Privacy policy

1. Who we are

SalonMaster is provided by Norveon d.o.o., registered address: street, city, company number MB, tax number PIB. For any question about your data, write to [email protected] or call +381 64 333 51 58.

2. Two roles: ours and the salon's

For the accounts of the app's users and for visits to this site we are the controller: we decide why and how the data is processed.

The data a salon enters about its staff and clients (names, phones, emails, notes, appointments, revenue, pay) is processed for the salon. For that data the salon is the controller and we are its processor: we process it only on the salon's instructions and only to provide the service. If you are a salon's client, send questions and requests about that data to the salon; we help the salon answer them.

3. What data we process

• Visitors to this site: the site uses no cookies, no analytics and no content from other servers. The server keeps technical request logs (IP address, time, page address, browser) for security and fixing faults.
• App users (owners, reception, staff): name, email, role, settings and language; the password is stored only as a hash; the two-step sign-in secret, if you turn it on, is stored encrypted.
• Salon data: salons, services and prices, staff and pay models, revenue and tip entries, costs, the KPO record, appointments and client cards.
• Clients on a salon's page (book.salonmaster.app): email, name, phone, membership of the salon, requests and appointments, chosen language.
• Emails we send: sign-in codes, appointment confirmations and reminders, reports a salon turns on.

4. Why, and on what basis

• To provide the service under the contract with the salon: accounts, sign-in, storing and showing data, emails.
• Legitimate interest: security, preventing abuse (for example limiting sign-in attempts) and fixing errors.
• Legal obligations, where we have them.

We do not sell data, use it for advertising or build advertising profiles.

5. Cookies and browser storage

The salonmaster.app site sets no cookies. The apps set only the cookies sign-in needs, which scripts on the page cannot read:

• sf.session: sign-in to the salon app, 7 days, renewed while you use it, at most 30 days from sign-in.
• sf.client: a client's sign-in on a salon's page, 90 days.
• sf.platform: sign-in to the platform administration, for our team only.

Browser storage (localStorage) keeps only the chosen language. There are no advertising or analytics cookies, so we ask no consent for them.

6. Who we share data with

Only processors that help us provide the service, under contract and only for that purpose:

• DigitalOcean: server and database, data centre in Frankfurt (Germany); database backups.
• Brevo: sending emails (European Union).
• Sentry: error reports from the app, confirm whether it is on and where the data is stored.

European Union countries are considered to provide an adequate level of data protection. We give data to public authorities only when the law requires it.

7. How long we keep it

• Account and salon data for as long as the contract with the salon lasts. After it ends we return the data to the salon or delete it, as the salon instructs, within number days, except what the law requires us to keep longer.
• Database backups are deleted on the provider's schedule, at most number days after deletion from the database.
• Server logs for number days.
• A sign-in code lasts 10 minutes and is deleted as soon as it is used or after five wrong tries; invitations until they expire.

8. How we protect it

All traffic goes over HTTPS. Passwords are stored only as hashes and sensitive fields encrypted. Each company's data is kept apart and no company sees another's. Within a company everyone sees only what their role allows, and two-step sign-in is available to every user.

9. Your rights

You can ask for access to your data, correction, deletion, restriction of processing and data portability, and object to processing based on legitimate interest. Write to [email protected]; we answer without delay and within 30 days at the latest. If you are a salon's client, contact the salon about the data it keeps.

If you think the processing is unlawful, you can complain to the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs).

10. Changes

We tell users by email about material changes to this policy before they take effect. The effective date is at the top of the page.