Back to home

Privacy Policy

Last updated: October 9, 2026

ChairTime is operated by ZEF SOFTWARE SRL. This policy explains what we collect, how we use it, who processes it, and your choices. It covers the ChairTime app and website and salon-branded apps powered by ChairTime, currently Exquisite Salon. Salon-owner subscriptions and trial eligibility apply only where those features are offered; they do not apply to clients booking through Exquisite Salon.

Who we are

ChairTime is a private booking system for beauty salons. Salon owners subscribe to ChairTime and their clients book appointments through the mobile app by scanning a QR code provided by the salon. We are not a marketplace and do not sell appointments to third parties. The service is operated by ZEF SOFTWARE SRL (CUI: 30975520, Str. Ep. dr. Vasile Coman, nr.3, bl.2, sc.B, et.7, ap.58, Oradea, Romania). ZEF SOFTWARE SRL is the data controller. ZEF SOFTWARE SRL also operates the salon-branded (white-label) apps built on the ChairTime platform — currently Exquisite Salon — and is the data controller for those apps in the same way.

What we collect

We collect only the data we need to run the service:

  • Account details — name, email address, optional phone number, and account identifiers. Clerk handles authentication and account management.
  • Optional profile photos that you choose to upload. Clerk stores the image and we keep its link with your profile.
  • Salon details — business name, address, selected map coordinates, services, prices, working hours and time off, including any reason entered by a team member. Google processes address searches and selected coordinates for autocomplete and geocoding.
  • Booking details — service, specialist, appointment dates and times, recurring schedules, booking history, notes, preferences and linked salons. If you book for someone else, we also process the name and contact details you provide for them.
  • Push tokens and installation identifiers used to deliver notifications, and your language and notification preferences. Expo also processes technical installation and app-version information to deliver app updates.
  • Diagnostics — crash reports, errors, performance measurements and technical context such as device model, operating system, app version and events leading to a problem. Sentry receives this information; in the mobile app it can include your signed-in account ID, email address and username. Website diagnostics can also include IP addresses and request information.
  • For ChairTime salon trials — an installation identifier, organization identifier, an approximate area derived from the salon map coordinates, and trial dates, used to prevent repeated free-trial claims.
  • Transactional email records — recipient address, message content and delivery status, used to send and troubleshoot account, trial and subscription messages.

What we don't collect

We have deliberately kept the data footprint small:

  • We never see your payment card details. Stripe handles all payment processing on its own infrastructure.
  • We do not request your device location or track it in the background. Salon locations come from the business address or map point the owner selects.
  • We don't run advertising or marketing trackers. There are no third-party ad pixels in the app or on this website.
  • We don't sell, rent, or share your personal data with data brokers.

How we use your data

We use the data we collect to:

  • Run your account and let you sign in.
  • Show the relevant salon and its authorized team the bookings and client details needed to provide the service; let clients view, change or cancel their own appointments. Specialist profiles and salon details are shown to clients using that salon.
  • Send appointment reminders, confirmations, and other transactional messages.
  • Process subscription payments for salon owners.
  • Keep the service secure, prevent trial abuse, investigate errors and delivery failures, and maintain reliable performance.

Legal bases (GDPR)

We process personal data on the following legal bases:

  • Performance of a contract — most of what we do (creating your account, processing bookings, billing salon owners) is necessary to deliver the service you signed up for.
  • Consent — if we introduce optional features in the future (such as marketing emails or promotional notifications), we will ask for your separate, explicit consent. You will always be able to withdraw that consent.
  • Legitimate interests — securing the service, preventing repeated trial abuse, diagnosing faults and delivery failures, and measuring service reliability. These records can be linked to an account or installation; we do not describe them as anonymous. You can object to processing based on legitimate interests by contacting us.

Service providers

We use the providers below for the stated purposes. Processing on our behalf is governed by applicable data processing terms. Some providers, including payment providers, also process data for their own legal obligations as described in their privacy notices.

International transfers

Some of our sub-processors are based outside the EU/EEA, primarily in the United States. For transfers of personal data outside the European Economic Area, we rely on the safeguards provided by these processors — including the EU-US Data Privacy Framework (where the provider is certified) and Standard Contractual Clauses (SCCs) approved by the European Commission. You can request details about the specific transfer mechanisms in place by contacting us.

How long we keep data

We keep account and booking data while the account is active. Inactive salon cleanup follows the existing schedule: unfinished setup after 4 weeks; an ended trial or plan after about 6 months, with advance emails. Account deletion removes the active account and related booking data. The limited exceptions below have separate retention periods.

  • Trial-abuse records: retained for 12 months (365 days) after the trial ends, including after account deletion. They contain the organization and installation identifiers, approximate salon area and trial dates, not booking history. Expired records stop affecting trial eligibility immediately and are deleted by the daily cleanup.
  • Email delivery records in our email queue: message content, recipient details and delivery events are removed by daily cleanup once they are more than 30 days old, including abandoned messages. Our lifecycle delivery and error records are also removed 30 days after the scheduled send date; future scheduled messages are preserved. The email provider also applies its own retention rules to its delivery logs.
  • Diagnostics: our current Sentry Developer plan retains errors, logs and performance traces for 30 days. Sentry stores these records in the EU. Retention is fixed when a record is received; records received under a different plan keep that plan’s retention period. Previously submitted records are not automatically erased when an app account is deleted. You can contact us about these records.
  • Backups: our scheduled production database backups include file storage and expire after 7 days. Copies in these backups may therefore remain temporarily after deletion from the live service. Service providers also apply their own retention periods to operational logs and backups. Retained copies are not an active account or a way to undo account deletion.
  • Paid salon subscriptions: invoices and transaction records are retained for applicable statutory tax and accounting periods, including records held by Stripe under its own obligations. Client accounts have no subscription payment records.

Account deletion

You can delete your account from the ChairTime or Exquisite Salon app, or contact us if you cannot access it. There is no grace period or account recovery after deletion. Deletion from the live service and the retention exceptions above work as follows:

  • The account profile and its associated appointments, recurring schedules, customer links, push tokens and preferences are removed from the live service. Provider deletion also removes the associated services, working hours and time off.
  • If you own a salon, its organization and associated booking records are removed. Clients also lose the booking history belonging to that salon.
  • Deletion does not immediately erase trial-abuse records, previously sent email records, diagnostics, backups or records retained under legal obligations. Their purposes and retention are described above; they are not retained to restore your account.
  • To request erasure of specific retained records or object to legitimate-interest processing, contact us. We assess the request and explain any applicable exception to erasure.

Your rights under GDPR

If you are in the EU, you have the following rights:

  • Access — ask what data we hold about you.
  • Rectification — ask us to correct inaccurate data. Most fields you can edit yourself in the app.
  • Erasure — delete your account at any time (see above).
  • Restriction — ask us to limit how we process your data.
  • Objection — object to processing based on legitimate interest.
  • Withdraw consent — where processing is based on consent, you can withdraw it at any time by contacting us or adjusting your preferences in the app.
  • Portability — receive a copy of your personal data in a portable format. On the website, Account & security → Your data prepares a JSON file of your own profile and sign-in details, preferences, salon memberships, your appointments as a client and your own billing records, downloadable for seven days. For anything that file does not include, such as notes a salon kept about your visits, email us and we answer within 30 days.

Children

ChairTime is not intended for users under 16. If you believe a child has created an account, please contact us and we will remove it. An adult may book an appointment for a child; in that case we process the booking details the adult provides, without requiring a child account.

Security

Data is encrypted in transit over HTTPS and at rest with our sub-processors. We follow least-privilege access for our own team. No service can promise perfect security, but we take it seriously and regularly review our practices.

Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ANSPDCP within 72 hours as required by GDPR Article 33. If the breach is likely to result in a high risk to you, we will also notify you directly, as required by Article 34, with information about the nature of the breach and the steps we are taking.

Cookies

ChairTime uses only essential cookies that are strictly necessary for the application to function (such as session cookies for authentication). These do not require consent under the ePrivacy Directive because the service cannot operate without them. We do not use any advertising, tracking, or third-party marketing cookies. Vercel Analytics, which we use on the chairtime.studio website, operates without cookies and collects only anonymized, aggregate data.

Changes to this policy

We update the date above when this policy changes and notify you of material changes where appropriate. Where a new use requires consent, we ask separately; continued use does not replace that consent.

Supervisory authority

If you are unhappy with how we handle your data, you can lodge a complaint with the Romanian data protection authority — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro, anspdcp@dataprotection.ro.

Contact

Questions about this policy, or about your data? Contact ZEF SOFTWARE SRL at contact@chairtime.studio.