Privacy Policy

This Privacy Policy explains how Destilio handles personal data when people use a Destilio-powered public booking page or related Destilio booking features. A participating Salon may also have its own privacy obligations and policies for the services it provides.

Depending on the feature used, information may include:

• Name, phone number and email address.
• Selected Salon, services, professional, appointment date and time.
• Booking status, cancellation, rescheduling and no-show information.
• Email-verification and booking-security metadata.
• Priority Booking request, deposit and payment-status information where enabled.
• Support messages and information you choose to provide when contacting support.
• Technical and security information reasonably necessary to protect the service.

Personal data may be used to:

• Create, confirm and manage appointments.
• Verify an email address and help reduce fake or abusive bookings.
• Show the client the phone number they are confirming for the booking.
• Send transactional messages such as verification codes, confirmations and reminders.
• Provide booking information to the Salon that will provide the service.
• Process or record payment status where online payment is enabled.
• Prevent fraud, abuse, security threats and misuse of Destilio.
• Provide support, troubleshoot problems and improve reliability.
• Comply with legal obligations and protect legitimate rights and interests.

A participating Salon is responsible for the professional services it provides and for how it uses client information in its own business. Destilio provides the technology used to manage bookings. Depending on the specific processing activity and applicable law, the Salon and Destilio may have different data-protection roles. These roles should be reflected in the final production legal documentation and any required data-processing agreements.

Information may be shared where reasonably necessary with:

• The Salon and relevant professional involved in your appointment.
• Service providers that support hosting, database, email, security or communications.
• Payment providers where online or Priority Booking payment is enabled.
• Authorities or other parties where disclosure is required by law or necessary to protect legal rights or safety.

Service providers should receive only the information reasonably necessary for the service they provide and should be subject to appropriate contractual and security safeguards.

Verification codes, booking confirmations, reminders, rescheduling notices and cancellation messages are transactional communications necessary to manage a booking. Consent to receive marketing messages should be requested separately where required and is not automatically created merely by making an appointment.

Destilio may send a temporary verification code to the email address entered during booking. The message may display the phone number entered for that booking. Entering the code confirms access to the email address and records that the client confirmed the displayed phone number as correct for the booking.

Destilio may use technical safeguards, verification tokens, booking metadata and other reasonable measures to prevent fake bookings, fraud, automated abuse and unauthorized use. No internet service can guarantee absolute security, but reasonable administrative and technical protections should be maintained appropriate to the risk.

Personal data should be kept only for as long as reasonably necessary for booking operations, customer support, fraud prevention, accounting, dispute handling, legal compliance and other legitimate purposes. Different categories of data may have different retention periods. The final production policy should specify retention periods once Destilio’s legal and operational requirements are finalized.

Depending on the law that applies to you, you may have rights such as access, correction, deletion, restriction, objection, portability or the right to complain to a competent data- protection authority. Some rights can be limited where information must be kept for legal, security, fraud-prevention or dispute reasons.

Destilio and its service providers may process information in more than one country. Where applicable data-protection law requires safeguards for international transfers, appropriate mechanisms should be used.

Destilio public booking is not designed to override parental-consent or age requirements that apply to a Salon’s services. A Salon is responsible for applying any legal or professional consent requirements for minors.

This Privacy Policy may be updated as Destilio features, legal requirements and data practices evolve. The version relevant to a public booking may be recorded with the appointment.

Privacy questions about Destilio can be sent to salonai.support@gmail.com. Questions about a Salon’s own use of your information may also need to be directed to that Salon.