1. Roles and Data Controller Distinction
This document describes the processing of personal data in connection with the HurryStyle hair salon management software, operated by Simone Venturini as a natural person.
Under EU Regulation 2016/679 (GDPR), operational privacy roles are distinguished as follows:
- Simone Venturini (natural person, developer and operator of the service) acts as Data Controller solely for personal data required to register the salon account, maintain infrastructure security, manage subscriptions, handle direct support requests, and operate the public website.
- The Hair Salon acts as an Independent Data Controller for all personal data belonging to its end clients and staff members (names, phone numbers, appointments, work schedules, and styling notes).
- For salon client and employee data processed through the application on behalf of the salon, Simone Venturini acts as a Data Processor under Article 28 GDPR, governed by the Data Processing Agreement (DPA) provided with the service.
2. Data Categories Processed, Mandatory Fields, and Consequences of Omission
The platform only processes data required to deliver core functionality:
- Account and Salon Data: Salon owner email address (mandatory to create and access the account), owner name (mandatory), commercial salon name (mandatory), physical address (mandatory), and opening hours. Failure to provide these mandatory fields prevents account creation and service delivery.
- Salon Cover Image: Optional photo selected by the user, stored as a compressed JPEG in the Firestore configuration document.
- Stylist and Team Data: Employee names, assigned roles, working schedules, and calendar exceptions (vacations or days off).
- Salon Client Data: Client name (mandatory to schedule appointments), phone number (optional; if omitted, pre-filled WhatsApp reminders cannot be generated), email address (optional), and cosmetic style or hair color preferences.
- Appointments and Services: Booked treatment, duration, appointment time, indicative price, assigned stylist, and status.
- CSV Client Import: Selected CSV files are parsed locally within the browser or device memory to facilitate column mapping; only records explicitly confirmed by the user are saved to the salon database.
- WhatsApp Reminders: Sending reminders is optional and occurs via manual handoff to the external WhatsApp application via standard URL (
https://wa.me/). Transmitted fields include recipient telephone number, client name, date, time, service, and stylist. - Technical System Data & Metadata: IP address, operating system, browser user agent, and timestamps in server network logs strictly necessary for security; subscription metadata (active or trial state) stored in database. No profiling cookies or advertising trackers are used.
- App security: Firebase App Check and Google Play Integrity check app and device integrity to protect service access.
3. Purposes and Legal Bases for Processing
Personal data is processed under distinct legal bases:
- For operator account and service delivery: Performance of the service agreement or pre-contractual measures (GDPR Art. 6(1)(b)).
- For operator statutory duties: Compliance with applicable tax, accounting, or legal disclosure obligations (GDPR Art. 6(1)(c)).
- For system security: Legitimate interest of the operator in protecting systems against abuse, unauthorized access, and cyber attacks (GDPR Art. 6(1)(f)).
- For salon client and staff data: The determination of appropriate legal bases (e.g., client contract, consent, or legitimate interest) is the autonomous responsibility of the Salon as Data Controller, which must provide appropriate notices and collect any required consents.
Calculations and suggestions support salon decisions. They do not make solely automated decisions with legal or similarly significant effects on people.
4. Prohibition of Sensitive Health Data & Age Restrictions
Prohibition of Special Category (Health) Data: Under the current phase of the service, users are strictly prohibited from entering health-related personal data under GDPR Article 9 (such as skin disorders, clinical allergies, medical treatments, or diagnostic notes) into client cards or appointments. Annotations must be strictly aesthetic (e.g., hair color formula, cutting technique).
Minors: The service is intended exclusively for adult salon professionals (18 years of age or older). Direct registration by minors is not permitted.
5. Infrastructure Location and International Data Transfers
Infrastructure providers have the following characteristics:
- Firestore Database: Configured in Google Cloud's European region europe-west8 (Milan, Italy) for storing salon operational records.
- Firebase Authentication: User authentication operates on infrastructure located in the United States of America, as specified in Google/Firebase official documentation. Consequently, not all processing operations take place within the European Union. International transfers are governed by European Standard Contractual Clauses (SCCs) and Google Cloud's Data Processing Addendum.
- Website Hosting & Email Routing: Static web delivery and email forwarding are handled via Cloudflare, with delivery to a regular Gmail account managed by the operator.
We do not provide absolute guarantees of system invulnerability or claim that all data remains within the EU. Personal data is never sold or transferred to third parties for marketing purposes.
6. Retention Periods, Technical Caveats, and Backup Retention
Salon data is kept during the service relationship until deletion or the controller’s instruction, subject to applicable legal duties. The salon sets proportionate retention periods for client, staff and photo records and handles data-subject requests.
Deleting a client card does not remove names or contact details stored in historical appointments. The salon must review and remove those copies where required. Account deletion removes the salon’s active archive, including photos, asynchronously. Deleted photos may remain recoverable in protected Cloud Storage copies for 7 days, without being accessible in the app.
Logout and remote deletion do not automatically clear offline device copies. Clear app data or uninstall the app to remove them; device backups and exported or shared files must be managed separately.
Logs support security and incident handling; support records and documents needed to protect rights are kept for the time required by the matter and applicable duties. Firebase states that deleted authentication data is removed from live and backup systems within 180 days. For information about residual data in a specific case, contact privacy@hurrystyle.com.
7. Data Subject Rights & Supervisory Authority Complaints
Under GDPR Articles 15-22, individuals may request access to their personal data, rectification, erasure, restriction of processing, data portability, or object on legitimate grounds.
End clients and salon staff members must address requests to exercise their privacy rights directly to the Hair Salon as independent Data Controller. If such requests are mistakenly sent to Simone Venturini, the operator will promptly redirect the individual to the respective salon or forward the request.
Requests submitted to the operator regarding data for which it acts as Controller will receive a response within one month of receipt. This deadline may be extended by two further months (up to three months total) where necessary, taking into account request complexity and volume; the operator will notify the applicant of any extension and reasons within the first month.
Identity is verified proportionately, primarily via the registered account email address; passwords will never be requested. Additional verification evidence may only be requested where strictly necessary to prevent fraudulent requests.
Individuals have the right to lodge a complaint with the competent supervisory authority: in Italy, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, garanteprivacy.it), or their local EU Member State Data Protection Authority.
8. Data Controller Contact Information
Data Controller: Simone Venturini (natural person).
Privacy Inquiries: privacy@hurrystyle.com.
General Support: support@hurrystyle.com.
Postal contact details and tax identifiers are shown in the operator identity panel on this page.
9. Photos, export, reminders and analysis
Work photos (Pro): images and comments are linked to appointments. The salon chooses what to upload, must inform people shown, establish a valid legal basis and obtain any consent required for use and sharing. Do not upload health data. Images are converted to reduced JPEGs without EXIF metadata and stored privately in Google Cloud Storage in europe-west1 (Belgium). Limits: 5 GB per salon and 10 photos per appointment. Existing photos remain readable and deletable after plan expiry; new uploads require the entitlement shown in the app.
Export and sharing: owners may export clients and appointments as CSV even after expiry. Exported files and photos shared through the system menu are handed to the app or recipient chosen by the user. Those copies follow the recipient’s terms and are not removed by deletion in HurryStyle. Nothing is sent automatically.
Local reminders and automatic completion: authorised appointment reminders are scheduled on the device 30 minutes beforehand. Notification details may be visible according to device settings. If the owner enables automatic completion, the server may mark appointments complete 30 minutes after their planned end; the result is identifiable and editable. This uses times and status already held by the salon.
Statistics and suggestions: amounts, services, visit frequency and availability are calculated inside the app from salon records. They are not sent to generative AI services. There is no Google connection or automatic review import. Any excerpts pasted by the user are analysed on the device and held in memory during the session: they are not saved or sent to external services. Avoid names, contact details or other identifying information in excerpts. Results are supporting estimates, not evidence of absence, illness, individual performance or future outcomes. The salon must consider the context, inform staff and respect applicable employment rules. No solely automated decisions with legal or similarly significant effects on people are made.