Privacy Notice

1. Personal Data We Collect

To provide our salon booking and appointment-management services, we collect the following personal data:

• When booking an appointment (as a guest or a registered user): First name, last name, phone number (with country code), email address, along with the date, time and service(s) requested.
• When creating an account or signing in:
  • Standard sign-in: Name, email address, phone and password (encrypted and handled securely by Firebase Authentication; we do not store passwords in plain text).
  • Sign-in with Google (OAuth 2.0): Full name, email address, email verification status, public profile photo and Google Unique Identifier (Google UID). (To be clear: we neither receive nor store your Google account password.)
  • Sign-in with biometrics / passkeys (WebAuthn): Cryptographic credentials tied to your device (fingerprint, face or PIN). Your biometric data never leaves your device; on our servers we store only a public key and a credential identifier.
  • Profile photo: Optional, uploaded by the user or imported from their Google account.
• Push notifications: A technical browser/device token via Firebase Cloud Messaging (only with the user's express authorization).
• Browsing and web usage metrics: Through Google Analytics, we collect technical data such as anonymized IP address, browser type, operating system, pages visited and time spent on the site.

2. Purposes of Data Processing

The personal data collected will be used for the following purposes:

Primary purposes (essential to the service):

1. To book, confirm, manage and provide the salon services you request.
2. To create and administer personal profiles for reviewing past and future appointments.
3. To authenticate the user's identity and keep the session securely active.
4. To send operational notifications, confirmations and appointment reminders by email (via Brevo) and push notification.
5. To let salon staff consult the daily operational schedule in order to provide the service.

Secondary purposes (optional):

1. To send communications about promotions, seasonal offers, newsletters and maintenance or rebooking reminders by email.
2. To analyze website performance and optimize the browsing experience through anonymous statistics (Google Analytics).

If you do not want your data used for the secondary purposes, you may say so by sending a direct message to the salon or by using the unsubscribe mechanisms included in our automated emails.

3. Transfer of Data to Third Parties

To keep the digital platform running correctly and to send communications, we share data with the following service providers, which act as data processors under strict security standards:

Limited Use of Google Data: Information received through Google APIs (OAuth) is used exclusively for user authentication and profile management. We do not sell or trade your data to third parties, nor do we use it for advertising profiling. You may revoke our application's access at any time through your Google account settings at: myaccount.google.com/permissions.

4. Use of Cookies and Tracking Technologies

Our website uses technical, strictly necessary cookies to keep your session active and ensure smooth browsing. In addition, we use analytics cookies through Google Analytics to understand how users interact with the platform.

You can disable or delete cookies at any time by adjusting your web browser's settings; please note, however, that disabling technical cookies may limit or prevent signing in and the functioning of the booking process.

5. Data Retention

Your personal data will be retained indefinitely for as long as you keep an active account on the platform, or for as long as is necessary to maintain the operational history of your appointments and make future bookings easier for you, or until you request its cancellation or explicit deletion.

6. Procedure for Exercising ARCO Rights

You have the right to know what personal data we hold about you, what we use it for and the conditions of that use (Access); to request that your information be corrected if it is out of date, inaccurate or incomplete (Rectification); to have it removed from our records or databases (Cancellation); and to object to the use of your data for specific purposes (Opposition).

As there is currently no automated module inside the app, the procedure for exercising your ARCO rights is manual and direct. To make any request, you may contact the salon by the following means:

• In person: Plaza Bukáre Interior #8, Perif. Paseo de la República 2761, Cinco de Diciembre, 58280 Morelia, Michoacán.
• Directly: By phone, by WhatsApp message to the salon's contact number, or by direct support email.

Your request must include: the data owner's name, a contact method for our reply, and a clear description of the data over which you are seeking to exercise one of the ARCO rights.

7. Changes to This Privacy Notice

This privacy notice is a provisional technical draft that will be replaced by the definitive legal version issued by our legal team. We reserve the right to modify or update this notice in response to legislative developments or internal policy changes.