1. Who controls your data?

The legal establishment that owns My Salon, identified at the bottom of this page, is the controller of personal data processed by the platform. Hosting, payment, notification, and messaging providers may act as processors under our instructions and protection agreements.

2. Data we collect

• Account data: name, mobile number, role, and protected authentication data.
• Booking data: service, time, provider, selected staff, group size, notes, and status.
• Location data needed for nearby results, home visits, and directions.
• Transaction amounts and payment, refund, and settlement references. We do not store full card numbers or PINs.
• Partner registration, licensing, bank verification, and supporting documents.
• Support conversations, complaints, attachments, reviews, and audit actions.
• Device type, network address, security and error logs, and notification tokens.

3. Purposes

We use the minimum data needed to create accounts, perform bookings, verify availability, provide directions and home visits, process payments and refunds, send notifications, prevent fraud, support users, protect rights, and improve reliability.

4. Legal basis

Depending on the context, processing relies on consent, contract performance, legal obligation, or a legitimate interest that does not override your rights. Optional permissions can be disabled, although refusing essential data such as a home-visit address may prevent that feature.

5. Location

Location permission is optional for nearby discovery. A customer's precise address is disclosed only as needed to deliver a confirmed home visit and at the appropriate time. It is not made public or used for unrelated advertising without an applicable legal basis.

6. Sharing

Necessary data may be shared with the booked provider, payment, hosting, notification, messaging, mapping, and professional service providers, and authorities where legally required. We do not sell personal data. Cross-border processing is subject to applicable Saudi safeguards.

7. Retention

Data is retained while needed to provide the service, meet accounting and legal duties, protect rights, and resolve disputes. It is then deleted or anonymized under an approved retention schedule. Protected backups may remain for a limited replacement cycle.

8. Security

Controls include role-based access, transport encryption, protection of sensitive bank data, audit logs, login rate limits, and protected backups. No system eliminates every risk, so safeguards and incident response are reviewed regularly.

9. Your rights

Subject to Saudi law and its exceptions, you may exercise rights to be informed, access and receive a copy, correct, complete or update data, request deletion when no longer needed, and withdraw consent where consent is the legal basis.

10. Children

The platform does not invite children to create independent accounts without an appropriate guardian or legal basis. If a child's data is received contrary to this policy, we will verify and take appropriate action.

11. Requests and complaints

Submit a request through in-app support or the contact details below. We verify identity before acting to protect your data and explain the result or any legal limitation. Unresolved privacy complaints may be raised with the competent Saudi authority.

12. Updates

This policy may change as the product or legal requirements change. The latest date appears above, and material changes will be communicated appropriately when required.