1. Introduction
CueConnect is designed for wig salons, hair replacement studios and related service businesses. This policy applies to information processed through our website, web application, related services and communications (collectively, the "Service").
Two categories of people interact with the Service: (a) salon owners, managers and staff who operate a workspace ("Salon Users"); and (b) the salon's own clients whose information Salon Users enter into the Service ("Salon Clients"). Salon Clients do not create accounts with CueConnect. Salon Users are the data controllers for information they enter about Salon Clients; CueConnect acts as the data processor for that information.
2. Information we collect
Information Salon Users enter
Salon Users enter operational data into their workspace. This includes, without limitation:
- Salon information — business name, brand assets, locations, hours of operation and preferences.
- Appointment data — scheduled services, staff assignments, durations, statuses, notes and history.
- Invoices & payment records — line items, amounts, methods (cash, card, check, bank transfer, store credit, etc.), balances and receipts. CueConnect does not currently process card payments directly.
- Inventory — wig SKUs, unique item codes, statuses, movements and repair history.
- Employee information — names, roles, contact details, working hours and permission assignments provided by the Salon User.
- Salon Client records — names, phone numbers, email addresses, service history, formulas, measurements, and notes entered by staff.
- Client photographs and uploaded files — images, documents and attachments uploaded by Salon Users to a client record or workspace.
Account information
When a Salon User creates an account we collect their name, email address, and a hashed password (or, when using single sign-on, only the information the identity provider returns to us).
Usage analytics
We collect basic product analytics — pages viewed, features used, error events, approximate timing — so we can improve performance, reliability and usability. Where possible this information is aggregated or pseudonymised.
Device information
We automatically receive information sent by your browser or device, including IP address, browser type and version, operating system, referring pages, and timestamps. This information is used for security, diagnostics and rate limiting.
Cookies
We use strictly necessary cookies to keep you signed in and to protect the Service. See our Cookie Policy for details.
3. How we use information
- To provide, maintain and improve the Service.
- To operate salon workflows entered by Salon Users (appointments, invoices, inventory, communications).
- To send transactional communications — appointment reminders, confirmations, verification codes and account-related notices.
- To secure the Service, prevent fraud and abuse, and enforce our Terms.
- To respond to support requests and diagnose issues.
- To comply with legal obligations and lawful requests.
We do not sell personal information. We do not use Salon Client data to build advertising profiles. Mobile phone numbers are never sold, rented or shared with third parties for marketing purposes.
4. How we protect information
Encryption
Data is transmitted over TLS between your browser and our servers. Data at rest in our managed database and object storage is encrypted using industry-standard encryption provided by our infrastructure providers.
Cloud storage
Salon workspaces are hosted on reputable cloud infrastructure providers (see "Third-party services" below). Each workspace is logically isolated using row-level security so that data belonging to one salon is not accessible to another.
Access controls
Access to production systems is restricted to authorised personnel who need it to operate and support the Service. Salon Users control internal access to their workspace through role-based permissions.
5. Data retention
We retain workspace data for as long as the account is active. When a subscription ends, workspace data may be retained for a limited grace period to allow reactivation or export, then deleted or anonymised, subject to any legal or accounting obligations that require longer retention.
Salon Users may delete individual records (clients, appointments, invoices, etc.) at any time from within the Service, subject to legal retention requirements (for example, invoicing records may need to be retained for tax purposes).
6. International users
CueConnect is operated from United States. If you access the Service from outside this jurisdiction, you understand that your information will be transferred to, stored and processed in countries where our infrastructure providers operate. We take reasonable steps to ensure that any such transfer is protected by appropriate safeguards.
7. GDPR (European Economic Area & United Kingdom)
If you are located in the EEA or the UK, the General Data Protection Regulation gives you certain rights over your personal data, including the right to access, rectify, erase, restrict or object to processing, and the right to data portability.
For information Salon Users enter about Salon Clients, the Salon User is the data controller and CueConnect acts as the data processor. Requests from Salon Clients should generally be directed to the salon that holds their record; CueConnect will assist the salon in fulfilling the request.
Our lawful bases for processing include performance of a contract (providing the Service), legitimate interests (security, product improvement) and consent (where required, for example for certain communications).
8. CCPA awareness (California residents)
If you are a California resident, the California Consumer Privacy Act, as amended, gives you the right to know what personal information is collected, to request deletion of personal information, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. CueConnect does not sell personal information and does not share personal information for cross-context behavioural advertising.
9. Children's privacy
The Service is intended for use by salon businesses and their staff. It is not directed to children under 13 (or the equivalent minimum age in the applicable jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us so we can delete it.
10. Third-party services
We use carefully selected third-party providers to deliver the Service. These include:
- Twilio — SMS delivery for appointment reminders, confirmations, verification codes and other transactional messages.
- Supabase — managed database, authentication and object storage.
- Hosting providers — cloud infrastructure that runs our web application and background services.
- Email providers — transactional email delivery for account and product notifications.
- Stripe (future) — when CueConnect enables card payments, Stripe will process card data. CueConnect does not currently process card payments and does not store full card numbers.
Each of these providers processes personal information solely to provide their service to us, under contract, and is subject to their own privacy commitments.
11. SMS communications
Mobile phone numbers are never sold. Phone numbers are used only for appointment-related communication and salon operations, such as appointment reminders, confirmations, changes, consultation reminders, staff and owner notifications, and verification codes.
No mobile information, including phone numbers and SMS opt-in consent, will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and consent are not sold, rented, or transferred to any third party for their own use. Aggregated or anonymised data that cannot reasonably be used to identify a person is not subject to this restriction.
Message frequency varies. Message and data rates may apply. Recipients may reply STOP at any time to unsubscribe, or HELP for assistance. Opting out stops SMS from the salon workspace except for messages that are legally required (for example, certain regulatory or security notices).
See our SMS Terms for full details.
12. Your rights
Depending on your location, you may have rights to access, correct, port, restrict, object to, or delete personal information we hold about you. You may also have the right to lodge a complaint with a supervisory authority.
Salon Clients: because your record is held by the salon you visit, please contact the salon directly. If you cannot reach them, contact us and we will help route your request.
13. Deletion requests
Salon Users may request deletion of their workspace by contacting privacy@cueconnect.studio. We will confirm the request, verify identity, and delete or anonymise personal information within a reasonable period, subject to any legal retention obligations.
14. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated through the Service or by email to Salon Users.
15. Contact us
Questions about this policy or your personal information can be sent to privacy@cueconnect.studio. General support inquiries can be sent to support@cueconnect.studio.
Please contact us by email for our current business address.