Privacy Policy

Lean Salon provides salon management software, including online booking, a WhatsApp AI assistant, payments, inventory management and business insights, to independent salons and their clients.

Lean Salon is a sole proprietorship (eenmanszaak) registered in the Netherlands, located at Pijnsweg 29, 6419 CH Heerlen, and registered with the Dutch Chamber of Commerce (KvK) under number 42089738.

For the personal data of a salon's clients and staff, the salon is the controller and Lean Salon acts as processor on the salon's behalf. This is set out in our Data Processing Agreement. For our own website, our own customer relationship with salons and the accounts of salon owners and staff, Lean Salon is the controller.

Depending on how you use Lean Salon, we process the following categories of personal data:

• •Salon owner and staff accounts: name, email address and login information (managed via our identity provider).
• •Client data entered by a salon: name, email address, phone number, date of birth (if the salon records it), appointment history and notes.
• •Booking and WhatsApp messages: content of messages exchanged with our AI assistant, used to schedule, reschedule or cancel appointments.
• •Payment data: processed by our payment provider, Mollie. Lean Salon does not store full card or bank details itself.
• •Uploaded documents: purchase invoices forwarded by email, which may contain supplier and product information.
• •Statistics from marketing accounts a salon chooses to connect (Google Analytics, Google Search Console, Google Business Profile and Instagram): figures such as website visits, searches, clicks, profile views and reach. These are aggregated statistics, not data about individual visitors.
• •Support chat in the dashboard: the questions salon owners and staff ask our support assistant, and the answers.
• •Sales chat on our website: your question and recent conversation context, used to answer questions about Lean Salon. No account or phone number is required.
• •Technical data: IP address, browser type and usage data collected via analytics tools on our marketing website, only after consent.

We process personal data to provide the Lean Salon service: to schedule and manage appointments, process payments, send reminders and confirmations, respond to WhatsApp messages, help salons understand how clients find them online, and generate business insights for salon owners.

We also process data to secure the service, to answer support questions, to send invoices for our subscriptions and to comply with legal obligations.

We do not share contact details of clients, such as names, email addresses or phone numbers, with AI providers.

WhatsApp assistant: before a message reaches the AI model, client names, email addresses, phone numbers and bank account numbers are automatically replaced by placeholders. The model receives the conversation with these placeholders, the salon's services and opening hours, and details of the client's most recent appointment (treatment, day and staff member). Lean Salon fills in the real details again only after the model has replied. Other information a client types in the chat, for example a date of birth or a remark about their health, is passed on as written. We therefore ask clients not to share sensitive information in the chat.

Support chat in the dashboard and sales chat on our website: your messages and recent conversation context are sent to the AI provider selected for that feature, as you typed them. These assistants have no access to the data of salons or their clients. Please do not share sensitive information.

Other AI features, such as strategic advice, the CEO report, the daily briefing, reading purchase invoices and product suggestions, work only with aggregated business figures or supplier and product information, never with data of individual clients.

We may use different AI providers for these features and may change provider over time, for example because of pricing, availability or quality. Section 6 lists the providers we currently work with or may draw on. Processing location and retention at the provider depend on the provider and our account settings; we do not promise that all AI processing takes place within the EU.

A salon can connect its Google Analytics, Google Search Console, Google Business Profile or Instagram account to Lean Salon. Lean Salon then reads statistics from that account, such as visits, searches, clicks, profile views and reach, and shows them in the salon's health score, CEO report and marketing overview. We only read data. We do not post, change or delete anything in these accounts.

We use data from these accounts only to provide these insights to the salon that connected the account. We do not sell this data, do not use it for advertising, do not use it to train AI models and do not share it with third parties, except where necessary to provide the service, for security or to comply with the law. Our staff do not read this data unless the salon asks us to (for example for support), it is necessary for security, or the law requires it.

Lean Salon's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.

A salon can disconnect an account at any time in the dashboard. The access tokens are then deleted immediately. Statistics already retrieved remain part of the salon's reports for as long as the salon uses Lean Salon, and are deleted in accordance with section 8.

We work with a limited number of sub-processors, each bound by a data processing agreement, to deliver the service. Each receives only the data it needs for its task:

• •Microsoft Azure: hosting, infrastructure and login (Microsoft Entra), in the Northern Europe region. Stores all data in Lean Salon.
• •Mollie: payment processing. Receives the payment details needed for a payment, such as amount, description and payment method.
• •Mailgun: sending and receiving email. Receives email addresses, names and the content of the emails we send or receive on behalf of a salon, such as confirmations, reminders and forwarded purchase invoices.
• •Meta (WhatsApp Business Platform): WhatsApp messaging. Receives the client's phone number, WhatsApp profile name and the content of WhatsApp messages, including reminders and confirmations (for example first name, treatment and time) and, where relevant, the email address the client uses for a booking or gift voucher. Meta does not receive dates of birth from Lean Salon.
• •Google (Gemini), OpenAI, Anthropic (Claude) and Mistral AI: AI processing as described in section 4.

We aim to host and process data within the European Economic Area (EEA). Our hosting infrastructure (Microsoft Azure) runs in the Northern Europe region.

Some of our sub-processors (including OpenAI and Anthropic, both based in the United States) are located outside the EEA. For these, we rely on Standard Contractual Clauses (SCCs): contract templates approved by the European Commission that legally require the receiving party to protect personal data to a standard equivalent to the GDPR, even though the country itself does not have an EU "adequacy decision". You can read more about Standard Contractual Clauses on the European Commission's website: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

We do not keep personal data for longer than necessary for the purpose it was collected for, or for longer than required by law:

• •Client data of a salon (name, contact details, appointment history, notes): for the duration of the salon's subscription to Lean Salon. During the subscription the salon decides how long inactive clients are kept: the salon can have Lean Salon automatically anonymise a client's personal data after 12, 24, 36, 60 or 84 months without an appointment (switched off unless the salon turns it on). Appointments and invoices are kept without the personal details of an anonymised client. After the subscription ends, we delete or return the data at the salon's choice, as described in the Data Processing Agreement, unless the law requires us to keep it. Deletion can be requested earlier; see section 9.
• •Invoices and payment records: for the period required by the accounting and tax law that applies to the salon or to Lean Salon (in the Netherlands, for example, 7 years).
• •WhatsApp and booking messages: for the duration of the salon's use of Lean Salon. We do not automatically delete or anonymise this content, because the salon may need to refer back to it, for example in case of a dispute about what was agreed. You can request deletion at any time; see section 9.
• •Statistics from connected marketing accounts: for the duration of the salon's use of Lean Salon, together with the salon's other data.
• •Salon owner and staff account data: for the duration of use of Lean Salon. About 3 months after the salon's subscription has ended, or after an account is closed by the user, the personal details of the account are anonymised.
• •Audit log (record of who changed what): 2 years, and 7 years for changes to financial records.
• •Support chat in the dashboard: for the duration of use of Lean Salon, so we can follow up on questions. You can request deletion at any time.
• •Uploaded purchase invoices: for the same statutory retention period as invoices above.
• •Sales chat on our website: we do not save conversations in the Lean Salon database. Recent context and messages are kept temporarily in your browser tab. Context expires after 30 minutes; closing the tab or starting a new conversation removes the local conversation. The AI provider may apply its own retention period.

Under the GDPR, you have the right to access, correct, delete or export your personal data, and to object to certain processing. To exercise these rights, contact us at the email address below. If you are a client of a salon, you can also contact the salon directly; we help the salon handle your request.

You also have the right to lodge a complaint with the data protection authority in your country (in the Netherlands, the Autoriteit Persoonsgegevens).

On leansalon.com, we use cookies for analytics only (Google Analytics and Microsoft Clarity); we do not use advertising pixels. These cookies are only activated once you have given explicit consent via our cookie banner, and you can withdraw this consent at any time via the cookie settings on this website. Our Cookie Policy lists the cookies we use.

Salons using Lean Salon's website feature can enable their own third-party trackers on their own salon website, including Meta, Microsoft, Google, LinkedIn, Snapchat and Pinterest. The same principle applies there: non-essential cookies are only activated after a visitor gives explicit consent via that salon's own cookie banner. For questions about cookies on a specific salon's website, please contact that salon directly.

We use industry-standard technical and organisational measures to protect personal data:

• •Hosting with Microsoft Azure (Northern Europe region), with encryption of data in transit (TLS) and at rest.
• •Passwords, API keys and other secrets are never stored in source code, but managed via Azure Key Vault. Access tokens for connected accounts are stored encrypted.
• •Access to Azure resources uses Managed Identity, avoiding long-lived credentials that could leak.
• •Strict separation of data between salons at the database level (Row-Level Security), so that one salon's data is never accessible to another salon, even in the event of an application-level bug.
• •Role-based access within a salon's own dashboard (for example owner versus staff member), and a record of changes to client data.

We may update this Privacy Policy from time to time. When we do, we update both the date and the version number at the top of this page, so you can always see whether and when something has changed. Earlier versions remain available on request.

Questions about this policy? Email us at legal@leansalon.com.