Privacy policy

1. Who we are and the role we play

Smart Booking is an online scheduling service for salons, barbershops and aesthetics studios.

Two situations differ. For the data of people who sign up as a salon's owner or staff, we are the DATA CONTROLLER. For the data of end clients who book an appointment, we are a DATA PROCESSOR acting on the salon's behalf: the salon decides what it collects and why, and we process it only on its instructions and to provide the service.

If you are a salon's client and want to exercise your rights, you can contact the salon or write to us and we will route it.

2. What we process

Only what an appointment actually needs:

• From the salon: business name, email address, password (stored as an argon2id hash, never in the clear), timezone, opening hours, services, prices and staff.
• From the end client: name, phone and/or email, and their appointment history with that salon.
• From payments: the gateway's operation reference, the amount and its status. We do NOT store card numbers — card details are entered directly with MercadoPago or PayPal and never reach our servers.
• Technical data: IP address and access logs, used for security, rate limiting and diagnostics.

3. What we use it for

To run the diary and its bookings, send appointment confirmations and reminders over WhatsApp, SMS or email, process deposits and subscriptions, provide support, and keep the service secure.

We do not sell personal data, do not share it for advertising, and do not profile people or make automated decisions with legal effects on them.

4. Legal basis

Salon data is processed to perform the service contract and to meet legal obligations. End-client data is processed on the basis of the consent given when booking and the salon's legitimate interest in honouring the appointment, under articles 9 and 13 of Ley 18.331.

5. Who we share it with

Only the providers needed to deliver the service, and only the data each one needs:

• Meta Platforms (WhatsApp Business Cloud API) and/or Bird.com: WhatsApp and SMS reminder delivery. They receive the recipient's phone number and the message.
• Outbound email provider (SMTP): confirmations, reminders, sign-in codes and recovery links. Receives the email address and the message.
• MercadoPago and/or PayPal: deposit and subscription payments. They receive the amount and an operation reference.
• The infrastructure provider hosting the service.

6. International transfers

Some of those providers are outside Uruguay. Where the destination country does not offer an adequate level of protection under article 23 of Ley 18.331, the transfer relies on the data subject's consent and on the contractual clauses we hold with each provider.

7. How long we keep it

Booking data is kept while the salon's account is active, because it is their client history and their accounting record.

If a salon closes its account, we delete its data and its clients' data within 90 days, except what we must keep to meet a legal or accounting obligation.

Database backups are kept for 14 days and then deleted automatically. Data you asked us to delete may persist in a backup until that backup expires.

8. Security

Traffic is encrypted with TLS. Passwords are stored with argon2id. Each salon is isolated from the others at the database level through row-level security policies, not only in application code. Administrative sign-in requires a second factor sent by email.

No system is infallible. If a breach affects your data, we will notify you as the applicable rules require.

9. Your rights

You may at any time request access to, rectification, updating, inclusion or deletion of your personal data, under articles 13 to 15 of Ley 18.331.

Write to us and we will answer within the statutory deadlines. If you believe we handled your request poorly, you may complain to Uruguay's data protection authority, the URCDP (www.gub.uy/unidad-reguladora-control-datos-personales).

10. Cookies

This marketing site uses no cookies and no third-party analytics.

The management app and the public booking page store in your browser only what is needed to keep you signed in and remember usage preferences. These are not advertising or tracking cookies.

11. Changes

If we change this policy we update the date in the header, and where the change is material we email salons before it takes effect.