Legal
Privacy Policy
What personal data LayanOS handles, why, who it is shared with, and the rights you have over it.
- Effective
- Last updated
LayanOS is business software used by beauty centres and salons to run bookings, client records, payments and messaging. Two different groups of people appear in this policy, and the difference matters.
If you are a salon that subscribes to LayanOS, we are the controller of your business account data. If you are a client of a salon that uses LayanOS, the salon decides what is held about you and why — we process it on their instructions. Requests about a salon's client records are answered by that salon, and we help them do it.
1. Who we are
LayanOS (“LayanOS”, “we”, “us”, “our”) is a software platform operated from Bethlehem, Palestine.
For privacy questions, data requests, or to reach the person responsible for data protection, contact [email protected]. We aim to acknowledge every request within 5 business days.
2. Controller and processor — which one we are
Our obligations depend on whose data is involved, so we state both roles plainly:
- Controller — for the accounts of subscribing businesses: owner and staff names, work contact details, login credentials, billing records, and usage of the platform. We decide why and how this is processed.
- Processor — for the client records a salon keeps inside LayanOS: their customers' names, contact details, appointments, preferences, notes and payment history. The salon decides what is collected and how long it is kept. We act on their documented instructions.
3. What we collect
Depending on how LayanOS is used, the platform may hold:
- Identity and contact data — name, phone number, email address, preferred language, and (where a salon records it) date of birth.
- Appointment data — services booked, dates and times, assigned staff, branch, cancellations, attendance and no-shows.
- Commercial data — invoices, deposits, payments, loyalty balances, packages and vouchers. Card details are handled by our payment processor and never stored on our systems.
- Messaging data — the content of conversations conducted through WhatsApp, Instagram, Messenger, the web booking widget, or the in-product inbox, including timestamps and delivery status.
- Voice data — audio captured when a client or staff member uses voice booking, and the text transcript produced from it.
- Photographs — images a client or salon uploads for a consultation, where that feature is used.
- Treatment notes — free-text notes a salon records, which may include allergies, sensitivities, contraindications and product reactions.
- Technical data — IP address, device and browser type, pages viewed, and security and audit logs recording who accessed what.
4. Why we process it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Providing the platform — bookings, records, scheduling, payments | Performance of a contract |
| Sending appointment confirmations, reminders and follow-ups | Contract, or the salon's legitimate interest in reliable service |
| Answering client enquiries across messaging channels | Contract or legitimate interest |
| Marketing messages and promotional campaigns | Consent, obtained and evidenced by the salon |
| Securing the platform, preventing fraud and abuse | Legitimate interest, and legal obligation |
| Improving service quality and diagnosing faults | Legitimate interest |
| Meeting tax, accounting and regulatory duties | Legal obligation |
Where we rely on consent, it can be withdrawn at any time without affecting processing already carried out. Where we rely on legitimate interest, we have weighed that interest against the rights of the individual and will share our reasoning on request.
5. Automated processing and artificial intelligence
LayanOS uses AI to understand messages, transcribe speech, draft replies and suggest appointment times. This is central to the product and we describe it precisely rather than in the abstract:
- Message content, and the business context needed to answer it — such as the service list, staff names and availability — is sent to third-party AI providers listed in section 7.
- Voice recordings are sent to a speech-to-text provider and converted to text. Replies may be converted back to speech.
- AI output is a draft, not a decision. Bookings, cancellations and reschedules are validated by our own booking engine against real availability before anything is written, and actions that change a client's booking require confirmation.
- We do not use AI to make decisions producing legal or similarly significant effects, and we do not carry out profiling for that purpose.
- We do not permit our AI providers to train their models on data sent through LayanOS, and we select service tiers accordingly.
6. WhatsApp, Instagram and Messenger
Where a salon connects a Meta business account, LayanOS sends and receives messages on that salon's behalf. In that flow:
- We receive the message content, the sender's platform-scoped identifier, profile name, and — where the platform provides it and the sender has shared it — the phone number.
- We use this solely to deliver the conversation, answer it, and link it to the salon's client record.
- We do not sell this data, use it for advertising, or combine it across unrelated businesses.
- Meta's own handling of your data is governed by Meta's policies, not ours.
- Deletion requests received through Meta's data deletion callback are honoured automatically — see our Data Deletion Policy.
8. International transfers
LayanOS is operated from Palestine and uses providers located elsewhere, so personal data crosses borders. Where a transfer leaves a jurisdiction whose law restricts it, we rely on contractual protections with the receiving party — including standard contractual clauses where applicable — together with encryption in transit and data minimisation, so that only the data actually needed for the feature is sent.
You can ask us for details of the safeguards applying to a specific transfer.
9. How long we keep it
| Data | Retention | Reason |
|---|---|---|
| Business account and billing records | Life of the subscription + 7 years | Tax and accounting obligations |
| Salon client profiles and appointment history | Controlled by the salon; deleted on their instruction | We hold this as processor |
| Voice recordings | Deleted after transcription, within 30 days at the latest | Only the transcript is retained |
| Voice and chat transcripts | 24 months, or until the salon deletes them | Service quality and dispute resolution |
| Consultation photographs | Until the salon or client deletes them | Uploaded at the client's initiative |
| Security and audit logs | 12 months | Fraud, abuse and incident investigation |
| Deletion request records | 24 months after completion | Proof that the request was honoured |
| Backups | Rolling 35 days | Deleted data disappears as backups age out |
When a subscription ends, business account data is deleted within 90 days unless a longer period is required by law. Salons may export their records before that point.
10. How we protect it
- Encryption in transit, and encryption at rest for sensitive personal fields.
- Database-level tenant isolation, so one business cannot read another's records even in the event of an application fault.
- Role-based access control, multi-factor authentication for privileged accounts, and audit logging of administrative access.
- Searchable fields such as phone numbers are indexed using keyed hashes rather than plain text.
- Least-privilege access for our staff, granted only where support requires it and recorded when used.
- Regular backups, held for a rolling 35 days and encrypted.
No system is perfectly secure. If a breach affects your personal data and presents a risk to you, we will notify the affected businesses without undue delay, and regulators where the law requires it.
11. Your rights
Subject to your local law, you may have the right to:
- Access the personal data held about you, and receive a copy.
- Correct data that is inaccurate or incomplete.
- Erase data, where there is no overriding legal reason to keep it.
- Restrict or object to processing, including direct marketing — which you may refuse at any time.
- Receive your data in a portable, machine-readable format.
- Withdraw consent where processing relies on it.
- Complain to your local data protection authority.
To exercise any of these, contact [email protected]. We will respond within 30 days, and will tell you if we need longer and why. We do not charge for these requests unless they are manifestly unfounded or excessive.
12. Children
LayanOS is not directed at children and we do not knowingly collect data from anyone under 16 in their own right. Where a salon books a treatment for a minor, the record is created and consented to by a parent or guardian, and the salon is responsible for obtaining that consent. If you believe a child's data has been provided without proper authority, contact us and we will remove it.
14. Changes to this policy
We update this policy as the platform changes. The effective date above always reflects the current version. Where a change materially affects your rights, we will notify subscribing businesses directly and, where required, seek fresh consent rather than relying on silence.
15. Contact
Privacy and data protection: [email protected]. General enquiries: [email protected]. LayanOS is operated from Bethlehem, Palestine.