On this page
Data Controller
SalonGo is developed and provided by Muhammed Mustafa Geldi (Türkiye), operating under the name Swanky Software (referred to in this policy as “Swanky Software”). The developer name of the application on Google Play is “Swanky”.
With regard to the personal data of users who create a SalonGo account, the data controller is Swanky Software. Questions and requests concerning personal data may be sent to [email protected].
Scope, How the Application Works and Allocation of Roles
SalonGo is a business application that helps hairdressers, beauty salons and similar businesses keep records of customers, employees, appointments and cash transactions. Customer, employee, appointment and cash records are stored on your phone; these records leave your phone only if you use the cloud backup included in premium.
SalonGo is available worldwide, and this policy applies in the same way to all users regardless of the country in which they are located. As the data controller is established in Türkiye, all processing activities are subject to the KVKK; processing relating to users in the European Economic Area is additionally subject to the GDPR. Where the laws of your country grant you rights in addition to those set out in this policy, those rights remain unaffected.
Users decide for what purposes and on what legal basis the customer and employee information they record in the application is processed. With regard to this information, the data controller is the business that created the relevant record. Swanky Software stores this information only when cloud backup is used, on behalf of the user and for the purpose of technically providing the service; in this capacity it acts as a data processor. Informing the individuals concerned and, where required, obtaining their consent is the responsibility of the user.
Personal Data Processed
The following categories of data are processed in order to provide the service.
Account data
- Registration details: Username, email address, salon name and registration method.
- Password: Stored using a one-way hashing method. No one, including Swanky Software, can access the password in plain text.
- Sign in with Google: When this method is chosen, the email address, account identifier and name provided by Google are received. The Google account password is not accessed.
- Session information: Session token, session status and device identifier. As an account can be used on only one device at a time, the device identifier is processed to apply this rule.
- Verification codes: One-time codes sent to your email address for email verification and password reset, and the daily count of emails sent, kept to prevent misuse. These records are deleted automatically after a short time.
Subscription information
- Plan and status: Subscription type, premium status and time of last synchronisation.
- Google Play records: The purchase token and order number provided by Google Play for verifying the subscription.
- Payment details: Card and other payment details are processed solely by Google; they are not transmitted to Swanky Software and are not stored by us.
Business records stored on your phone
Unless you use cloud backup, these records are not transmitted to Swanky Software or to any other service provider.
- Customers: Full name, phone number, date of birth, gender, notes, VIP status and loyalty information (number of stars, annual spending).
- Employees: The employee’s name and profile icon.
- Appointments: Date and time of the appointment, the employee and customer concerned, the service to be performed, notes and completion status.
- Cash records: Title, amount, date and description of income and expense records and, where applicable, the customer concerned.
- Business settings: Working hours, closed days, automatic message template and loyalty programme settings.
Cloud backup
When you use the cloud backup included in premium, a backup file containing all the business records on your phone is stored in Supabase storage, linked to your account. The size of the backup and the time at which it was created are also recorded.
Technical data
- Connection records: When the application communicates with the servers, information such as the IP address and request time may be logged on the service providers’ infrastructure for security and error detection purposes.
- Advertising and tracking: SalonGo does not contain advertisements and does not use tracking or analytics tools for marketing or behavioural analysis.
Purposes and Legal Bases of Processing
Personal data are collected electronically through the information you enter in the application, the information provided by Google during Sign in with Google and Google Play purchases, and the records generated when the application communicates with the servers, and are processed for the following purposes:
- Account service: Creating the account, verifying the email address, signing in, resetting the password and applying the single-device rule. Legal basis: conclusion and performance of a contract (Art. 5(2)(c) KVKK; Art. 6(1)(b) GDPR).
- Subscription management: Verifying the subscription, granting premium entitlements and synchronising the subscription status with Google Play. Legal basis: performance of a contract (Art. 5(2)(c) KVKK; Art. 6(1)(b) GDPR).
- Cloud backup: Backing up and restoring business records. Legal basis: performance of a contract (Art. 5(2)(c) KVKK; Art. 6(1)(b) GDPR); with regard to customer and employee information, as a data processor on behalf of the user.
- Announcements: Displaying important announcements about the application within the application. Legal basis: performance of a contract (Art. 5(2)(c) KVKK; Art. 6(1)(b) GDPR).
- Security: Preventing unauthorised access and misuse. Legal basis: legitimate interest of the data controller (Art. 5(2)(f) KVKK; Art. 6(1)(f) GDPR) and the legal obligation relating to data security (Art. 12 KVKK).
- Responding to requests: Handling support requests and requests concerning personal data. Legal basis: performance of a contract and legal obligation (Art. 5(2)(c) and (ç) KVKK; Art. 6(1)(b) and (c) GDPR).
Device Permissions
SalonGo does not request access to your location, camera, microphone or your entire contact list.
- Internet: Used for account operations, subscription verification and cloud backup.
- Google Play purchases: Used for premium subscription transactions.
- SMS, calls and WhatsApp: When you want to send a message to or call a customer, the application opens your phone’s messaging, phone or WhatsApp application with prepared content. You initiate the sending or the call yourself; SalonGo does not request a separate permission for this.
Disclosure of Personal Data
Personal data are not sold and are not shared for advertising purposes. Data are disclosed only to the recipients listed below and only for the stated purposes.
Service providers and other recipients
- Supabase: The database in which account, session and subscription information is stored and the storage area in which cloud backups are stored. For details, see the Supabase Privacy Policy.
- Resend: Sending email verification and password reset codes to your email address. For this purpose, your email address and the code sent are transmitted to Resend. For details, see the Resend Privacy Policy.
- Google: Sign in with Google, and distribution, updates and subscription payments via Google Play. For details, see the Google Privacy Policy.
- Hostinger: Emails sent to [email protected] and the content of this correspondence are hosted on the infrastructure of the email service provider Hostinger. For details, see the Hostinger Privacy Policy.
- Competent authorities: Data are disclosed to public authorities and courts empowered by law only where there is a legal obligation to do so and only to the extent required by that obligation.
Countries where data are processed
Regardless of the country in which the user is located, personal data are processed on Supabase’s servers in the European Union and on the infrastructure of Resend, Google and Hostinger in various countries, including the United States. Your data may therefore be processed outside your country.
With regard to transfers from Türkiye, these transfers are based on the appropriate safeguards provided for in Article 9 of the KVKK; with regard to transfers from the European Economic Area, they are based on the safeguards provided for in Chapter V of the GDPR, in particular standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework.
Sharing initiated by the user
When you send a message to a customer by SMS or WhatsApp or call a customer, the relevant information is transmitted to the mobile operator or to WhatsApp through your own action. The terms of the respective service provider apply to these services.
Data Security
In accordance with Article 12 of the KVKK and Article 32 of the GDPR, Swanky Software takes appropriate technical and organisational measures to ensure the security of personal data.
- Encrypted communication: All communication between the application and the servers is encrypted with TLS.
- Access control: Each user can access only their own account and backup. Cloud backups can be accessed only by the signed-in account holder.
- Single-device rule: When the account is signed in on another device, the session on the previous device is invalidated.
- Records on the phone: Business records are kept in the protected storage area that Android allocates to the application. It is important that you protect your phone’s screen lock and the security of your account.
Data breaches
No system can guarantee absolute security. If personal data are unlawfully obtained by others, the competent data protection authorities and the affected users will be notified within the time limits and in the manner prescribed by law.
Retention Periods
- Account and subscription information: Retained for as long as the account remains open and deleted when the account is deleted. Deletion methods are described on the Account and Data Deletion page.
- Session information: Retained until the session is ended or invalidated; invalid sessions are cleaned up regularly.
- Verification codes and sending counters: Verification and password reset codes are deleted automatically within a few minutes, and daily email sending counters within a few days.
- Cloud backup: A new backup replaces the previous one and is retained until the account is deleted.
- Records on the phone: Remain on your phone until you delete them, clear the application data or uninstall the application. If Android backup is enabled on the device, these records may be included in your phone’s backup in your Google account.
- Correspondence: Correspondence relating to support requests and data protection requests is retained for as long as necessary to resolve the request and to provide evidence in possible disputes.
Your Rights
Regardless of the country in which you are located, you have the following rights regarding your personal data (Art. 11 KVKK; Arts. 15–22 GDPR):
- Information: To learn whether your personal data are processed and, if so, to request information about it, and to learn the purpose of the processing and whether the data are used in accordance with that purpose.
- Recipients: To know the third parties to whom your personal data are transferred, whether domestically or abroad.
- Rectification: To request the rectification of incomplete or inaccurate personal data.
- Erasure: To request the erasure or destruction of personal data under the conditions provided for by law.
- Restriction: To request, in certain cases, that the processing of your personal data be restricted.
- Data portability: To request the personal data you have provided in a structured, commonly used format.
- Notification: To request that rectification, erasure or destruction be notified to the third parties to whom the data have been transferred.
- Objection: To object to processing based on legitimate interest and to a result to your detriment arising from analysis carried out exclusively by automated systems.
- Compensation: To claim compensation for damage suffered as a result of the unlawful processing of your personal data.
How to Submit a Request
You may send requests concerning your rights to [email protected] from the email address registered to your SalonGo account. Additional information may be requested if your identity cannot be verified.
Requests are handled as quickly as their nature allows and free of charge within thirty days at the latest.
If you are not satisfied with the outcome of your request, you may lodge a complaint with the competent data protection authority. Users in Türkiye may apply to the Turkish Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the date of the request; see the KVKK right to apply page for details. Users in the European Economic Area may apply to the data protection authority of the country in which they reside or work, and users in other countries may apply to the competent authority in their country.
Requests concerning customer or employee information recorded by a SalonGo user should be directed to the relevant business, which is the data controller. As these records are kept on the business’s phone, they cannot be seen by Swanky Software; for requests concerning records contained in a cloud backup, the necessary support is provided to enable the business to fulfil its obligations.
Age Limit
SalonGo is an application designed for managing business activities and is not intended for persons under 18 years of age. Accounts found to belong to a person under 18 may be closed and the associated data may be deleted.
Changes to This Policy
This policy may be updated in line with changes to the application, the services used or the applicable law. The current version is published on this page, and the date of the last update is shown at the top of the page. Updates that materially change the purposes of processing or data transfers will also be announced in the application or by email.