Privacy Policy

1. Information We Collect

To provide business management tools, direct in-app appointment scheduling, specialist roster management, and public web booking portals, GlowSync processes the following categories of data:

• Salon Owner Account Data: Real names, verified active phone numbers (dial code and number), business emails, salon business names, business operation hours, and address parameters.
• Google Sign-In Data: If you choose to sign in with Google, we receive your name, email address, and Google account identifier from Google to create and authenticate your account. We do not receive your Google password.
• Staff & Specialist Profiles: Specialist names, working schedules, break times, and service assignments configured by the salon owner.
• Customer & Appointment Data: Client names, contact numbers, direct in-app appointment entries, and appointment logs managed by salon owners.
• Public Web Booking Submissions: Information submitted by end-clients through a salon's auto-generated public web page URL—including requested time slots, service selections, specialist preferences, client names, and contact phone numbers.
• Salon Location Data (Sensitive Personal Information): With explicit operating system permissions, we process business address data and geographic coordinates via Flutter frameworks to display salon storefronts and mapping details on public web booking pages.
• In-App Subscription Status: SaaS access tiers for salon management features are processed through Google Play In-App Purchases. We store only transaction status tokens and subscription tier IDs. We do not collect, process, or store financial payment details, cards, or bank records on our servers. All client appointments booked via the app or web portal are settled physically via cash directly at the salon business location.
• System & Identifier Storage:
  • Secure tokens stored via flutter_secure_storage for active session management.
  • Device tokens for Push Notifications (via Firebase Messaging) to alert salon owners of new incoming booking requests and system updates.
  • Local caching via Hive and SharedPreferences for app responsiveness and offline functionality.
• No Analytics or Advertising Trackers: GlowSync and its public booking pages do not use analytics tools, advertising trackers, or third-party tracking cookies. Only strictly necessary technical cookies (such as security and form-protection tokens) may be used to keep the service working securely.

2. Legal Basis for Processing & Data Retention

Our legal grounds for processing personal data depend on the specific feature and user role:

• Performance of a Contract: Operating salon owner accounts, hosting auto-generated public web pages, maintaining specialist availability calendars, and processing direct/web appointment bookings.
• Consent: Accessing location coordinates for public web mapping, sending transactional push notifications, and processing public booking requests submitted by end-clients.
• Legitimate Interests: Preventing automated booking spam on public web links, ensuring server infrastructure stability, and securing backend endpoints.

Roles & Responsibilities: Salon owners decide which customer and appointment data they enter into GlowSync and are responsible for having a lawful basis to do so. For that customer data, Synkn acts on the salon owner's behalf to provide the service. Information an end-client submits through a salon's public booking page is made available to that salon so it can fulfil the booking. For salon owner account data, Synkn determines the purposes of processing.

Data Retention Window: Active salon records, specialist profiles, and client appointment histories are retained while the business account remains active. Executing an account deletion completely purges all associated production server records within 72 hours. Where we maintain database backups, they are kept only for a limited rolling period, after which they are overwritten, and data deleted from production is not restored from them. Because GlowSync does not process payments or collect financial transactions, no financial or billing tax records are retained following account deletion.

3. Data Sharing & Cross-Border Transfers

We do not sell, rent, or trade personal or customer data. Data is shared exclusively with necessary service infrastructure providers:

• DigitalOcean: Primary cloud infrastructure host for databases, API backends, application business logic, and public web booking page hosting.
• Google Firebase: Used strictly for transmitting transactional push notifications and real-time booking alerts to salon owner devices.
• Google Sign-In: Used, if you choose it, to sign in to your account with your Google account.
• Google Play Billing: Used to manage in-app SaaS subscriptions and access tiers.
• Mapping Services: We use flutter_map and geocoding to process address data and display salon locations on public booking pages.

Cross-Border Data Transfers: Data hosted across DigitalOcean cloud clusters and Firebase messaging servers may be processed internationally. We rely on encrypted transport layers and on the contractual safeguards of our infrastructure providers, including Standard Contractual Clauses where applicable, to protect cross-border transfers.

4. Your Global Privacy Rights

Regardless of geographic location, Synkn extends core privacy controls to all business owners and web page users:

• Right to Access & Portability: Request copies of business profiles, specialist records, or web booking logs.
• Right to Rectification: Salon owners can edit business hours, specialist availability, services, and appointment listings directly within the app.
• Right to Erasure: Salon owners can delete and permanently remove their account and all associated data themselves, directly from within the GlowSync app, without contacting us (see Section 6 for the steps). You may also request permanent deletion of business profiles, specialist lists, or public booking submissions by contacting us.
• Right to Withdraw Consent: Revoke device location or notification permissions at any time via operating system settings.

5. Jurisdiction-Specific Provisions

Additional region-specific statutory terms apply to businesses and end-clients operating in these regions:

7. Policy Updates

We may update this Privacy Policy to reflect app updates or regulatory changes. Revisions will be indicated by changing the "Last updated" date at the header. For material changes, we will also notify you through an in-app notice or by email.