1. Who we are, and our role in your data
You are contracting with Saponly, a trading name of an unincorporated sole proprietorship operated by Shakib. It is operated from Bangladesh, and has no office or registered address in the UAE or elsewhere in the Gulf. These terms are governed by the laws of Bangladesh.
For your salon’s own account data — your login, your services, your prices, your billing records — Saponly is the controller. For your customers’ data, your salon is the controller and Saponly is a processor acting on your instructions; see section 7.
Because there is no company, there is also no separate legal person standing between you and the operator. Data requests, complaints and breach notifications all reach the same person, at our contact page, and are answered by them rather than routed to a department.
2. Data we collect
- Salon information — name, location, hours, branding, settings.
- Services — names, descriptions, prices, durations.
- Staff — names, roles, and the services they perform.
- Customers — name, phone number, and booking history for the salon.
- WhatsApp messages exchanged through the AI receptionist, and booking requests created from them.
- Support and billing information you provide to us.
3. Why we process it
We process this data to:
- Run the AI receptionist and answer customer questions.
- Capture and manage booking requests and reminders.
- Provide the owner dashboard, support, and billing.
- Keep the service secure and prevent abuse or prohibited use.
4. Third-party processors
We rely on a small number of providers to operate Saponly. They may process data on our behalf under their own terms:
- Meta Platforms (WhatsApp Business Platform) — whatsApp message delivery and business messaging APIs.
- OpenAI — generating AI receptionist replies.
- Vercel — application hosting.
- Cloudflare — dNS, TLS termination and CDN in front of saponly.com.
- Supabase — postgres database hosting.
- Resend — transactional email.
- Payoneer — hosted payment page for Saponly invoices, if you choose to pay by card.
- cron-job.org — scheduled triggers (reminders, digests).
The full table, including what each one may see, is on our subprocessors page. We add a provider there before it starts processing anything.
5. We do not sell your data
We do not sell customer data. We do not use private customer conversations to train any shared or third-party AI model unless this is explicitly stated and consented to. Customer messages are used to operate the salon’s own receptionist, not to build cross-salon profiles.
6. Data requests (export & deletion)
Salon owners can export their salon’s data at any time from the dashboard (one file, no request needed). To have a salon’s data deleted, contact us via the contact page. Deletion is performed manually by an administrator and removes the salon and its associated records; we confirm when it is done.
Bookings, invoices and usage records are kept for as long as we need them for accounting, refunds and dispute resolution, even after chat content is removed.
6b. How long we keep chat content
Where a retention period is configured for the service, the content of WhatsApp messages (the text, plus any voice transcription or image description) is automatically removed once it is older than that period. The message record itself — who sent it, when, and whether it was delivered — is kept so owners keep accurate history and usage counts without us holding their customers’ words indefinitely.
7. Customer consent is the owner’s responsibility
As the salon, you are the controller of your customers’ data. You are responsible for having an appropriate basis to message your customers on WhatsApp and for honouring their preferences and applicable consent and messaging laws.
8. Security
We take reasonable measures to protect data, but no system is perfectly secure. Tell us promptly if you believe your account has been compromised.
9. Changes & contact
We may update this policy as the product evolves; the “last updated” date above reflects the current version. Questions? Reach us via the contact page.