Privacy Policy

Tu Salón — Management Platform for Beauty Businesses

Publication URL: /privacy-policy

Version: 1.1 · Effective date: date of publication

Article 1. Data Controller

Legal name: VFG LLC
Tax identifier (EIN): 30-1338936
Address: 447 Broadway, 2nd Floor, #1776, New York, NY 10013, United States
State of incorporation: Wyoming, United States of America
Privacy contact email: [email protected]

Article 2. What Personal Data We Collect

2.1 Registration and account data: first and last name, email, password (cryptographic hash), business name, country.

2.2 Operational data entered by the user: the business's client data, suppliers, transactions and cash movements, operational information (services, products, reports).

2.3 Usage and navigation data: IP address, browser type and operating system, pages visited and actions taken, date and time of access.

2.4 Billing data: Tu Salón does not directly store credit or debit card data. It is processed by Stripe under its own privacy and security policies.

2.5 Support assistant conversations. The platform includes a support assistant that answers questions about using the product. The questions the user writes and the answers they receive are recorded, together with the date, the language of the conversation and technical usage data. Users should not enter their own clients' personal data or sensitive information into the assistant, as it is not needed to obtain help with the product.

[REVIEW] New article. The assistant was added to the product after the 9 July draft.

Article 3. Purposes of Processing

Data is used to: provide, maintain and improve the Service; manage the account and subscription; process payments and billing in the applicable currency; send technical communications and notifications; respond to support enquiries, including those made through the platform's support assistant; comply with legal obligations in the applicable country; and analyse use of the Service using anonymised or aggregated data.

The provider does not use personal data for its own or third-party advertising purposes, and does not sell, assign or rent personal data to third parties for commercial purposes.

Conversations with the support assistant are not used to train artificial intelligence models.

[REVIEW] The final sentence reflects current operation: questions are sent to the provider in order to generate the answer, and are retained for customer service and usage analysis, without being used for training. Confirm this matches the contractual terms in force with the infrastructure provider.

Article 4. Legal Basis for Processing

Processing is based on: the data subject's consent (acceptance checkbox at registration), performance of the Service contract, compliance with legal obligations, and the provider's legitimate interest in the security and improvement of the Service.

Article 5. Cookies

Tu Salón uses exclusively strictly necessary technical and functional cookies, such as session cookies and the language preference cookie. No third-party tracking, advertising or analytics cookies are used.

Article 6. Transfer of Data to Third Parties and Internationally

The provider may disclose personal data only to:

Infrastructure and hosting provider: AWS (Amazon Web Services), under confidentiality and data protection agreements. This includes the AWS language model service used to generate the support assistant's answers, to which the user's questions and the minimum necessary context are sent (salon name, the person's name and role, language, and recent conversation history).
Payment gateway: Stripe, for payment processing.
Email delivery provider, for Service notifications and communications.
Competent authorities, where required by law.

Because the provider is incorporated in the United States and the Service's infrastructure is located there, data is stored and processed in the United States, that is, in a country other than the country of residence of most users. The provider takes reasonable contractual and technical measures to protect data in these transfers.

The provider does not sell, assign or rent personal data to third parties for commercial purposes.

[REVIEW] The language model service and the email provider were added. International transfer to the United States is now the rule rather than the exception, which in several countries in the region requires express disclosure and, in some cases, consent or specific contractual clauses.

Article 7. Storage and Security

Personal data is stored on AWS (Amazon Web Services) servers located in the United States — the database in the us-east-1 region and files and images in the us-east-2 region.

The provider implements reasonable technical and organisational measures to protect data, including encryption in transit (HTTPS/TLS), password storage using cryptographic hashing, access restricted on a need-to-know basis, and periodic backups.

Article 8. Data Retention

Data is retained while the account is active. Upon cancellation or expiry without renewal, it is retained for a grace period of 7 (seven) days, during which the user may export their information in accordance with Article 12.3 of the Terms and Conditions. After that period, data is deleted, except where it must be retained for legal or accounting obligations.

When clients, users, services or suppliers are deleted within an active account, the records are archived by logical deletion so as not to affect the integrity of the transaction history.

Article 9. Client Data Entered by the User

The personal data of the business's clients is entered by the user and remains under their ownership and responsibility. The user acts as data controller for that data in relation to their own clients, and Tu Salón acts as data processor, processing it exclusively in order to provide the Service, in accordance with the data protection legislation applicable in the user's country.

When the user configures automatic reminders, the Service sends messages to the business's clients using the contact details the user themselves entered. It is the user's responsibility to have a legal basis for those communications.

[REVIEW] Paragraph added. Automatic reminders involve communications to third parties (the salon's clients) and the Policy should disclose this.

Article 10. Rights of the Data Subject

The data subject has the right, in accordance with the legislation applicable in their country, to: access their data, rectify inaccurate data, request deletion of their data, object to certain processing, and request portability of their data (rights commonly known as "ARCO rights" in several countries in the region).

Email for privacy requests: [email protected]

The provider will respond to requests for access, rectification, deletion, objection and portability within the period required by applicable legislation.

[REVISAR] Response deadline for data subject requests. The document does not currently commit to a specific number of days. Several jurisdictions in the region set a statutory deadline — Brazil's LGPD among them — and in some cases it differs by the type of right exercised. State the applicable period, or the correct formulation if deferring to each country's law. Whatever is defined here becomes an operational commitment: the team must be able to meet it, because account deletion is carried out manually.

If the data subject considers that their rights have not been addressed, they may lodge a complaint with the data protection authority of their country of residence.

Article 11. Minors

The Service is intended for persons over 18 years of age. The provider does not deliberately collect data from minors.

Article 12. Changes to this Policy

The provider may update this Policy to reflect changes in the Service or in applicable legislation, notifying users by registered email and/or notice within the platform at least 14 (fourteen) days in advance where the changes substantially affect the processing of their data.

Article 13. Contact and Privacy Enquiries

Privacy email: [email protected]
Address: 447 Broadway, 2nd Floor, #1776, New York, NY 10013, United States

Note on the Country Annex

The 9 July draft included a Country Annex to be completed for each market, with the applicable data protection law, the supervisory authority and the billing currency. That annex has been removed in this version and replaced by the general references in the body of the document — "the legislation applicable in their country of residence" (Article 8 of the Terms, Articles 9 and 10 of the Policy) — and by removing the recommendation not to enable registration in unlisted countries.

A relevant product fact behind that decision: billing is always in United States dollars, in every country. The user's country does not change the price or the billing currency, so the annex's currency column would have been identical across all 29 rows.

[REVIEW] Decision to be confirmed by the lawyer. The alternative was to complete, for each of the 29 enabled countries, the name of the law and the supervisory authority. If the lawyer considers the general clause insufficient in a particular market, the annex should be reinstated at least for that country.