Privacy Policy

1. Introduction

Hue & Hair is operated by Ascend Leads, LLC ("Hue & Hair," "we," "us," or "our"), based at 2715 E Lehigh Ave, Philadelphia, PA 19125, United States. We are the data controller for the personal information described in this policy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our salon management platform.

Please read this policy carefully. By using Hue & Hair, you consent to the practices described in this Privacy Policy. We respond to data subject requests (access, deletion, rectification, portability) within 30 days of receipt.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, password
• Business Information: Salon name, address, business details
• Payment Information: Billing address, payment method details (processed by Stripe)
• Client Data: Client names, contact information, appointment history, service preferences
• Communication: Messages, support requests, feedback

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, referring URLs
• Cookies: Session cookies, preference cookies, analytics cookies

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send appointment reminders and notifications
• Respond to customer service requests
• Send marketing communications (with your consent)
• Monitor and analyze usage patterns
• Detect, prevent, and address technical issues
• Comply with legal obligations

4. Data Sharing and Disclosure

We may share your information with:

4.1 Service Providers

• Stripe: Payment processing (Stripe DPA, SCCs in place)
• Twilio: SMS notifications (Twilio DPA, SCCs in place)
• Supabase: Database and authentication (Supabase DPA, SCCs in place)
• Resend: Transactional email delivery (booking confirmations, reminders)
• Sentry: Error monitoring and performance tracking (only loaded when you grant analytics consent)
• Anthropic: Powers our in-app support assistant (Claude API). Your support questions are sent to Anthropic for response generation; Anthropic operates a zero-data-retention agreement and does not train on customer data.
• Cloudflare: Bot protection (Turnstile captcha) on sign-in, sign-up, and booking submission. Cloudflare receives your IP address and browser fingerprint solely to score bot likelihood.

4.2 Legal Requirements

We may disclose information when required by law or to:

• Comply with legal process
• Protect our rights, privacy, safety, or property
• Enforce our Terms of Service

4.3 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption in transit (HTTPS/TLS) and at rest
• Row-level security for data isolation
• Regular security audits and monitoring
• Access controls and authentication
• Secure payment processing via Stripe (PCI-DSS compliant)

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide services. We also retain information as necessary to:

• Comply with legal obligations
• Resolve disputes
• Enforce our agreements

Specific retention periods:

• Account data: retained while your account is active. Upon deletion request, data is permanently removed after a 30-day grace period.
• Booking records: retained for the life of the salon account or until the salon owner deletes their account.
• Payment records: retained as required by financial regulations (typically 7 years).
• Communication logs (SMS/email): retained for 90 days for delivery verification, then purged.
• Error logs and session data (Sentry): retained for 90 days.

You may request deletion of your data at any time through the GDPR/Data Rights section of your account settings, or by emailing privacy@hue-and-hair.com.

7. Your Rights (GDPR & CCPA)

Depending on your location, you may have the following rights:

7.1 Right to Access

You can request a copy of your personal data.

7.2 Right to Rectification

You can update or correct inaccurate information.

7.3 Right to Erasure

You can request deletion of your personal data.

7.4 Right to Data Portability

You can request your data in a machine-readable format.

7.5 Right to Object

You can object to certain processing of your data.

7.6 Right to Withdraw Consent

You can withdraw consent for marketing communications at any time.

7.7 Rights for Booking Customers

If you are a customer who booked an appointment through Hue&Hair, you may exercise your rights by contacting the salon directly or by emailing us at privacy@hue-and-hair.com with details of the salon and booking. We will facilitate your request within 30 days.

To exercise these rights, visit the GDPR/Data Rights page in your account settings, use the public Manage your data page, or email privacy@hue-and-hair.com.

8. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you logged in
• Remember your preferences
• Analyze how you use the Service
• Improve performance and functionality

You can control cookies through your browser settings. Note that disabling cookies may affect the functionality of the Service.

9. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies.

10. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect information from children under 16. If we learn we have collected such information, we will delete it.

11. International Data Transfers

Your information may be transferred to and processed in the United States, where our infrastructure providers (Supabase, Stripe, Twilio, Resend, Sentry) operate. For transfers of personal data from the European Economic Area (EEA) or United Kingdom, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with each sub-processor
• Adequacy decisions where applicable

You may request a copy of the relevant safeguards by contacting privacy@hue-and-hair.com.

11a. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Notify affected individuals without undue delay if the breach poses a high risk
• Document all breaches, including their effects and remedial actions taken

If you believe your data has been compromised, please contact us immediately at privacy@hue-and-hair.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

We encourage you to review this policy periodically for any changes.

13. Contact Us

Ascend Leads, LLC (Hue & Hair)
2715 E Lehigh Ave
Philadelphia, PA 19125
United States

• Privacy & data subject requests: privacy@hue-and-hair.com
• General support: support@hue-and-hair.com

We aim to acknowledge data subject requests within 5 business days and resolve them within 30 days, as required by GDPR Article 12 and CCPA §1798.130.