Privacy and security

Built for the GDPR

Lean Salon has been built with the GDPR in mind from the very first line of code. Your data stays in the EU, a data processing agreement is included as standard, and your clients' rights are handled in a few clicks.

Updated on 11 November 2026

Data in the EU

All data is stored in Microsoft Azure in Ireland. Each salon is separated from other salons at database level.

Data processing agreement included

Every account comes with our data processing agreement. We announce a new sub-processor at least 30 days in advance.

Right to be forgotten

Anonymise a client in one action. Invoices remain for tax retention, without identifiable data. Access and export are available too.

Retention periods

Choose after how many months of inactivity client data is anonymised automatically. Incomplete bookings are removed after 30 days.

AI with safeguards

Before a WhatsApp message reaches AI, we remove names, contact details and sentences about health. AI providers do not train on this data. Health questions always go to a staff member.

Consent and audit log

Consent for marketing and WhatsApp reminders is recorded with time and source. Every view and change of client data is logged.

Who does what

As a salon, you are the controller of your clients' data. Lean Salon processes that data on your behalf, under the data processing agreement.

Lean Salon provides the technology and the agreements. You provide a privacy notice for your clients and ask for consent where needed. Lean Salon generates a tailored privacy notice for your booking page, based on your own settings.

Documents

Data processing agreement
The agreement between your salon and Lean Salon.
Read
Privacy policy
How Lean Salon handles its own data.
Read
Cookie policy
Which cookies this website uses.
Read
DPIA
Our risk assessment for the WhatsApp assistant and health information.
On request
Record of processing
All processing activities, legal bases and retention periods.
On request
Data breach procedure
In case of a breach, you hear from us within 48 hours.
On request

We send documents on request within 5 working days. Email ….

Sub-processors

These parties process data for Lean Salon. Outside the EU, the Standard Contractual Clauses of the European Commission (SCCs) apply.

Party	Purpose	Location
Microsoft Azure	Hosting, database and sign in	Ireland (EU)
Mollie	Payments	Netherlands (EU)
Mailgun	Sending and receiving email	EU region
Meta (WhatsApp Business Platform)	WhatsApp messages	EU and US, with SCCs
Google (Gemini)	AI, without names, contact details and health information	Global, with SCCs
OpenAI	AI, without names, contact details and health information	US, with SCCs
Anthropic (Claude)	AI, without names, contact details and health information	US, with SCCs
Mistral AI	AI, without names, contact details and health information	France (EU)

Changes

11 November 2026: Health information is removed before a message reaches AI. Data processing agreement version 1.1.
7 October 2026: Data processing agreement version 1.0 at launch.