Ovela
Privacy policy.
Last updated [DATE]Effective [DATE]
Ovela Systems, LLC, doing business as Ovela (“Ovela,” “we,” “us”), provides salon management software. This policy explains what personal information we collect, why, and what rights you have.
Read this first — we play two different roles
This distinction determines who you contact about your information.
| Whose information | Our role | Who decides how it’s used |
|---|---|---|
| Whose informationSalon owners, managers, and staff who create accounts, use our website, or contact us | Our roleBusiness (controller) | Who decides how it’s usedOvela |
| Whose informationSalon clients — people who book appointments, receive services, or pay at a salon using Ovela | Our roleService provider (processor) acting on the salon’s instructions | Who decides how it’s usedThe salon |
If you are a salon client and want to access or delete your information, contact the salon directly. They control it. We will help them respond, but we cannot act on your request without their instruction. Their contact details are on their booking page. If you cannot reach them, write to us at [privacy@___] and we will forward your request and tell you which salon holds your record.
01 / 11
Information we collect
1.1 From salon operators (our customers)
| Category | Examples | Source |
|---|---|---|
| CategoryIdentifiers | ExamplesName, business name, email, phone, mailing address | SourceYou |
| CategoryCommercial information | ExamplesPlan, transaction volume, subscription history | SourceYou, our systems |
| CategoryFinancial information | ExamplesBank account for payouts, tax ID, beneficial ownership details required for payment underwriting | SourceYou |
| CategoryIdentity verification | ExamplesGovernment ID, date of birth, last four of SSN — collected by our payment processor for KYC | SourceYou, via processor |
| CategoryInternet activity | ExamplesLog-ins, pages viewed, features used, device and browser type, IP address | SourceAutomatically |
| CategoryGeolocation | ExamplesApproximate location from IP; precise location only if you enable it | SourceAutomatically or you |
| CategoryAudio | ExamplesSupport calls, if recorded, with notice | SourceYou |
| CategoryInferences | ExamplesUsage patterns used to improve the product and support you | SourceOur systems |
1.2 From salon clients (on behalf of salons)
Processed on the salon’s behalf and under its instructions:
- Name, phone number, email address
- Appointment history, services received, technician preferences, and notes the salon enters
- Purchase and payment history, tips, loyalty balances, gift card balances
- Marketing and messaging preferences and opt-out status
- Any note the salon chooses to record, which may include a stated allergy or sensitivity
Card numbers. Payment card data is captured, encrypted, and tokenized by our payment gateway, [GATEWAY NAME], and processed by our payment facilitator, [PAYFAC NAME]. Ovela does not store, process, or transmit full card numbers, CVV codes, PINs, or magnetic stripe or chip track data. We retain only a token, the card brand, and the last four digits. Identity, banking, and beneficial-ownership information you provide for payment onboarding is collected by [PAYFAC NAME] for its own underwriting and anti-money-laundering obligations, and is subject to its privacy policy at [URL] as well as this one.
1.3 Sensitive personal information
We do not intentionally collect sensitive personal information as defined by the CPRA, other than (a) government identification and financial account details required for payment onboarding, and (b) any allergy or sensitivity note a salon chooses to record about a client. We use this information only for the purpose of providing the Services and do not use or disclose it to infer characteristics — meaning the CPRA right to limit use of sensitive personal information does not apply to our processing.
1.4 Cookies and tracking technologies
We use cookies and similar technologies in three categories:
| Category | Purpose | Examples |
|---|---|---|
| CategoryStrictly necessary | PurposeAuthentication, security, session management, load balancing | ExamplesLogin session, CSRF protection |
| CategoryFunctional | PurposeRemembering your preferences | ExamplesLanguage, saved views |
| CategoryAnalytics | PurposeUnderstanding how the product is used so we can improve it | Examples[ANALYTICS PROVIDER] |
We do not currently use advertising cookies, marketing pixels, or cross-context behavioral advertising technologies. You can manage cookie preferences at [link to cookie settings] or through your browser.
02 / 11
How we use information
We use personal information to:
- (a)create and administer accounts and authenticate users;
- (b)provide the Services — booking, scheduling, client records, point of sale, payments, reporting;
- (c)process payments, payouts, tips, refunds, and disputes;
- (d)send messages to salon clients — appointment reminders, confirmations, receipts, and marketing messages — at the salon’s direction and on its behalf. The salon determines who is messaged and is responsible for obtaining the consents required by law; Ovela provides the sending infrastructure and processes opt-outs;
- (e)provide support and respond to inquiries;
- (f)detect, investigate, and prevent fraud, abuse, and security incidents;
- (g)maintain, debug, and improve the Services;
- (h)produce de-identified, aggregated analytics that do not identify any person or business;
- (i)market Ovela to salon operators and prospective salon operators — never to salon clients;
- (j)comply with legal obligations, including tax, anti-money-laundering, and card network requirements.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
We do not use salon client information to market Ovela, and we do not disclose one salon’s client list to another salon.
03 / 11
When we disclose information
We disclose personal information to:
| Recipient type | Purpose | Examples |
|---|---|---|
| Recipient typeThe salon | PurposeIt is their data | ExamplesThe salon operator whose client you are |
| Recipient typePayment facilitator | PurposeUnderwriting, processing, settlement, fraud prevention, KYC/AML | Examples[PAYFAC NAME] |
| Recipient typePayment gateway | PurposeAuthorization, routing, card tokenization | Examples[GATEWAY NAME] |
| Recipient typeCloud infrastructure | PurposeHosting and storage | Examples[AWS / GCP / Azure] |
| Recipient typeCommunications providers | PurposeSending SMS and email on salons’ behalf, and carrier A2P 10DLC registration | Examples[SMS PROVIDER] / [EMAIL PROVIDER] |
| Recipient typeAnalytics and error monitoring | PurposeProduct improvement, debugging | Examples[___] |
| Recipient typeProfessional advisors | PurposeLegal, accounting, insurance | ExamplesAs needed |
| Recipient typeAuthorities | PurposeWhere legally required | ExamplesSubpoena, court order, lawful request |
| Recipient typeAcquirer | PurposeIn a merger, acquisition, or asset sale | ExamplesSubject to this policy |
Service providers are contractually bound to use personal information only to perform services for us, and are prohibited from selling it or using it for their own purposes.
Legal requests. Where lawful and not prohibited, we will notify the affected salon before disclosing their data in response to a legal request, so they have an opportunity to object.
A current list of subprocessors is at [https://___/subprocessors].
04 / 11
Your California privacy rights
California residents have the following rights under the CCPA as amended by the CPRA:
- Know — what personal information we collect, use, disclose, and the categories of recipients
- Access — a copy of your personal information, including in portable form
- Delete — deletion of your personal information, subject to legal exceptions
- Correct — correction of inaccurate personal information
- Opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of
- Limit use of sensitive personal information — see Section 1.3; we do not use it in a way that triggers this right
- Non-discrimination — we will not deny service, charge different prices, or provide a different quality of service because you exercised a right
How to exercise your rights
- Salon operators and staff: email [privacy@___] or write to the address below.
- Salon clients: contact your salon. See the note at the top of this policy.
Verification. We will verify your identity before acting, typically by confirming information already in our records. We do not require you to create an account to make a request.
Authorized agents. You may use an authorized agent with written permission; we may require you to verify your identity directly.
Timing. We confirm receipt within 10 business days and respond within 45 calendar days, extendable by another 45 days with notice.
Appeals. If we deny your request, you may appeal by writing to [privacy@___] with “Privacy Appeal” in the subject line. You may also complain to the California Privacy Protection Agency or the California Attorney General.
Other states
If you live in a state with a comprehensive privacy law (Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others), you have broadly similar rights, and we will honor them through the same process.
05 / 11
Retention
| Data | Retention |
|---|---|
| DataSalon operator account data | RetentionFor the term, plus [3] years after closure |
| DataSalon client records | RetentionFor the term of the salon’s subscription, then [90] days, then deleted unless the salon requests earlier deletion |
| DataTransaction and payment records | Retention[7] years, as required by tax and financial recordkeeping rules |
| DataSupport communications | Retention[3] years |
| DataSecurity and access logs | Retention[12] months |
| DataBackups | RetentionDeleted on the ordinary backup rotation, no longer than [90] days after deletion from active systems |
We retain information longer where required by law or where necessary to resolve a dispute or enforce our agreements.
06 / 11
Security
We maintain administrative, technical, and physical safeguards including encryption in transit (TLS 1.2 or higher) and at rest, role-based access controls, multi-factor authentication for administrative access, logging and monitoring, regular backups, vendor security review, and an incident response plan.
No system is perfectly secure. If a breach affecting your personal information occurs, we will notify affected individuals and, where required, the salon and regulators, consistent with California Civil Code §§ 1798.29 and 1798.82 and other applicable law. Where Ovela acts as a service provider, we will notify the salon without undue delay and in any event within [72] hours of confirming an incident, so it can meet its own obligations.
07 / 11
Children
The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. Salons should not enter information about a minor client without a parent or guardian’s consent. If we learn we have collected such information without consent, we will delete it. Contact [privacy@___].
08 / 11
International
The Services are offered in the United States and information is processed in the United States. If you access the Services from outside the U.S., you understand your information will be transferred to and processed in the U.S., which may have different data protection laws. [We do not currently offer the Services in the European Economic Area, the United Kingdom, or Switzerland.]
09 / 11
Notice at collection
California requires notice at or before the point of collection.
At the point we collect personal information, we collect the categories listed in Section 1, for the purposes listed in Section 2, retained for the periods in Section 5. We do not sell or share personal information. This policy is our notice at collection and is linked from every page where we collect information.
10 / 11
Changes
We will post changes here with an updated date. For material changes, we will notify salon operators by email at least [30] days before they take effect.
11 / 11
Contact
Ovela Systems, LLCAttn: Privacy
[ADDRESS]
[privacy@___]
[PHONE]