Privacy Policy

1. Scope and responsibilities

This notice covers the IlMioSalone information website and salon-management service. Francesco Fuso, a self-employed professional in Spain, operates the service and is the contact for privacy and data-protection requests. His details appear below.

The operator determines the purposes and means of website enquiries, account administration, service security and his own business records. Salons determine the purposes of processing their customers’ appointments, contact details and treatment records; the service processes those records on the salon’s instructions. Product ownership and these data-processing responsibilities are separate.

2. Information processed

Information you provide may include your name, email, telephone number, business details, trial request, account details and support messages. The product also processes salon staff, customers, appointments, service and payment records, and files or notes that authorised users choose to enter.

Technical information includes IP addresses, browser and device information, authentication and security events, and consent records. Optional usage analytics are described in the cookie policy. Do not send passwords, access tokens or unnecessary customer information in support requests.

A salon is responsible for providing its customers with appropriate information and establishing the basis for processing their data, including any health-related information entered in treatment notes.

• Cookie policy

3. Purposes and legal bases

We use enquiries and account information to respond to requests, arrange trials and provide the requested service, including steps taken before a contract. Account and technical records support secure operation, fraud prevention and troubleshooting on the basis of legitimate interests. Records required by tax, accounting or other applicable law are processed to meet those obligations.

Optional analytics require your consent. Consent to analytics is separate from any permission to receive promotional messages. You can withdraw optional consent without losing access to necessary website functions. Processing performed for a salon follows its documented instructions and applicable data-processing agreement.

4. Meta and WhatsApp

The direct WhatsApp integration is under development and assessment; it is not yet available for general salon onboarding. The proposed service lets authorised salon staff connect a business WhatsApp account and manage one-to-one customer conversations. Controlled development and review tests use agreed test assets.

For an authorised connection, the relevant data can include business and WhatsApp account identifiers, business phone numbers, permissions and access credentials, message text or media, sender and recipient identifiers, message timestamps and delivery status, and message-template information. These data are used for the connection, permitted messaging, delivery reporting, troubleshooting and disconnection. They are not used to access unrelated businesses or sold for advertising.

Controlled tests may connect an eligible WhatsApp Business mobile app number while keeping the mobile app available. This synchronizes WhatsApp contact details and messages sent from the phone with our messaging service. If the business chooses to share previous chats during Meta onboarding, the available history and media are also imported; history sharing can be declined. The assessment does not provide automated AI replies or forward messages to an AI service. Meta also processes information under its own terms and privacy policies.

• Integration status and intended use
• Meta privacy policy

Google Maps address lookup

When address lookup is enabled during trial registration, the street search and address details you enter are sent to Google Maps to suggest and check the salon address. We retain the address you confirm as part of your trial and business information; suggestion lists and raw Google responses are not stored by the application.

• Google Privacy Policy
• Google Maps / Google Earth Terms

5. Access and service providers

Access is limited to authorised salon users, the service operator and people or providers needed to operate and support the service. Infrastructure administration, hosting, database and file storage, transactional email or SMS, and payment processing can involve service providers. Umami is used for optional usage analytics on the service’s analytics infrastructure.

Payment functions use the provider identified in the payment flow. Meta receives the information needed for authorised WhatsApp operations. Data entered into optional features is also subject to the information provided for those features; the WhatsApp assessment does not route messages into AI.

External providers may process data outside the European Economic Area. The applicable recipient information and transfer safeguards, including an adequacy decision or contractual safeguards where required, can be requested from the privacy contact. A provider’s presence in the source code does not mean that every optional service is enabled for your salon.

6. Retention

Account and business information is retained while needed to provide the service and meet applicable legal obligations. Salon customer records follow the salon’s instructions, deletion requests and relevant retention obligations. We do not apply a blanket accounting retention period to all customer data.

The application’s scheduled retention rules cover access telemetry and expired sessions (180 days), security alerts (730 days), communication and closed support content (730 days), consent and privacy-request evidence (2,190 days), and cookie-consent receipts (730 days after their last update). For historical assistant records, conversation and derived-data rules remain 180 and 365 days respectively. These rules include documented legal holds; restricted records needed for an obligation or dispute may remain after an erasure request.

WhatsApp connections, messages, attachments and delivery records use durable application and self-hosted Chatwoot storage. Restarting the service does not delete them. Disconnection stops use of the connection and removes its sending credentials after cleanup; historical conversations remain available until erased under the applicable retention or deletion process. Privacy requests must cover both application and messaging storage, including pending delivery data. Backup and legally retained copies require separate handling; copies held independently by Meta or recipients are outside our deletion controls.

7. Your rights and deletion requests

Subject to the applicable conditions, you may request access, correction, erasure, restriction or portability, object to processing, and withdraw consent. Contact the address below. For a salon customer record, identify the relevant salon so the request can be directed to the responsible controller.

We may request proportionate information to verify your identity. Requests are normally answered within one month; if a lawful extension is necessary, you will be informed. Deletion and disconnection are distinct actions: removing an app permission does not by itself delete every existing copy of data.

You may complain to the Spanish Data Protection Agency (AEPD), or another competent data-protection authority, including in the country where you live or work.

• How to request data deletion
• Spanish Data Protection Agency

8. Changes and contact

This notice will be updated when the service, operator or data practices change. The date identifies the current version. The contact below handles privacy, deletion and support enquiries.

9. Historical assistant records

The former AI assistant features have been retired. Historical records may remain subject to the existing retention rules, access and export requests, erasure procedures and documented legal holds. Retiring these features does not itself erase historical records. Contact the operator below for requests concerning these records.