Salowa is a salon, spa and tattoo-studio management service published by Mcartus Technologies (“Salowa”, “we”, “us”), India. This policy is governed by Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000. Booking as a customer on book.salowa.com? Your customer account there has its own notice: book.salowa.com/privacy.
Who this policy covers — and who controls what
In plain wordsFor your Salowa account and billing, we are responsible. For the customer records a salon keeps inside Salowa, the salon is responsible and we act only on its instructions.
Under the DPDP Act, roles matter:
- Your Salowa account (owner details, subscription, billing, support conversations, product usage): Mcartus Technologies is the Data Fiduciary and this policy applies directly.
- A salon’s business records (its customers, appointments, invoices, staff): the salon is the Data Fiduciary and Salowa is its Data Processor. We process that data only to run the service for the salon and only on the salon’s instructions — never for our own purposes, never to advertise to its customers, never for another salon, and never sold. The processor terms are written out in full in the Terms of Service (“Your data and responsibilities”): what we do with it, who can see it, which sub-processors touch it, how long we keep it, and what happens when a salon tells us to erase a record. If you are a salon’s customer and want your record changed or deleted, contact the salon first — we help the salon fulfil these requests and forward any request sent to us directly.
Information we collect
In plain wordsWe collect what you type in to run your salon, basic technical data to keep the service working, and nothing we don't need.
- Website visits: standard technical information (IP address, browser type, pages viewed) to serve pages securely, measure performance and prevent abuse. No account is needed to read product, pricing or guide content. If you press Allow on the strip at the foot of the page, we also keep one random id on your device — see This website: what we count, and what we store on your device.
- Registration and trial: owner name, business name, email address, mobile number, and a password (stored only as a salted one-way hash — our staff cannot read it).
- WhatsApp onboarding: if you set up via WhatsApp, we receive the phone number and messages you send in that conversation, used only to create and configure your account.
- Salon business records entered by authorised users: appointments, clients, invoices and GST billing, loyalty/wallet/voucher ledgers, inventory, staff rosters, attendance, commissions, photos and files the salon uploads, and optional service notes (including allergy or skin-sensitivity notes, which the salon should record only where needed for service safety and with the customer’s consent).
- Payments: payer name, contact, amount and transaction identifiers. Card and UPI credentials go to the payment gateway (e.g. Razorpay) — never to Salowa’s servers.
- Business tax details: your business state, which we must have to charge the right GST, and your GSTIN if you choose to give one so your invoice is claimable.
- Support: the content of your support requests and the account context needed to resolve them.
How we use information
In plain wordsTo run the product, bill you, support you, keep the service secure, and nothing else. We do not sell data.
We use personal data to: provide and operate the service; create and secure accounts; process subscription payments and issue GST invoices and vouchers; deliver messages the salon initiates (appointment confirmations, reminders); provide support; monitor security, prevent fraud and abuse; comply with law; and improve the product using aggregated, anonymised usage patterns. We never sell personal data, and we never use one salon’s client list to benefit another business.
Consent, and how to take it back
In plain wordsThree separate consents, three separate records. You can withdraw any of them as easily as you gave it, and it costs nothing.
There are three different consents in play and we never treat one as another:
- Your consent to hear from Salowa — our WhatsApp, SMS and email updates about the product. You give this at signup and we record it against the exact wording you saw. Withdraw it by replying STOP to any message, by the unsubscribe link in any marketing email, in your account settings, or by writing to founder@salowa.com. It takes effect immediately and costs nothing.
- A salon’s consent to message its own clients — collected by the salon and stored against that salon’s records, not ours. If you are a salon’s client, that consent belongs to the salon: reply STOP to its messages, or ask the salon.
- Your choice about this website — the Allow / Don’t allow strip at the foot of every page on salowa.com. It is about analytics on this website only. It is recorded on your own device, nowhere else. Change it by pressing the other button, on any page, at any time. What it covers is written out in This website: what we count, and what we store on your device.
Withdrawing consent stops future use; it does not undo what was already done, and it does not touch records we are required by law to keep, tax records in particular. If withdrawing means part of the service can no longer work for you, we will tell you that before it takes effect.
This website: what we count, and what we store on your device
In plain wordsIf you press Allow, we keep one random id on your device so we can tell which campaign brought you here. Press Don’t allow and it is deleted straight away.
This section is about salowa.com only — not the Salowa app, and not any salon’s records. Until you answer the strip at the foot of the page, nothing that could identify you runs at all.
- What we store, and where. One value named sx_visitor. It is a random id your own browser generates. There is no name, phone number or email address in it, and it is not tied to any Salowa account. It lives in localStorage on your own device — your browser holds it, and clearing your browsing data removes it.
- Why. Attribution: knowing which campaign produced a signup.
- When it leaves your device. Only when you open a Salowa payment link or wallet top-up link. We send that random id, whether the link was for a subscription or a top-up, and the campaign tags carried in the link’s own web address (utm_source, utm_medium, utm_campaign). It goes to Salowa. It does not go to an advertiser.
- How to stop it. Press Don’t allow. sx_visitor is deleted from your device the moment you press it, and nothing further is sent. Press Allow again later and a fresh random id is made — a new one, not the old one back.
- Your answer itself is stored on your device too, as sx_consent, so we do not ask again on every page. That is the only thing it is for.
Advertising pixel — not running today. This site carries the code for a Meta (Facebook) advertising pixel and it is switched off: no pixel identifier is configured, so nothing loads and nothing reaches Meta. If we ever switch it on it will load only after you press Allow, never on a payment or account page, and this section and the “Last updated” date above will change before it goes live.
We do not use this to build a profile of you, we do not sell it, and it never touches a salon’s client records.
Phone masking and salon control
In plain wordsYour client list is yours. Client phone numbers are masked inside the product by default, and every reveal is logged.
Client phone numbers are masked by default in the product interface. The salon owner controls which roles can reveal a number, and every reveal action is recorded in an audit trail the owner can review. Exported client data goes only to the account owner or roles the owner authorises.
Retention and deletion
In plain wordsWe keep your data while you are using Salowa, keep tax records for 8 years because the law says so, and email you before anything is erased.
- Tax, billing and GST records — invoices, receipt and refund vouchers, payment records, GSTIN, amounts: 8 years. The law requires it, and it applies after you leave.
- Your account and its contents — appointments, clients, staff, inventory: kept while you are using Salowa. If an account goes 24 months with no bookings, no invoices and nobody signing in, we email the owner and erase the account contents 48 hours later. Signing in is enough on its own — it resets the clock, and nothing is deleted. A trial ending is not a deletion trigger — we do not erase trial data at day 30.
- A salon’s own inactive customer records: anonymised after 3 years without a visit — sooner if your salon has asked us to shorten that window.
- Deleted or closed accounts: export first; we then delete or irreversibly anonymise, across live systems and backups, within 90 days.
- Access and processing logs: kept at least 12 months, for security and for investigating incidents.
- Data that has been irreversibly anonymised is no longer personal data and may be kept as aggregate statistics. Nothing that can be traced back to a person is kept indefinitely.
Your rights
In plain wordsYou can see, correct, export and delete your data, withdraw consent, and complain — to us first, then to the Data Protection Board of India.
Under the DPDP Act you may request access, correction, completion, erasure, and withdrawal of consent (see Consent, and how to take it back), and nominate a person to exercise your rights if you are unable to. Account owners can raise requests via founder@salowa.com or in-app support; we respond within 30 days. If you are a salon’s customer, contact the salon (the Data Fiduciary for your record); we assist salons within 7 working days so they can meet their obligations. If you are unsatisfied, contact our Grievance Officer (see the Grievance Redressal page) and, thereafter, the Data Protection Board of India.
Children
Salowa is a business tool intended for users aged 18 and over. We do not knowingly process children’s data for tracking, behavioural monitoring or targeted advertising.
Google Calendar consultations
When you book a consultation through our booking page, Google Calendar processes what you submit and creates the invitation and Google Meet details. Google’s own terms and privacy practices apply to that booking experience.
Changes and contact
We will post updates here with a new “Last updated” date, and notify account holders of material changes through the product or email. Questions: founder@salowa.com, or Mcartus Technologies, India. Grievances: see Grievance Redressal.