Privacy

What we store, why we store it, and how to get it back.

No dark patterns, no data resale, and no clauses written to be skimmed past. This is the plain version of how SalonQube handles your data and your clients' data.

Last updated 7 August 2026

Who we are

SalonQube is a salon management platform operated by Smarties & Cookies Technologies Pvt. Ltd. This policy explains what the platform stores, why, who else can see it, and what you can ask us to do with it.

Two different relationships are covered here, and the distinction matters. When you sign up as a salon, we are the data controller for your account — your company details, your login, your subscription. When your staff enter client and business records into the system, you are the controller of that data and we process it on your behalf, under your instructions.

Questions about anything below go to info@salonqube.com and are answered within one business day.

What we collect

We collect what the product needs to work, and we try not to collect anything else.

Category	Examples	Why
Account	Company name, owner email, hashed password, optional two-factor secret, company logo	To create and secure your account and brand your invoices
Branch & staff	Branch name, address, gender scope, branch and admin logins, staff names, role titles, roll numbers, employment type, salary or commission rate, joining date	To run payroll, commissions and per-branch reporting
Operational	Services, prices, deals, products, stock movements, vendors, assets, expenses, investments	This is the business record the product exists to keep
Client	Client name and phone number on an invoice or booking, and the service history that follows from them	To bill, to take bookings, and to show returning-client history at the till
Financial	Invoice totals, payment channel splits, daily balances, subscription payments and gateway transaction references	To reconcile your takings and to bill your subscription
Technical	IP address, browser user agent, sign-in and activity timestamps, error diagnostics	Security, rate limiting, the in-app activity log and debugging

We do not ask for, and the product has no field for, client identity documents, health records or biometric data. Please do not put them in a note field.

We never see or store full card numbers. Card payments are handled entirely by the payment gateway; we receive only a transaction reference and a status.

How we use it

To provide the service: billing, bookings, inventory, payroll, reporting and printing.
To secure accounts: password hashing, optional two-factor authentication, rate limiting, and the activity log that tells you who did what.
To bill your subscription and to tell you before a payment is due.
To answer your messages, bug reports and support requests.
To keep the platform working: diagnosing errors, measuring page performance and fixing what is slow.

We do not sell your data. We do not sell your clients' data. We do not use the records inside your account to advertise anything to you or to anyone else.

What is stored on your own device

SalonQube keeps some data in your browser so the product is fast and so billing survives a dropped connection. None of it is advertising or tracking storage.

What	Where	Why
Session token	Cookie, plus local or session storage	Keeps you signed in. Choosing 'remember me' extends it to 30 days; otherwise it clears when the browser closes.
Offline invoice queue	Browser database (IndexedDB)	Lets the till keep billing without internet. It syncs and clears when the connection returns.
Preferences	Local storage	Theme, sidebar state, printing on/off, selected timezone, and your progress on the public tutorial checklist.

Clearing your browser storage signs you out and discards anything not yet synced. Do not clear it mid-shift on a till that has been billing offline.

Who else sees it

We share data only with the services needed to run the product, and only the part each one needs.

Service	What it receives	Purpose
Payment gateway (JazzCash)	Subscription amount, transaction reference and the payer details required to complete the payment	Collecting subscription payments by card, mobile wallet or over-the-counter
Email provider	Recipient address and message content for verification codes, invites, reports and notifications	Transactional email
WhatsApp Business API (optional)	Only what you configure and send, using your own access token	Client messaging, if you enable it in Company Settings
Hosting and analytics	Page URLs, performance timings, IP address and user agent	Serving the app and measuring whether it is fast

We will also disclose data where the law requires it, or where it is necessary to investigate fraud or a security incident. If that ever happens to your account, we will tell you unless we are legally prevented from doing so.

Inside your own company, visibility follows the panel. A branch account sees only its own branch. An admin sees operations across branches but not the subscription. Only the owner account can see or settle billing. Those boundaries are enforced by the system, not by convention.

How it is protected

Passwords are stored as bcrypt hashes. Nobody — including us — can read them back.
Two-factor authentication is available per branch and is enabled from the owner panel.
Shared admin-access invites are single-use, expire after seven days, and the database stores only a hash of the token, so a database leak never yields a working invite link.
Traffic is encrypted in transit with TLS.
Sensitive public endpoints are rate limited by IP address.
Actions inside the app are recorded in an activity log so unusual behaviour is visible to you, not only to us.

No system is perfect. If we become aware of a breach affecting your data, we will notify you without undue delay and tell you what we know, what we have done, and what you should do.

How long we keep it

While your subscription is active, your business records are kept in full — that is the point of the product.
Deleting a record inside the app is a soft delete first. It sits in Trash where an admin can restore it, and is purged after that.
If a subscription lapses, the account locks rather than deletes. Your data stays intact so that settling the account restores it immediately.
If you close your account, we delete or irreversibly anonymise your data within 90 days, except records we are legally required to keep — typically payment and tax records.
Support emails and bug reports are kept for up to 24 months so we can trace a recurring problem.

Your rights

You can ask us to do any of the following, and we will respond within 30 days:

Give you a copy of the personal data we hold about you.
Correct anything that is wrong.
Delete your account and the data in it, subject to records we must legally retain.
Export your business data in a portable format — most of it you can already export yourself from Statements, Invoices and Salaries.
Object to or restrict a particular use of your data.

If a client of yours asks you to remove their details, you can do that yourself inside the app; you do not need us. Email info@salonqube.com from the address on the account to make any of the requests above.

Children

SalonQube is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 18. If you believe a minor has an account with us, tell us and we will remove it.

Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects how we handle your data, we will tell account owners by email before it takes effect, so you have time to object or to close the account.