Data processing terms
Last updated 23 Oct 2026
This clause forms part of the terms of service. It covers the personal data of your customers that you record in SalonBook ("customer data"). Under the DPDP Act, you are the data fiduciary for customer data and SalonBook is your data processor.
1. Instructions
We process customer data only to provide the service you use: storing and syncing records, making bills and calculating balances, and sending the bills, reminders and receipts you set up. We do not use customer data for our own purposes, advertising or model training.
2. Confidentiality and access
Only staff who need it to support you or run the service can access customer data. Any support view of your salon is read-only, needs a recorded reason, expires after 15 minutes and is logged.
3. Security
- Encryption in transit; encrypted backups.
- Database-level isolation between salons (row-level security).
- Least-privilege access for staff and systems, with audit logs.
4. Sub-processors
We use hosting, messaging (SMS and WhatsApp Business), payment and error-reporting providers. We bind them to equivalent obligations and tell you before adding new ones that receive customer data.
5. Breaches
We tell you without undue delay, and within 72 hours, after we become aware of a personal data breach affecting customer data, with what we know and what we are doing, so you can meet your own duties to the Data Protection Board and your customers.
6. Data principal requests
If a customer asks us to access, correct or erase their data, we will pass the request to you and help you respond.
7. Deletion
When your account is deleted, we delete customer data within 30 days, and from backups within a further 30 days, unless the law requires us to keep it.