Privacy policy

Who is responsible

Ovanori is run by Sady Doucouré, a sole proprietorship registered in Quebec (NEQ 2277553931), in Montréal. The operator is responsible for the personal information described here.

Person in charge of the protection of personal information: Sady Doucouré, owner. For any question, or to exercise your rights, write to privacy@ovanori.com.

What we collect

Account: first name, last name, email address, phone number, language, a profile photo if you add one, and a password that is never kept in clear text — only a hash is stored. If you sign in with Google or Apple, we keep the identifier that service gives us to recognise you.

Salon: trading name, address, contact details, services, opening hours, gallery photos, staff members.

Appointments: date, service, salon, any message left for the salon, and the history of cancellations or reschedules. When a card or payment is requested, we only see the card's brand and last four digits.

Salon client book: the notes a salon writes about its clients, visible to that salon only, and the name and phone number of a client the salon books in itself at the counter.

Reviews: the rating, the comment, and the author's first name — never their full name.

Location: used only when you ask for “salons near you”, for the time it takes to compute distances. It is never stored, never kept between visits, and never passed on.

Public page visits: a daily count by source (direct link, QR code, search, social media), with nothing that identifies the visitor.

Technical logs: IP address, timestamp and requested page, kept for security and diagnosis.

Why we collect it

To run the service: create an account, publish a page, book, send emails or text messages, display verified reviews.

To bill a salon's subscription and meet our accounting obligations.

To protect the service: confirm email addresses, limit abuse, handle reports, diagnose failures.

Who has access

The salon you book with receives your first name, last name, phone number and email address: it needs them to welcome you and reach you.

We sell no data and pass none to advertisers. Data is disclosed to an authority only on a lawful request.

Our service providers, listed below, only receive what they need to provide their service. Several of them process data outside Quebec and Canada, in particular in the United States, where it is subject to local law.

Our service providers and where they process data

Hostinger hosts the application server and its database, and carries our emails.

Amazon Web Services (AWS), us-east-1 region (Northern Virginia, United States): stores photos (profiles, galleries, staff) and the database backup copies.

Stripe (United States) processes salon subscriptions, and the cards and payments requested at booking. A card is saved on the salon's Stripe account, never with Ovanori.

Twilio (United States) sends text-message reminders: it receives the client's phone number and the reminder text (service, salon, appointment time and address). Only the two-hour reminder goes out by text. A client with an account can turn it off in their notification preferences; a client booked in by the salon without an account receives it at the number the salon noted for them.

Google (United States): Google Maps shows a salon's map and the directory map. A map only loads once it scrolls into view; Google then receives the visitor's IP address and the area shown. A salon's address is also sent to Google, once, to work out its position on the map. If you sign in with Google, Google gives us your name and email address.

Apple (United States): if you sign in with Apple, Apple gives us your name and email address, or a relay address if you hide it.

Cloudflare Turnstile checks, at sign-up and when a new password is requested, that the request comes from a person. Cloudflare receives the IP address and technical information about the browser.

Sentry receives the application's error reports, so that we can fix failures: browser type, page, and error message. These reports contain neither your identity, nor your IP address, nor your cookies; email addresses and phone numbers are masked before sending.

Each of these services also applies its own privacy policy.

For how long

The account and its content: until you delete it.

Past appointments and reviews stay in the salon's history. Once an account is deleted, they no longer identify anyone: reviews stay published, signed “Former client”.

Session, email confirmation, password reset and invitation tokens: deleted 7 days after they expire or are used. The personal link in a confirmation or password reset email is erased from our records as soon as the email is sent.

Emails and text messages sent: their content is erased after 30 days, and their record after 180 days.

Payment notifications received from Stripe: their content is erased after 30 days; their identifier is kept for one year so that the same payment is never processed twice.

The count of text messages sent, used for daily limits: 7 days. Public page visits: 25 months.

Backup copies: 35 days at most. Deleted data disappears from backups within that time.

Technical logs are overwritten automatically, after twelve months at the latest.

Your rights

You may ask for access to your personal information, its correction, its deletion, its portability, and withdraw a consent you gave. Your contact details and notification preferences can be changed straight from your account.

Deletion: a client or a staff member deletes their own account from the “My account” page. A salon owner's account is deleted on written request to support, at hello@ovanori.com.

Access, correction and portability: write to the person in charge of the protection of personal information, at privacy@ovanori.com. We answer within thirty days.

If our answer does not satisfy you, you may contact the Commission d'accès à l'information du Québec.

What deleting an account erases

Erased: first name, last name, email address, phone number, profile photo, password, links with Google and Apple, sessions, preferences, pending messages, waitlist entries, and the message left for the salon on an appointment. The notes a salon had written about that client are erased too.

Kept, with nothing that identifies you: past appointments, in the salon's history, and reviews, signed “Former client”. What must be kept for accounting reasons is kept as well.

The same email address can then be used to create a new account, which takes nothing from the old one.

Cookies

No advertising cookie, no analytics. Ovanori only sets strictly necessary cookies, which require no consent:

ovanori_refresh: keeps your session open. Unreadable by scripts, sent only to the sign-in service. 30 days (12 hours for an administration account), erased when you sign out.

ovanori_session: only says that a session exists, with no secret in it, to avoid a needless request on every visit. Same lifetime as ovanori_refresh, erased with it.

XSRF-TOKEN: protects session renewal against requests sent from another site. Erased when the browser closes.

ovanori_lang: remembers the language you chose. One year.

The browser also keeps, on your device only, the language you chose, the time format (12 h or 24 h), and for 48 hours at most the booking waiting for your email address to be confirmed.

Third-party services only load on the pages that use them: Google and Apple on the sign-in and sign-up pages and when confirming an account deletion, Stripe when a card or payment is requested, Google Maps when a map is shown, Cloudflare Turnstile at sign-up and when a new password is requested, and Sentry to report an error. They may then set their own cookies, under their own rules.

Emails and notifications

Confirmations, reminders and review invitations can be set category by category from your account. Messages about the account itself — security, billing, moderation — cannot be turned off.