Privacy Policy

Tu Salón — Management Platform for Beauty Businesses

Publication URL: /privacy-policy

Version: 1.2 · Effective date: date of publication

Article 1. Data Controller

Legal name: VFG LLC
Tax identifier (EIN): 30-1338936
Address: 447 Broadway, 2nd Floor, #1776, New York, NY 10013, United States
State of incorporation: Wyoming, United States of America
Privacy contact email: management@tu.salon

Article 2. What Personal Data We Collect

2.1 Registration and account data: first and last name, email, password (cryptographic hash), business name, country.

2.2 Operational data entered by the user: the business's client data, suppliers, transactions and cash movements, operational information (services, products, reports).

2.3 Usage and navigation data: IP address, browser type and operating system, pages visited and actions taken, date and time of access.

2.4 Billing data: Tu Salón does not directly store credit or debit card data. It is processed by Stripe under its own privacy and security policies.

2.5 Support assistant conversations. The platform includes a support assistant that answers questions about using the product. The questions the user writes and the answers they receive are recorded, together with the date, the language of the conversation and technical usage data. Users should not enter their own clients' personal data or sensitive information into the assistant, as it is not needed to obtain help with the product.

Article 3. Purposes of Processing

Data is used to: provide, maintain and improve the Service; manage the account and subscription; process payments and billing in the applicable currency; send technical communications and notifications; respond to support enquiries, including those made through the platform's support assistant; comply with legal obligations in the applicable country; and analyse use of the Service using anonymised or aggregated data.

The provider does not use personal data for its own or third-party advertising purposes, and does not sell, assign or rent personal data to third parties for commercial purposes.

Conversations with the support assistant are not used to train artificial intelligence models.

Article 4. Legal Basis for Processing

Processing is based on: the data subject's consent (acceptance checkbox at registration), performance of the Service contract, compliance with legal obligations, and the provider's legitimate interest in the security and improvement of the Service.

Article 5. Cookies

Tu Salón uses exclusively strictly necessary technical and functional cookies, such as session cookies and the language preference cookie. No third-party tracking, advertising or analytics cookies are used.

Article 6. Transfer of Data to Third Parties and Internationally

The provider may disclose personal data only to:

Infrastructure and hosting provider: Railway, where the application and the database run and where images and export files are stored, under confidentiality and data protection agreements.
Language model provider: AWS (Amazon Web Services), used to generate the support assistant's answers. The user's questions and the minimum necessary context are sent to it (salon name, the person's name and role, language, and recent conversation history).
Backup storage provider: Cloudflare, where the encrypted database backups are kept in accordance with Article 8.1.
Email delivery provider: Microsoft, for Service notifications and communications.
Payment gateway: Stripe, for payment processing.
WhatsApp (Meta): when the user enables automatic reminders, the messages are delivered to the business's clients through WhatsApp, which means disclosing the recipient's telephone number and the content of the message to that platform.
Competent authorities, where required by law.

Because the provider is incorporated in the United States and the Service's infrastructure is located there, data is stored and processed in the United States, that is, in a country other than the country of residence of most users. The providers listed above may in turn process data in other countries, in accordance with their own policies. The provider takes reasonable contractual and technical measures to protect data in these transfers.

The provider does not sell, assign or rent personal data to third parties for commercial purposes.

Article 7. Storage and Security

Personal data is stored on Railway infrastructure located in the United States: the application and the database run there, and images and export files are held there. Encrypted database backups are kept with Cloudflare, outside that infrastructure, in its Eastern North America region (United States or Canada), in accordance with Article 8.1.

The provider implements reasonable technical and organisational measures to protect data, including encryption in transit (HTTPS/TLS), password storage using cryptographic hashing, access restricted on a need-to-know basis, and periodic backups.

Article 8. Data Retention

Data is retained while the account is active. Upon cancellation or expiry without renewal, it is retained for a grace period of 7 (seven) days, during which the user may export their information in accordance with Article 12.3 of the Terms and Conditions. After that period, data is deleted, except where it must be retained for legal or accounting obligations.

When clients, users, services or suppliers are deleted within an active account, the records are archived by logical deletion so as not to affect the integrity of the transaction history.

8.1 Backups

So that the Service can be recovered from a failure or data loss, we take encrypted backups of the database on a daily basis. These are retained on a tiered schedule: daily backups for one week, weekly backups for one month, and monthly backups for one year.

Backups are taken as a whole and cannot be selectively modified without compromising their usefulness for a restore. For that reason, when an account is deleted the data is removed from all live systems immediately, but may remain within earlier backups until those expire on the schedule above — that is, for at most one year. Throughout that period the backups remain encrypted and are not used for any purpose other than disaster recovery.

Article 9. Client Data Entered by the User

The personal data of the business's clients is entered by the user and remains under their ownership and responsibility. The user acts as data controller for that data in relation to their own clients, and Tu Salón acts as data processor, processing it exclusively in order to provide the Service, in accordance with the data protection legislation applicable in the user's country.

When the user configures automatic reminders, the Service sends messages to the business's clients using the contact details the user themselves entered. It is the user's responsibility to have a legal basis for those communications.

Article 10. Rights of the Data Subject

The data subject has the right, in accordance with the legislation applicable in their country, to: access their data, rectify inaccurate data, request deletion of their data, object to certain processing, and request portability of their data (rights commonly known as "ARCO rights" in several countries in the region).

Email for privacy requests: management@tu.salon

The provider will respond to requests for access, rectification, deletion, objection and portability within the period required by applicable legislation.

If the data subject considers that their rights have not been addressed, they may lodge a complaint with the data protection authority of their country of residence.

Article 11. Minors

The Service is intended for persons over 18 years of age. The provider does not deliberately collect data from minors.

Article 12. Changes to this Policy

The provider may update this Policy to reflect changes in the Service or in applicable legislation, notifying users by registered email and/or notice within the platform at least 14 (fourteen) days in advance where the changes substantially affect the processing of their data.

Article 13. Contact and Privacy Enquiries

Privacy email: management@tu.salon
Address: 447 Broadway, 2nd Floor, #1776, New York, NY 10013, United States