Privacy Policy

The controller of your personal data is Jan Vancak, Business ID (IČO) 87592193, place of business Na Pancave 530, 538 51 Chrast, Česká republika.

In matters concerning the protection of personal data, you can contact us at the email address info@yoursalon.cz.

This policy covers the website www.yoursalon.eu together with its registration and contact forms, and the YourSalon mobile app for iOS and Android, which is used both by clients looking for a salon and by salons running their business.

YourSalon is an intermediary. When you book, the appointment is performed by the salon, and the salon is a separate controller for the records it keeps about its own clients.

On the website, if you only fill in a registration or contact form:

• the email address you provide,
• the name of your venue or the requested application prefix,
• the content of subsequent communication between you and us,
• technical data related to the operation of the website and the form, for example IP address, time of submission or operational logs.

In the mobile app, for a client account:

• email address and password — the password is never stored as text, only as a cryptographic hash,
• name, telephone number and date of birth, each of which is optional and given by you,
• the identifier of your account,
• your bookings and their history, the salons you save as favourites, the reviews you write, and the messages you exchange with a salon,
• the requests you send to several salons at once, including the position you were searching from.

In the mobile app, for a salon (owner) account:

• the name and email address of the person administering the salon,
• the salon's own business details: name, address, opening hours, services and prices, team members, and the photographs it publishes.

Content published through the app:

• photographs and videos in a salon's portfolio, including before-and-after pairs,
• 24-hour Stories, which are images or short videos,
• profile texts, service descriptions, reviews and public replies to reviews,
• messages in the client–salon conversation.

Location, only when you ask for it:

• the app reads your device's position only when you tap the control that finds salons near you. It is used to rank what you are shown,
• where you send a request to several salons at once, the position you were searching from is stored with that request so the salons can tell whether you are within reach,
• the app never reads your location in the background, and declining the permission leaves the app fully usable through the city picker.

Device and technical data:

• when you turn notifications on, a push token together with the platform, the app language and the app version,
• a device identifier, which we store only as an irreversible hash and never in its original form,
• records of interaction with listings — which salon pages were opened, which phone numbers or directions were tapped, which bookings were started — linked to your account when you are signed in, or to the hashed device identifier when you are not,
• security and operational logs.

Apple Ads attribution (iPhone only):

• a few seconds after its first launch, the iOS app asks Apple’s AdServices interface for a one-time token and sends it to our server, together with a random installation number that the app creates for this purpose and the time it first asked. Our server passes the token to Apple to find out whether the installation came from one of our Apple Ads campaigns. We do not store or log the token,
• if Apple answers that it did not, we keep nothing on our server. If it did, we keep Apple’s answer — the identifiers of our campaign, ad group, keyword and ad, whether the ad was tapped or only viewed and when (to the minute, where Apple reports it), the App Store country the campaign ran in, the ad placement and the type of download — together with the time the app first asked and, if you open the salon-owner part of the app (for example by tapping “I run a salon”), the time of that step. We keep this under a one-way hash of the installation number, never the number itself, and delete it 30 days after Apple’s answer,
• if within those 30 days you use this installation of the app to register or take over a salon as its owner, or to sign in to it as its owner, we attach Apple’s campaign details to that salon — unless the salon already existed before the ad or already has another recorded advertising source. We do this to see which of our own campaigns bring salon owners and how far their salons get, for example whether setup was completed or a subscription started. The details then stay with the salon for as long as it exists (see section 8),
• this never happens for client accounts or salon staff. It does not use the advertising identifier (IDFA) and the app does not ask for permission to track you for it; according to Apple, its answer does not identify you or your device. We do not pass Apple’s details or the installation number to Google or to any other advertising company. The installation number itself stays only in the app on your phone until you uninstall it.

What we do not collect. The app contains no advertising, analytics or crash-reporting software (SDK) from any third party. On iPhone it uses only Apple’s own AdServices interface, and only to find out whether the app was installed from one of our Apple Ads campaigns (see “Apple Ads attribution” above). We do not read your contacts, your calendar, your health data or your browsing outside our own app, we do not use the advertising identifier (IDFA), and the app never asks for permission to track you. Apart from the Apple Ads attribution described above, we do not combine data from the app with data from other companies for advertising or advertising measurement, and we do not sell personal data.

• Providing the service you asked for — your account, bookings, favourites, reviews, conversations with a salon, and publishing a salon's own content: the legal basis is the performance of a contract.
• Showing you salons and available times near you: performance of a contract, at your request. Your position is read only when you ask for it.
• Sending notifications about your bookings, messages and reviews: performance of a contract. You can switch them off in the app and in your device settings at any time.
• Keeping the marketplace safe — handling reports, blocking, automated screening of published content, and security logging: our legitimate interest, and compliance with our obligations under the Digital Services Act.
• Showing a salon how its own listing is performing, in aggregate: our legitimate interest in operating a marketplace that businesses can rely on.
• Handling an enquiry, or steps taken before entering into a contract: performance of a contract or steps taken at your request.
• Accounting, tax and other statutory obligations: compliance with a legal obligation.
• Measuring which of our own Apple Ads campaigns bring salon owners (Apple Ads attribution, iPhone only, see section 3): our legitimate interest in measuring our own advertising. You can object to this processing as described in section 9.

For the ordinary use of the app and for handling a registration or enquiry we do not require separate consent, because the processing is necessary to provide the service you asked for or to comply with legal obligations. Access to the camera, the photo library, your location and notifications is separately asked for by your device, and you can withdraw each of them at any time in your device settings.

Reviews, Stories, portfolio photographs, profile texts and messages are content created by users. A salon's content is published immediately and is visible to other users of the app.

Anyone can report content in the app, with or without an account, because the Digital Services Act requires the notice mechanism to be available to any person. Reports are recorded and reviewed by our operators. Published Stories are additionally screened automatically, which may remove a severe violation; this screening does not delay publication and never replaces the possibility of review by a person.

A signed-in client can block a salon and a salon can block a client. A block prevents messages in both directions and hides the blocked party's content from the person who blocked them.

Where we remove content or restrict an account, we keep a record of the decision and its reason, because Article 17 of the Digital Services Act requires us to be able to explain it afterwards.

A photograph may show a person. A salon may publish a photograph of a client only with that client's consent, and the app asks the salon to confirm this before publishing. If a photograph of you has been published without your agreement, report it in the app or write to info@yoursalon.cz and we will remove it.

The salon you book with, message or review receives what it needs in order to serve you: your name, the contact details you provided, and the appointment itself. From that point the salon is a separate controller for its own client records.

We also use processors who act on our instructions:

• Vercel Inc. — hosting, the application database and file storage,
• Resend, Inc. — delivery of transactional email such as confirmations and password resets,
• Expo (650 Industries, Inc.) — delivery of push notifications to your device,
• Stripe, Inc. — payment processing for salon subscriptions and paid promotion, where a salon buys them. Card details are entered on Stripe's own page and never reach us,
• OpenFreeMap and the OpenStreetMap Foundation — map tiles and address search; when the map is displayed your device requests tiles from these services directly.

Apple and Google operate the app stores. Purchases made in the app are paid through the App Store (Apple) or Google Play (Google) under their own terms, and we receive the transaction details we need to activate the plan or the promotion. On iPhone, our server also passes Apple the one-time Apple Ads attribution token described in section 3, to get Apple’s answer.

We do not pass personal data to third parties for their own marketing.

We aim to use suppliers operating within the EU or EEA. Some of the processors named above are established in the United States. Where a transfer outside the EU or EEA takes place, it happens only under the conditions permitted by the GDPR and with appropriate safeguards, in particular the European Commission's standard contractual clauses.

You can delete your account yourself, from inside the app. You do not need to write to us and you do not need to explain why.

• As a client: Profile → Settings → Security → Delete account. Your account and its personal data are deleted, every session ends immediately, and the email address can no longer be used to sign in.
• As a salon: Business → Account and security → Delete account. Your identity is erased and every session ends immediately. If no other administrator remains, the salon leaves the marketplace at the same moment, and everything belonging to it is permanently deleted after 30 days — a window that exists so a deletion made by mistake can still be undone.

Appointments you have already made remain with the salon after your account is deleted. They are the salon's own business and accounting record, which it is required by law to keep, and they are not ours to erase on your behalf.

Stories become unavailable 24 hours after they are published. If you only filled in a form on the website and no contractual relationship arose, we keep that data for as long as is necessary to handle the enquiry, usually no longer than 12 months from the last communication. Where a contractual relationship exists, we keep the data for its duration and afterwards for the period required by law, in particular for accounting and tax, or for as long as is necessary to protect our legal claims.

Apple Ads attribution: Apple’s answer about an installation is deleted 30 days after we receive it, whether or not it was attached to a salon. Campaign details attached to a salon are kept for as long as the salon exists and are deleted with it — when a salon is deleted, at the latest 30 days later together with everything else belonging to it.

• request access to your personal data,
• request rectification of inaccurate or incomplete data,
• request erasure or restriction of processing where the law permits,
• object to processing based on legitimate interest,
• request data portability where applicable,
• lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, web www.uoou.gov.cz, or with the supervisory authority competent for your country.

To exercise any of these rights, write to info@yoursalon.cz.

We do not use automated individual decision-making or profiling that would have legal effects for you or similarly significantly affect you.

Published Stories are screened automatically for severe policy violations, as described in section 5. That screening can remove a piece of content; it cannot restrict your account, it does not delay publication, and any decision can be reviewed by a person if you contact us at info@yoursalon.cz.