🔒 Your Privacy Matters

Privacy Policy

Last updated: May 23, 2026

1. Introduction

BookMyNails ("we", "us", "our") operates the BookMyNails.ca platform — a nail salon & spa booking service for Canadian businesses and their customers. We are committed to protecting your personal information in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the European Union's General Data Protection Regulation (GDPR).

This Privacy Policy applies to both Salon Owners (business accounts) and Customers (personal booking accounts). It explains what data we collect, how we use it, who we share it with, and your rights regarding your information.

2. Information We Collect

Salon Owner Account Information

Full name and email address
Personal mobile phone number (required for SMS two-factor authentication)
Business phone number (displayed on your salon page)
Google, Facebook, or Apple account profile data (when using social sign-in)
Password (hashed — we never store plaintext passwords)

Customer Account Information

Full name and email address
Phone number (used for booking verification and account linking)
Google account profile data (when using social sign-in)
Password (hashed — we never store plaintext passwords)
Booking history, loyalty points, gift card balances, and saved favourite salons
Reviews and ratings submitted through the platform

Salon & Booking Data

Salon name, address, phone number, and business hours
Services offered, pricing, and staff information
Booking details (date, time, service, client name, email, phone)

Payment Information

Payment details are processed by Stripe. We do not store credit card numbers on our servers. Stripe's privacy policy applies to payment processing.

Automatically Collected Data

Browser type, device information, and IP address
Pages visited, time spent, and referring URLs
Cookies and similar tracking technologies

3. Data Controller vs. Data Processor

For salon owner accounts, BookMyNails acts as a data processor on behalf of the salon owner (the data controller). Salon owners are responsible for how they collect and use their customers' personal information through the platform.

For customer accounts created directly on BookMyNails (not through a specific salon), BookMyNails acts as the data controller.

When a customer books at a salon through BookMyNails, the customer's booking information (name, phone, email, service details) is shared with the salon owner to fulfil the appointment. The salon owner becomes a joint data controller for that booking data.

3A. SMS Marketing & Communications (CASL Compliance)

BookMyNails enables salon owners to send SMS marketing messages to customers who have explicitly opted in. In compliance with Canada's Anti-Spam Legislation (CASL):

Salon owners may only send marketing SMS to customers who have opted in
All marketing messages include "Reply STOP to unsubscribe" instructions
You can opt out of a salon's marketing SMS at any time
Opting out of marketing SMS does not affect transactional messages (booking confirmations, reminders)
BookMyNails provides the technical platform; individual salon owners are responsible for CASL compliance of their marketing campaigns

3B. SMS Booking Consent

When booking an appointment, customers are asked to consent to receiving transactional SMS messages:

Booking confirmations, reminders, and updates are sent via SMS to the phone number provided during booking
Consent is collected via a checkbox on the booking form before the appointment is submitted
These are transactional messages only — not marketing
You can opt out at any time by replying "STOP" to any SMS message
Opting out does not cancel your existing bookings
Your phone number is shared with the salon you booked with for appointment coordination
SMS messages are delivered via Twilio; standard message and data rates may apply

4. How We Use Your Information

For All Users

To provide and maintain the BookMyNails platform
To authenticate users via Google OAuth, Facebook Login, Apple Sign-In, and email/password
To verify phone numbers via SMS one-time codes (OTP) for account security
To improve our services and user experience
To comply with legal obligations

For Salon Owners

To process bookings and manage salon operations
To send transactional emails (booking confirmations, reminders, notifications) via Resend
To process subscription payments through Stripe
To provide two-factor authentication (2FA) for salon owner logins via SMS
To send SMS marketing campaigns to opted-in customers (when enabled by the salon)

For Customers

To manage bookings, loyalty points, gift cards, and coupons across salons
To link guest bookings to your account using your phone number or email
To send booking confirmations, reminders, and review requests via email
To share your booking details (name, phone, email) with the salon you booked with
To send SMS notifications about bookings if you have opted in
To display your loyalty points balance and history per salon

5. Third-Party Services

We use the following third-party services that may process your data:

Stripe

Payment processing for subscription plans. Stripe handles all credit card data under PCI DSS Level 1 compliance.

Resend

Transactional email delivery for booking notifications, confirmations, and account-related communications.

Google OAuth

Optional sign-in method. We receive your name, email, and profile picture from Google. We do not access any other Google account data.

Facebook Login

Optional sign-in method. We receive your name, email, and profile picture from Facebook. We do not access your friends list, posts, or any other Facebook data.

Apple Sign-In

Optional sign-in method. We receive your name and email from Apple (you may choose to hide your email). We do not access any other Apple account data.

Twilio

SMS verification and two-factor authentication. Twilio processes your phone number to deliver one-time verification codes. Your phone number is transmitted securely to Twilio solely for the purpose of sending SMS messages.

Cloudflare Turnstile

Bot protection and spam prevention on forms. Turnstile may collect browser metadata to verify human users. No CAPTCHAs are shown to users.

6. Cookies & Tracking

We use cookies and similar technologies to operate the platform, remember your preferences, and analyze usage. You can control cookies through your browser settings, but disabling them may affect platform functionality.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Specific retention periods:

Account data: retained until account deletion is requested
Booking data: retained for 7 years for legal and accounting purposes
SMS verification codes: expire after 5 minutes and are automatically purged
Personal phone numbers used for 2FA are never displayed publicly on salon pages

8. Security

We implement industry-standard security measures to protect your personal information. All data is transmitted over HTTPS and stored on secure servers. Passwords are hashed using bcrypt. However, no method of transmission over the internet is 100% secure.

9. Your Rights

Under PIPEDA and GDPR, you have the following rights regarding your personal information:

Right of Access: Request a copy of the personal data we hold about you
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Deletion: Request deletion of your personal data ("right to be forgotten")
Right to Data Portability: Request your data in a structured, machine-readable format
Right to Withdraw Consent: Withdraw consent for data processing at any time
Right to Object: Object to processing of your data for certain purposes

To exercise any of these rights, contact us at support@bookmynails.ca. We will respond within 30 days.

10. Children's Privacy

Our platform is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or through a notice on our platform. Your continued use of BookMyNails after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

BookMyNails

Email: support@bookmynails.ca

Website: bookmynails.ca

1000 Innovation Drive, Suite 500, Kanata, ON K2K 3E7, Canada 🇨🇦

For more information about your privacy rights in Canada, visit the Office of the Privacy Commissioner of Canada.