Security and data protection
The data of a salon's clients belongs to that salon. We hold and process it only so that the program can work, and only on the salon's instructions. Here is what we do to keep it safe.
Updated 24 September 2026
What is in place
Data protection
A separate database for every salon
Each salon works with its own separate database. Which salon you are in is decided by your login, not by the address of the page, so no one can reach another salon's data by putting a different name in the link.
Encrypted connection
Everything travels over HTTPS with TLS 1.2 or higher. Certificates are issued and renewed automatically, and an unencrypted address is redirected to the encrypted one. For a year after the first visit the browser is not allowed to open the site without encryption. Login cookies are marked Secure and HttpOnly: they never travel in the clear and page scripts cannot read them.
Money and cards
Card numbers are never typed into the program and never stored. The database keeps only the card brand and the last four digits, so one payment can be told from another. Payment itself happens on the payment provider's side. The key to the bank feed, the descriptions of bank transactions and the salon's payment and SMS service keys are stored encrypted; the encryption key is kept apart from the database.
Access
Passwords and signing in
- Passwords are stored as bcrypt hashes. Neither we nor anyone with access to the database can read a password.
- Two-step login: after the password the program sends a six-digit code to your e-mail. It is always on for the salon owner and can be switched on for staff. A device you confirm is remembered for 30 days.
- Five wrong tries for one login name, or twenty five from one address, close the door for 15 minutes.
- A password reset link lives for 30 minutes and is not stored in readable form.
Who sees what inside the salon
The owner decides which sections each member of staff may open, down to single actions inside a section. Only the owner can add staff, change rights and change passwords. Every 90 days the program reminds the owner to review the list of access.
Every sign-in and every change is written to the activity log: who did what and when. Only the owner sees the log (Settings → Activity log); entries are kept for 400 days.
Reliability
Backups
Every night a copy is taken of every salon's database and of the files: client photos, appointment photos and signed documents. Copies are encrypted at once and kept on the server for 30 days. Every night an encrypted archive goes to separate storage outside the server and is kept there for 60 days. On top of that, every 15 minutes a fresh encrypted copy goes to the same storage and is kept for two days: if the server is lost, no more than a quarter of an hour of work is lost. The encryption key is kept apart from the archives.
The server
The program runs on a server in New York, USA. A firewall is on, the server can only be reached with a key, and password guessing is blocked automatically. A vulnerability scan report arrives every week.
Our commitments
How long data is kept, and deleting it
Data is kept while the salon uses the program. The e-mail and SMS journals can be set to clean themselves after a chosen period. The client base and the other tables export to Excel at any time, including after you stop subscribing. At the owner's request we delete the salon's account.
Who receives data
Only the services the salon switched on itself, and only what those services need:
- Stripe and Square — taking payments and deposits.
- QuickBooks — sending clients and sales to the books.
- Anthropic (Claude) — reading a receipt photo when the salon presses «Scan a receipt», and translating a template when the salon asks for it. Only that photo or text is sent, and it is not used to train models.
- Google Calendar — appointments in a master's calendar.
- The mail service — sending e-mail on behalf of the salon. SMS are sent from the salon's own phone: the program only prepares the text and hands the number to no one.
- WhatsApp — messages to clients, if the salon connected it.
- Facebook and Instagram ads — only scrambled fingerprints of a phone and an e-mail, never the numbers themselves.
- Bank feed — the salon's own accounts, not its clients.
- Translation service — the text of message templates, with no client details filled in.
If an integration is off, nothing goes there.
What we do not do
- We do not sell data and do not pass it on for advertising.
- We do not write to your clients ourselves.
- We do not store card numbers.
- We do not read the salon's conversations with clients for marketing.
If something goes wrong
Write to support@kaizerbooking.com. If a salon's data is ever affected, we tell the owner.
See also our Privacy Policy and Terms.