Legal

Privacy Policy

Effective August 13, 2026 · Policy version 2026-08-13

Questions about any of this? Get in touch or call +1 613-879-2247.

Hanny's Hair Lounge (“we,” “us,” or “the salon”) respects your privacy. This policy explains what personal information we collect when you book an appointment with us, why we collect it, how we protect it, and the rights you have under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s Anti-Spam Legislation (CASL). We collect only what we need to manage your booking — nothing more.

1. What we collect

When you book, we collect only the information needed to reserve and manage your appointment:

• Your name;
• Your email address (so we can send your confirmation);
• Your phone number — required, so the salon can reach you about this appointment if something changes on the day;
• The service and time you selected; and
• A record of your consent — the exact wording you agreed to, the policy version, and a timestamp.

If you ask to go on our waiting list for a day that is fully booked, we keep the same details plus the day you asked for, the part of the day that suits you, and the stylist you asked for if you named one. That creates a record for you even though you have not booked anything — we would rather say so plainly than describe it as something else. You can take yourself off the list from the link in any email we send you about it.

We practise purpose limitation: we do not collect demographics, marketing profiles, or any data unrelated to fulfilling your booking. We do not handle or store credit card information — no payment is taken online at this time.

2. Why we collect it

We use your information solely to:

• Reserve your appointment and prevent double-booking;
• Send you a booking confirmation, a reminder, and any necessary changes to it — by email, and by text message where the salon has texting switched on;
• Tell you if a time comes free on a day you asked us about, if you asked us to; and
• Keep an audit record of the consent you provided, as required by law.

If, and only if, you tick the optional box on the booking form, we also use your email address to write to you occasionally about the salon. That box is never ticked for you and is not needed to book.

These are transactional purposes tied directly to the appointment you requested. We rely on your consent, given at the time of booking, as our basis for this processing.

3. Emails and texts (CASL)

As part of a booking we send you a confirmation, and a reminder shortly before your appointment. Both are transactional: they contain your appointment details and our contact information, and carry no promotional content. This is permitted under CASL on the basis of our existing business relationship for that booking.

Where the salon has text messaging switched on, the confirmation and the reminder are also sent by text message to the number you gave us. Every text says who it is from and how to stop it: reply STOP to any of them and we will not text you again. That is recorded against your number immediately, and it applies to every text the salon sends, not just the one you replied to.

Today, it is switched off. The salon sends no text messages at all — confirmations and reminders go by email only. The paragraph above describes what would happen if that ever changes, and we would update the date on this page when it did.

We do not add you to a marketing list. There is one optional tick-box on the booking form, never ticked for you, and leaving it alone changes nothing about your appointment. If you do tick it we store the exact sentence you agreed to, and every message we send after that carries a one-click unsubscribe. Every message we send identifies us and includes our physical mailing address.

The waiting list is treated as marketing, and we want to explain why. An email that says “a time has come free on Tuesday, would you like it?” is us proposing a booking that does not exist yet, so we do not treat it as a service message about an existing appointment. Joining the list therefore asks for its own express consent, in its own words, on a box that is never ticked for you — and that consent is limited to openings on the day you asked about. It is not permission to write to you about anything else. Every one of those emails names us, carries our mailing address, and has a working link that takes you off the list.

4. Where your information is stored

Your booking data is stored in a managed PostgreSQL database hosted in a Canadian region (Montréal, ca-central-1) operated by our infrastructure provider (Supabase).

Some processing may occur outside Canada. In particular, our confirmation and reminder emails are sent through a transactional email provider (Resend), from the salon's own verified domain. If you reply to one of those emails, your reply goes to the salon's Google (Gmail) mailbox. Either way the message and your email address may be processed on servers located in the United States, and the serverless functions that run our booking flow may execute in data centres outside Canada. PIPEDA permits these cross-border transfers provided we tell you about them and use providers that offer a comparable level of protection through contractual safeguards — which we do. While information is handled outside Canada it may be subject to the laws of that jurisdiction, including lawful access requests by foreign authorities.

5. Service providers we share with

We share your information only with the providers that operate the booking system on our behalf, and only to the extent needed to deliver the service:

• Supabase — database, hosting and authentication (data stored in Canada);
• Resend — sends our confirmation and reminder emails, so it handles the message and your address;
• Google — the salon's own mailbox is Gmail, so if you reply to one of our emails, Google handles your reply and your address;
• Telegram — when you book, cancel, or join the waiting list, the salon gets an alert on its own phone through Telegram so somebody knows without refreshing a screen. That alert carries your name and your phone number, and Telegram processes it on servers outside Canada. It goes to the salon only; no customer is ever a recipient;
• Twilio — text-message delivery, if the salon ever switches texting on. It is off today and no text has been sent, so Twilio currently receives nothing. Were it turned on, they would receive your phone number and the wording of the message and process it on servers in the United States;
• Netlify — website and serverless function hosting.

These providers are bound to use your information only to provide their service to us. We never sell or rent your personal information, and we do not share it for advertising.

6. How long we keep it

We keep your booking records for as long as the salon is running. Nothing is deleted on a schedule today, and we would rather tell you that than promise a clean-up that is not happening. The salon's own history screen only shows the last few months, but that is a display setting, not deletion.

A time you held but never confirmed never had your name, email or phone attached to it, so there is nothing personal in an abandoned booking to keep. And you can ask us to delete your information at any time and we will, apart from anything we have to keep for legal or accounting reasons. If we introduce a routine deletion schedule, this page will say what it removes and when, before it starts.

7. How we protect it

Access to booking data is restricted and protected by database-level security rules, encrypted connections (HTTPS/TLS), and encryption at rest. The salon owner can see all bookings, through an authenticated sign-in. A stylist signed in to her own account sees only her own appointments, with your name so she knows who is coming, and not your email or phone number. We limit the staff and systems that can access your information to those who need it to run the salon.

8. Your rights under PIPEDA

You have the right to:

• Access the personal information we hold about you;
• Correct information that is inaccurate or incomplete;
• Withdraw consent and ask us to delete your information, subject to legal retention requirements; and
• Complain if you believe we have mishandled your information.

To exercise any of these rights, contact us using the details below. We may need to verify your identity before acting on a request. We will respond within the timeframe required by law (generally 30 days).

9. What we store on your own device

We do not use advertising cookies or third-party marketing trackers anywhere in the booking process. What we do store on your device is this:

• Your name, email and phone, after a booking you completed — kept in your browser on that device for 180 days, so you do not have to type them again next time. It never leaves your device by itself; it is simply filled into the form for you. When it is, the page says so and offers a Not you? Clear this link, because a shared phone or a family tablet is exactly when this would otherwise go wrong.
• Nothing that could act on your booking. We deliberately do not keep the link that cancels an appointment, or anything else that would let the next person to pick up that device do something to your booking.
• Never your consent. Ticked boxes are not remembered. You are asked again every time, because a box we ticked for you from an old visit would not be your consent.

You can clear it whenever you like — with the link on the form, or by clearing your browser’s site data. Doing so has no effect on any appointment you have already booked.

10. Children

Our booking system is intended for use by adults. A booking for a minor should be made by a parent or guardian, who provides consent on the child’s behalf.

11. Changes to this policy

If we change this policy, we will update the effective date and policy version above. Material changes will be reflected before they take effect. The version you agreed to at the time of your booking is recorded with that booking.

12. Contact us & the Privacy Commissioner

The person accountable for privacy at Hanny's Hair Lounge is the salon owner. For any privacy question, or to exercise any of the rights above, reach them here:

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

← Back to Hanny’s Hair Lounge