A single policy for every SalonTime surface.

1. Who we are and our role

SalonTime is operated by CloudSafe Consulting Pty Ltd (ABN 45 688 989 791), trading as Salon-On-Time. A participating salon decides what client information its authorised staff enter and how it is used to provide salon services. CloudSafe separately collects and holds information to operate, secure and support SalonTime and is responsible for its own handling of that information.

2. Information we handle

• Ordinary personal information: names, contact details, appointments, service history, formulas, treatment notes, account email, team membership and roles.
• Sensitive or health-related information: allergies, sensitivities, contraindications, prior reactions, patch-test information and safety notes chosen by the client and salon.
• Photographs: private reference images and, only under separate specific salon permission, images approved for marketing channels.
• Salon and operational information: workspace settings, products, inventory movements, timers, notifications, sync activity, app version, security records and support diagnostics.
• Pilot and agreement information: applications, contact and business details, testing feedback, choices, names, roles, typed signatures, timestamps, document snapshots and hashes.

3. Collection sources and purposes

Information may be provided by a client to the salon, entered by authorised salon staff, supplied by an account holder, imported from a selected calendar or compatible salon export, generated by app activity, or supplied in pilot, support and agreement forms.

We use information to provide salon records, appointment matching, processing timers and alerts, staff access, synchronisation, inventory tools, account and agreement administration, security, incident response and support. We do not sell personal information, build advertising profiles or use identifiable client records or photographs for advertising, demonstrations, general product development or AI or model training.

4. Sensitive information and photographs

The salon should provide the current collection notice and obtain a voluntary, informed, current and specific consent where required before entering sensitive information or taking or uploading photographs. Sensitive-information, private-photo and marketing-photo choices are separate. A client may decline optional information or withdraw consent for future use, although missing safety information may mean a requested service cannot safely be provided.

Marketing permission must identify the approved photographs, channels and whether the face may be shown. Private-reference photo consent does not permit publication.

5. Sharing, subprocessors and overseas processing

Salon records are available only to authorised accounts in the same salon workspace according to their role. CloudSafe uses contracted providers for authentication, database and file storage, web hosting, security, email and app distribution. The current provider, purpose, data-category, location and country details are listed in the incorporated Subprocessor Register.

Some provider support, security or network processing may occur outside Australia in the countries recorded in that register. We take reasonable steps to select and contract with providers that maintain appropriate safeguards. We may also disclose information where law requires or where reasonably necessary to protect a person, the service or others.

6. Security and data incidents

We use encrypted network connections, authentication, role-based access, private storage policies, workspace separation, audit records and protected device caching. No online service can guarantee absolute security. Salons must protect devices and credentials and promptly remove unnecessary access.

We assess suspected breaches under the written incident-response plan. We notify an affected salon without undue delay, target an initial notice within 24 hours of awareness, cooperate with assessment and containment, and notify affected people or regulators when required by applicable law.

7. Retention, archiving, export and deletion requests

The verified Retention and Deletion Schedule states the period and trigger for active records, archived records, photos, revision history, backups, audit logs, support material and signing evidence. Archiving is not permanent deletion.

A verified salon or client may request access, correction, export or deletion. A deletion request is not an absolute promise of immediate erasure: information may need to be retained by law, under a legal hold or temporarily in protected backups. We will explain what remains, why and for how long. Account deletion removes sign-in access but records controlled by a salon may remain with that salon.

8. Access, correction and complaints

Clients should first contact their salon about salon-held information. A person may also contact the SalonTime Privacy Officer at support@salontime.au. We will acknowledge the request, verify identity and authority where needed, investigate and respond within a reasonable time. A complainant may also contact the Office of the Australian Information Commissioner and any applicable state regulator after giving us an opportunity to respond.

9. Contact details

Privacy Officer, CloudSafe Consulting Pty Ltd; email support@salontime.au; telephone [SOLICITOR REVIEW: insert verified telephone number]; postal address [SOLICITOR REVIEW: insert verified postal address]. Do not send passwords, formulas, treatment notes or photographs in an unencrypted support email.

10. Children and changes

SalonTime is for professional salon teams and is not directed to children. A salon should record information about a minor only where appropriate and with the authority required for the service and information. We will give participating salons reasonable notice of a material policy change; each version and effective date will be retained with relevant signing evidence.