Privacy Policy
Version 2026-10-03 · Last updated October 3, 2026
DRAFT – requires legal review. This document is a working draft. Bracketed placeholders must be completed by counsel before launch.
This Privacy Policy explains how [LEGAL ENTITY NAME] ("Cherry", "we", "us") handles personal data in the Cherry booking platform (the "Service"). It covers two groups of people:
- Salon users: owners, admins and team members who use the Cherry dashboard. For their account data, Cherry decides how and why the data is used (we are the "controller").
- Clients of salons: people who book an appointment through a salon's Cherry booking page, or whose details a salon stores in Cherry. For this data, the salon is the controller and Cherry processes it on the salon's behalf as its processor or "service provider".
1. Summary
- We collect only what is needed to run bookings and accounts.
- We do not sell personal data and we do not share it for cross-context behavioral advertising.
- We do not use clients' data for our own marketing or to train AI models.
- Data is stored in the United States with the providers listed in our sub-processor list.
- You can ask for a copy of your data, a correction, or its deletion. See section 8.
2. Data we collect from salon users
| Category | Examples | Why we use it | Legal basis |
|---|---|---|---|
| Account | Name, email, password (stored only as a salted hash), Google account ID if you sign in with Google | Create and secure your account | Contract |
| Business profile | Salon name, address, phone, email, logo, cover photo, booking policy | Show your public booking page | Contract |
| Team and schedule | Team member names, titles, bios, photos, contact details, working hours, time off | Run your calendar and booking page | Contract |
| Legal records | Which version of these terms you accepted, when, IP address and browser | Prove acceptance and meet legal duties | Legal obligation and legitimate interest |
| Security and usage | Session tokens (stored as hashes), IP address, browser, request logs, error reports | Keep the Service secure, prevent abuse, fix bugs | Legitimate interest |
| Support | Messages you send us | Answer you | Contract and legitimate interest |
3. Data processed for salons about their clients
When you book through a Cherry booking page or a salon adds you to its client list, the salon may store:
- name, phone number, email address;
- optional details the salon chooses to record, such as birth date, city or neighborhood, social media handle, preferences (days, times, services, team members), tags and notes;
- appointment history: services, team member, date and time, price, notes you add, and photos or text you attach to a booking (for example a reference photo for a haircut);
- the version of the privacy notice shown when you booked.
The salon uses this data to schedule and manage your appointments, contact you about them, and remember your preferences. Cherry processes it only to provide the Service to the salon, following the salon's instructions and our Data Processing Agreement.
Your rights as a client. The salon you booked with is the best place to start for access, correction or deletion requests. If you contact Cherry instead, we will forward your request to the salon and help it respond. Salons can export your data and delete your personal details from Cherry at any time. When a salon deletes a client's personal details, we keep only the anonymized appointment records (service, time and price) for the salon's business records.
Messages. Today Cherry does not send marketing messages to clients. Appointment confirmations and reminders, when enabled by the salon, are transactional. If text or WhatsApp reminders are introduced, we will ask for your consent where the law requires it, and you will be able to opt out at any time.
4. Cookies
We use only strictly necessary cookies: two secure, httpOnly session cookies that keep salon users signed in. We do not use advertising or analytics cookies. If that changes, we will update this policy and ask for consent where required.
5. How we share data
We share personal data only with:
- Service providers (sub-processors) that host and run the Service for us, such as cloud hosting, file storage, error monitoring, email delivery and, when the feature is launched, AI processing of booking photos and text. They may use the data only to provide their services to us under written agreements. The current list, with locations and purposes, is at /legal/subprocessors.
- The salon you book with (for clients) and your own team (for salon users), according to the roles the owner assigns.
- Authorities, when required by law or to protect rights, safety and security.
- A successor, if Cherry is involved in a merger or acquisition, subject to this policy.
We do not sell personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.
6. International transfers
Cherry's team operates from Argentina and the Service is hosted in the United States. Personal data may therefore be accessed from Argentina and stored in the United States, which may not offer the same level of protection as your country. We protect transfers with contractual safeguards, including the model contractual clauses approved by Argentina's data protection authority where applicable. By creating a salon account, you consent to these transfers.
7. Retention
| Data | How long we keep it |
|---|---|
| Account and business data | While the account is active; deleted within 30 days after an owner's deletion request is completed |
| Clients' data | As long as the salon keeps it; the salon can delete it at any time. Deleted after the salon's account closes, as set out in the DPA |
| One-time sign-in codes | Deleted 24 hours after they expire |
| Session records | Deleted 30 days after they expire or are revoked |
| Unaccepted team invitations | Deleted 30 days after they expire |
| Acceptance and privacy-request records | For the life of the account plus 5 years, to prove compliance |
| Backups and logs | Daily database backups are kept for [X days] and then deleted; deleted or anonymized data disappears from backups when they expire. Logs follow the providers' rotation |
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain uses, and to withdraw consent. We do not discriminate against anyone for exercising these rights.
- Salon users: owners can request account deletion in Settings. Anyone can email [email protected].
- Clients of a salon: contact the salon first; you can also email [email protected] and we will pass your request to the salon and support it.
We may need to verify your identity before acting on a request. We answer requests within the time limits of applicable law (for example 45 days under California law).
9. Security
We use industry-standard safeguards, including encryption in transit, salted password hashing, hashed session and access tokens, short-lived access tokens, strict separation of each salon's data, role-based access and the least access needed for our team. No system is perfectly secure; if a security incident affects your data, we will notify the salon and, where required, you and the authorities.
10. Children
The Service is not directed to children under 13 and we do not knowingly collect their data directly. A parent or guardian may book an appointment for a child; in that case the parent provides the information.
11. Information for US state residents
If a salon you booked with is subject to a US state privacy law (such as the California Consumer Privacy Act), Cherry acts as its service provider or processor and helps it respond to your requests. In the last 12 months, for salon users, we collected the categories described in section 2 (identifiers, commercial information about the subscription, internet activity such as logs, and professional information) for the purposes described there. We do not sell or share personal data and we do not use sensitive personal information to infer characteristics about anyone. You may use an authorized agent to make a request on your behalf.
12. Changes
We will post any changes here and update the version date. If a change is material, we will notify salon users by email or in the dashboard and ask them to review and accept the new version.
13. Contact
[LEGAL ENTITY NAME] · [REGISTERED ADDRESS] · [email protected]