What we hold, and why

If you are booking an appointment

You are a customer of the salon, not of us. The salon decides what to do with your details; we hold them on their behalf and give them the software.

What is held

• Your name and mobile number. The number is how you are identified — there is no account and no password.
• Your email, if you gave one. It is optional, and it is used to send confirmations and reminders because email arrives when WhatsApp sometimes does not.
• Your appointments: what you booked, with whom, when, and what it cost.
• Notes the salon writes — allergies, colour formulas, preferences. You can ask them what these say.
• Your address, if you book somebody to come to you. It is held against that one appointment, and the people who see it are the person travelling to you and the staff at that business. It is kept for next time only if you tick the box asking us to, and you can ask the business to forget it.
• Whether you missed an appointment or cancelled late. Salons use this to decide whether to ask for a deposit.

What is never held

• Card or bank details. Payments go through Fonepay or Khalti, who handle them — we record that a payment happened and its reference, nothing more. When you scan a QR, you are paying the business directly through your own bank or wallet app; the money never passes through us.
• A password. One-time codes are stored hashed and can never be read back, including by us.

If your appointment is in a calendar

A stylist may connect their own Google Calendar so their day is in one place. If yours does, an entry for your appointment is written to their calendar carrying your name, your phone number, what you booked and any note you left — the same things the salon already sees in its diary. Your email address is never added, so Google never invites you to anything.

In the other direction we read only when that stylist is busy, never what they are doing: times and nothing else, so the system stops offering a slot they have already given away. If they disconnect the calendar, we stop reading it and delete those busy times.

Messages

Confirmations, reminders and cancellations are about an appointment you made and are sent regardless. Review requests and reminders that you are due a visit are optional, need your agreement, and every one carries a link that stops them in one tap — which never silences the messages about your own bookings.

Asking us to stop, or to delete

Ask the salon first; it is their record. If you would rather come to us, write to hello@getyourvibe.app and we will act on it with them. Some things cannot be deleted on request — a tax invoice is a numbered document the Inland Revenue Department requires the business to keep, and we will tell you plainly when that applies.

If you run a salon

• Your business details: registered name, PAN, address and contact details, which appear on the invoices you issue.
• Identity and registration documents collected when you join. These are stored apart from everything the public can reach, have no web address at all, and are readable only by our staff through a screen that checks who is asking.
• Your bank details, used only to pay you what you are owed.
• Your payment gateway keys, if you enter them, so customers can pay you directly. They are encrypted before they are stored, are never shown back to you or to us afterwards — the screen shows only the last four characters — and they are yours to change or remove at any time.
• Your account with us: which plan you are on, what you have been billed and what you have paid.
• Everything your salon records: staff, services, bookings, bills.

Your customers' data is yours, and we do not use it for anything but running your salon. We do not sell it, and we do not use one salon's customers to market to another's.

Where it lives

On servers we control. Each salon's data is separated at the database level, not merely by a filter in the software — one salon cannot read another's, and neither can a mistake in our own code.

Backups are taken daily and kept encrypted. Messages are sent through Google (email) and WasenderAPI (WhatsApp), and payments through Fonepay or Khalti; each of them sees only what is needed to do its part.

Google Calendar

Connecting a calendar is a stylist's own choice and nothing in the product depends on it. We ask Google for the narrowest permission that does the job — managing calendar events and reading the email address of the account being connected — and not for permission to create, delete or share whole calendars.

What we hold is the permission itself: the tokens Google issues, the email address of the connected account, and the busy times read back. The tokens sit in our database, reachable only by our servers, and disconnecting from the calendar screen deletes them and the busy times. You can also revoke it from your own Google account, and the system will say the calendar needs reconnecting rather than quietly ignoring it. We use none of this for anything but the diary, and we give none of it to anybody else.

How long

Appointment and customer records last as long as the salon is with us, and are handed over or deleted when they leave, as they choose. Tax invoices are kept as long as Nepali tax law requires the business to keep them. One-time codes — whether for booking or for signing in to a console — expire in five minutes and are stored hashed. Calendar permissions and the busy times read with them are deleted the moment a stylist disconnects.

Changes

If this page changes in a way that matters, salons are told before it takes effect rather than after.