This policy explains what personal data mSalon collects when you use our website, the mSalon business app, the staff login and the mSalon client app, why we collect it, and the choices you have. We follow India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.
1. Who we are
mSalon ("mSalon", "we", "us") provides cloud software that salons, barbershops, spas and beauty studios use to manage appointments, billing, memberships, clients, staff and stock.
2. Our two roles
How we handle personal data depends on whose data it is:
- Salon owners and their account. For the details you give us to open and run your mSalon account — your name, salon details, contact details, billing and subscription records — we decide how the data is used, and this policy applies to us directly.
- The salon's clients, staff and leads. Information a salon enters about its own clients, employees, leads and visitors belongs to that salon. The salon decides what to collect and why; we process it only on the salon's instructions to provide the service. If you are a client of a salon and have a question about your data, please contact the salon first — we will help the salon respond.
3. Information we collect
From salon owners
- Account details: name, salon name, email address, phone number, city, address and password (stored in hashed form).
- Business details: GST type and number, tax settings, opening hours, logo and branding images.
- Subscription and payment records: the plan you choose, invoices, and payment status. Card and UPI details are handled by our payment provider; we do not store full card numbers.
Entered by salons about their clients and staff
- Client records: name, phone number, email, gender, date of birth and anniversary, address, membership and package details, appointments, visit and purchase history, bills, dues, wallet balance, loyalty points and notes.
- Staff records: name, contact details, role and permissions, attendance, commissions and payouts.
- Leads, enquiries and visitor logs, including follow-up notes.
Collected automatically
- Log and device information such as IP address, browser type, and the date and time of requests, used to keep the service secure and working.
- Activity records inside the app (for example, who created or changed a bill) so salons have an audit trail.
- If you use the client app, a device token so we can send you push notifications.
When you contact us
If you use the contact form on our website, we collect your name, email, and optionally your phone number and salon name, along with your message and your IP address (to prevent spam).
4. Face and biometric data
Some salons choose to use mSalon's face recognition for client check-in, or connect fingerprint or face-recognition attendance devices for their staff.
- Client face check-in. We store a mathematical representation of a face (a numeric "embedding"), not a photograph, linked to that client's record in that salon's account. It is used only to recognise the client at that salon.
- Staff attendance devices. Matching happens on the salon's device; we receive the attendance event (who checked in, and when) to record attendance.
- A salon that enables these features is responsible for telling people and obtaining their consent before enrolling them, and for honouring requests to remove them.
- When a salon deletes a client, that client's stored face data is permanently erased. A salon can also ask us to remove a person's face data at any time.
5. How we use information
- To provide the service: run calendars, billing, memberships, reminders, reports and the client app.
- To manage your subscription, process payments and send invoices and account notices.
- To provide support and respond to enquiries.
- To keep the service secure, prevent fraud and abuse, and fix problems.
- To understand, in aggregate, how features are used so we can improve them.
- To comply with legal, tax and accounting obligations.
We do not sell personal data, and we do not use a salon's client data to market to those clients ourselves.
6. Who we share it with
We share personal data only as needed to run the service, with providers bound by confidentiality and data-protection obligations:
- Messaging: MSG91, to deliver SMS reminders and notifications that salons send.
- Payments: Razorpay, to process subscription and wallet payments.
- Push notifications: Google Firebase, to deliver notifications to the client app.
- Hosting, email and infrastructure providers that host our servers and deliver emails.
WhatsApp messages started from the app open in WhatsApp on the salon's own device and are then governed by WhatsApp's own terms. We may also disclose information if required by law, to protect our rights or users' safety, or as part of a merger or acquisition (with notice to you).
7. Messages to clients
Salons use mSalon to send appointment reminders, renewal reminders, birthday wishes and campaigns to their clients. The salon decides who receives these messages and is responsible for having its clients' permission and for complying with telecom rules (such as TRAI's commercial-communication regulations). Clients who no longer want messages should ask the salon to stop them.
8. Cookies
We use essential cookies to keep you signed in, protect forms against forgery and remember basic preferences such as light or dark mode. We do not use advertising cookies. You can block cookies in your browser, but signing in will not work without them.
9. How long we keep data
- We keep account and salon data for as long as the account is active.
- If an account is closed or not renewed, we keep the data for up to 90 days so the salon can renew or export it, and then delete it — except records we must keep longer by law, such as tax and invoice records.
- A salon can delete individual client or staff records at any time from within the app.
10. Security
We protect data with encrypted connections (HTTPS), hashed passwords, role-based permissions so each team member sees only what they need, and access logging. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.
11. Your rights
Under the DPDP Act you can ask to access, correct, update or erase your personal data, withdraw consent you have given, and nominate someone to exercise your rights if you cannot. Salon owners can make most changes directly in the app or contact us through our contact page. Clients and staff of a salon should send requests to that salon, which controls their data; we will support the salon in responding.
12. Children
mSalon is for businesses and is not directed at children. Salons that keep records of clients under 18 are responsible for obtaining a parent's or guardian's consent where required.
13. Changes to this policy
We may update this policy as our service or the law changes. We will change the "Last updated" date above and, for significant changes, notify salon owners in the app or by email.
14. Grievance Officer & contact
If you have a question or complaint about how we handle personal data, contact our Grievance Officer through our contact page. We will acknowledge your complaint and aim to resolve it within the time the law requires. If you are not satisfied, you may approach the Data Protection Board of India.