in marketing our own similar services to customers (you can opt out at sign-up and in every email) |
| Customers who allow marketing cookies | Your sign-up, with your email address and phone number in scrambled (hashed) form, and the advert you clicked | To tell Google, Meta and Microsoft that one of their adverts led to a sign-up (for Google, "enhanced conversions" and "offline conversion import") | Your consent through the cookie banner |
| Customers who tick the box at sign-up | Your email address in scrambled (hashed) form | To measure and tailor our adverts on Google and Meta, for example so we do not show adverts to existing customers (Google "Customer Match") | Your consent, which you can withdraw at any time |
| Customers who ask us to read their website or a file | The website or booking page address, or the file (such as a price list), you give us, and what we draft from it | To set up your services, prices and front desk answers for you to check | Our contract with you |
You do not have to give us personal data, but without your name, email address and salon details we cannot provide the service.
4. Advertising and the data we share with ad platforms
We may advertise Salonly on Google, Meta (Facebook and Instagram), Microsoft (Bing) and LinkedIn. We only use their tags on our website if you allow marketing cookies in our cookie banner, and nothing is loaded before you choose.
If you allow marketing cookies and then sign up, we tell the ad platform about your sign-up so it can work out which adverts work. With Google we use enhanced conversions, which sends your email address and phone number in scrambled form (hashed with the SHA-256 algorithm, so they cannot be read) so Google can match the sign-up to a click on one of our adverts. We may also report sign-ups to Google later using the advert's click identifier (offline conversion import).
If you also tick the box at sign-up, we may share your email address, in scrambled form, with Google and Meta to measure and tailor our adverts, for example to stop showing our adverts to existing customers. You can withdraw this at any time by emailing us.
Google, Meta, Microsoft and LinkedIn use this information under their own terms, in some cases as separate controllers. You can read how Google uses information from sites that use its services, and manage the adverts Google shows you in Google's My Ad Center. You can change your cookie choices at any time from "Cookie settings" at the bottom of every page.
We never share salons' clients' data with ad platforms.
A salon's clients can sign in to their own area of that salon's booking page with a code we text or email to the number or address the salon already holds for them. We use a cookie to keep them signed in at that salon, and the page suggests when they are due back, a service people often add and a product they may need, worked out only from that client's own visits and purchases at that salon. The salon decides whether the area is on, and a client can ask the salon to delete their details from it.
5. AI and automated processing
Calls to a salon's AI front desk are answered by AI, as section 2 explains. When a salon asks us to set up its services, prices or front desk answers from its website or from a file it uploads, such as a price list, an AI model reads it and drafts them for the salon to check. An AI model can also draft a marketing message from a salon's notes, which the salon checks before sending. Salonly also suggests times to clients who are due back, based on their past visits, which the client can take or ignore.
We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects on them.
6. Who we share personal data with
We share personal data only as this policy describes, and we never sell it. We use these service providers, who act on our instructions under contracts that protect your data:
| Provider | What it does for us | Where |
|---|---|---|
| Twilio (Twilio Ireland Limited) | Phone numbers, carrying calls, and sending texts | United States and Ireland |
| ElevenLabs (Eleven Labs Inc.) | The AI front desk and the live call demo: speech recognition, the AI conversation and the voice | United States (its hosting suppliers may also process data in the European Economic Area or Singapore) |
| Google Cloud, through ElevenLabs | Runs the AI language models for ElevenLabs. Anthropic's Claude writes the replies on calls and in the live call demo, unless a salon chooses another model; Anthropic itself does not receive the calls. If the main model fails or is slow to answer, a backup Claude model takes over, then Google's Gemini. Gemini also reads each call after it ends to pick out the caller's details | United States, European Economic Area or Singapore |
| OpenAI, through ElevenLabs | Writes the replies on a salon's calls, only if that salon chooses an OpenAI model. It is not used as a backup | United States and European Economic Area |
| Anthropic (Anthropic Ireland, Limited) | Reads the websites, booking pages, price lists and other documents salons give us to set up their services and front desk answers, and drafts marketing messages from a salon's notes. It does not handle calls | United States |
| Stripe (Stripe Payments Europe, Limited) | Takes subscription payments, and salons' deposits on their own Stripe accounts. Stripe also uses payment data as a separate controller to prevent fraud and meet its legal duties | United States and Ireland |
| Fasthosts Internet Limited | Hosts our website, database and backups, and sends our emails | United Kingdom |
| Google, Meta, Microsoft, LinkedIn | Analytics and advertising for our own website, only with your consent, as section 4 explains | United States and Ireland |
We may also share personal data with our professional advisers; with the police, regulators or courts when the law requires it or to protect rights and safety; and with a buyer if we sell our business, who would be bound by this policy.
7. Transfers outside the UK
Our own systems are in the United Kingdom. Some of the providers above process personal data outside the UK, mainly in the United States and the European Economic Area. We only make those transfers with a safeguard that UK law recognises: UK adequacy regulations (including the UK-US data bridge for providers certified to it), or the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Email us for a copy of the safeguard that applies.
8. How long we keep it
| Personal data | How long |
|---|---|
| A salon's account, clients, appointments, records, messages and settings | While the account is open, then deleted 90 days after the subscription ends (voices a salon designed: 30 days) |
| AI front desk call recordings, and our voice provider's copy of transcripts | 90 days after each call |
| Billing records and the record of what was agreed at sign-up | 6 years, for tax and legal claims |
| Enquiries from our contact form | 2 years |
| Sign-ups that were not finished | 90 days |
| Copies of emails we sent, and the content of webhook messages | 30 days |
| Sign-in links and sessions | Until they expire (sessions last up to 30 days) |
| The security log of account actions | 2 years |
| Records of cookie choices | 1 year |
| Web server logs (internet address, pages requested, browser) | Up to 4 months |
| Visit counts (page, referring site, device type, daily-changing code) | 13 months |
| Our application's error and diagnostic logs | Up to 1 month |
| Database backups | 14 days |
| Marketing preferences, including a request to stop | Kept for as long as we need to respect it |
9. Your rights
You have the right to:
- ask for a copy of your personal data;
- ask us to correct it if it is wrong or incomplete;
- ask us to delete it;
- ask us to restrict how we use it;
- object to how we use it when we rely on our legitimate interests, and to object to direct marketing at any time (we will stop);
- ask for data you gave us in a format you can take elsewhere;
- withdraw your consent at any time, where we rely on it (this does not affect what we did before);
- not be subject to decisions made solely by automated means that have legal or similarly significant effects on you.
To use any of these rights, email hello@salonly.co.uk. It is free. We may ask you to confirm your identity, and we will reply within one month, or tell you within that month if we need longer for a complicated request. Some rights only apply in certain circumstances; if we cannot do what you ask, we will explain why. If your request is about data a salon holds about you as its client, we will pass it to the salon, as section 2 explains.
10. Complaints
If you are unhappy with how we have used your personal data, please complain to us first: email hello@salonly.co.uk or use our contact form. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay.
You also have the right to complain to the Information Commission (the UK regulator, known as the ICO) at ico.org.uk or on 0303 123 1113.
11. Cookies
We use essential cookies to run the site, and analytics and marketing cookies only if you allow them. Our cookie policy lists them all, and you can change your choice at any time from "Cookie settings" at the bottom of every page.
12. Children
Salonly is a service for businesses and is not aimed at children. We do not knowingly collect children's personal data for our own purposes. A salon may hold details of a client who is a child, for example when a parent books for them; section 2 covers that, and the salon is responsible for it.
13. Keeping your data secure
We protect personal data with encryption in transit, single-use sign-in links, two-step sign-in, strict separation between salons' accounts, rate limiting, monitoring, daily backups and automatic deletion on the schedule above. Our data processing agreement describes these measures in more detail.
14. Changes to this policy
We will update this policy when our use of personal data changes. The date it was last updated is shown at the top. If a change is significant, we will tell customers by email before it takes effect.