Privacy Policy

DoWhat (“DoWhat,” “we,” “us”) provides cloud-based salon management software. This policy explains what personal information we collect, how we use and share it, and the choices and rights you have. It covers our marketing site, our web and mobile apps, and related services (together, the “Services”).

Salons use DoWhat to run their business, which includes storing information about their own clients. For that client information, the salon is the party that decides how the data is used (the “controller”) and DoWhat processes it on the salon’s behalf (the “processor”). If you are a client of a salon that uses DoWhat, please contact that salon about your information; we will support their requests.

Information we collect

• Account & business information — name, email, phone, business name, role, and login credentials for salon owners and staff.
• Salon operational data — appointments, services, schedules, staff, and the client records a salon enters (names, contact details, appointment history, and service notes). A salon controls what it enters.
• Correspondence with a salon — the emails, text messages, booking-form enquiries and phone calls a client sends to a salon that uses DoWhat, and the replies sent back. For a call to an assistant-answered line, we keep a written transcript and call details such as the number that called, the time and the length of the call.
• Photographs — where a salon enables it, photographs of a client’s hair attached to that client’s record.
• Payment information — subscription and billing details. Card data is handled by our payment processor; we do not store full card numbers.
• Usage & device data — log data, device and browser type, IP address, and interactions with the Services, collected to keep them secure and working.
• Communications — messages you send us (e.g. support requests) and related metadata.

How we use information

• Provide, maintain, secure, and improve the Services.
• Process bookings, briefings, notifications, and payments.
• Handle correspondence between a salon and its clients, including the automated assistance described below.
• Respond to support requests and communicate about your account.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our terms.

We do not sell personal information, and we do not use salon client data for advertising.

Photos

Where a salon enables it, a stylist may attach photographs of a client’s hair to that client’s record. Photographs are chosen from the device’s photo library, location data is removed before upload, and they are stored in the salon’s own private storage and shown only to that salon’s authorised staff.

Messages we send for a salon

Staff can send a client an email or text from the app (appointment replies, receipts, messages). We process and deliver that message and keep a record of what was sent, to whom and when.

Service notes

A salon may record service-relevant notes about a client (for example a product sensitivity). These are the salon’s service records and are visible only to that salon’s staff.

AI and automated processing

How we use AI. DoWhat uses artificial-intelligence models provided by Anthropic to help a salon handle its correspondence and bookings. When you write to a salon that uses DoWhat — by email, text message or booking form — or call a salon’s assistant-answered phone line, the content of your message or call is processed by AI in order to understand what you are asking for.

Automated replies and bookings. Depending on how the salon has set DoWhat up, its assistant may reply to you automatically, without a staff member reviewing the reply first — for example to acknowledge your request, offer available appointment times, ask a clarifying question, or answer a routine question such as opening hours or prices — and may confirm an appointment at a time you choose. Anything the assistant cannot resolve is passed to the salon’s staff. An email sent this way carries a line at the foot of the message saying it was sent automatically and how to reach a person. A text sent this way is marked as automated too, either by a short line saying it is an automated message from the salon or by being signed in the name of the salon’s AI assistant. Some salons also sign their emails with their assistant’s name. You can ask to deal with a person at any time by replying to say so or by calling the salon, and you can ask the salon to review any booking the assistant made.

Assistance for staff. Other AI features only help a staff member write — suggesting or polishing a reply that a person then reviews and sends.

Assistant-answered phone lines. Where a salon has turned one on, your call is answered by an AI assistant. A call to an assistant-answered line is transcribed, and the transcript is filed in the salon’s inbox alongside its other client correspondence.

What is shared, and with whom. For these purposes the content of your message or call, your name, and relevant booking details (such as your upcoming and past appointments) are sent to Anthropic. Anthropic processes this data as our processor, under its Commercial Terms and Data Processing Addendum, and does not use it to train its models. Anthropic deletes this data within 30 days by default, and may keep it longer only where the law requires or where its automated safety systems flag a violation of its usage policy. Calls to an assistant-answered line are additionally processed by our voice providers for speech recognition and speech synthesis.

How we share information

We share personal information only as described here:

• Service providers — vetted vendors that host, secure, and operate the Services on our behalf, listed by name below, under contracts that limit their use of the data.
• Within your salon — data is visible to the salon’s authorized users per their roles and permissions.
• Legal & safety — when required by law, or to protect the rights, safety, and security of users, the public, or DoWhat.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice as required by law.

Who processes data for us

These are the providers that process personal information on our behalf so the Services can run:

• Google Cloud — hosting, databases, file storage, and salon mailbox integration.
• Anthropic — the AI models described above.
• Twilio — text messages and telephony.
• Resend — email delivery and receipt.
• Vapi and Deepgram — speech recognition and speech synthesis for assistant-answered phone lines.
• Auth0, Apple, and Google — staff sign-in.
• Sentry — error monitoring.
• Cloudflare — network delivery and this website.

Data retention

We keep personal information for as long as an account is active and as needed to provide the Services, then for a limited period to meet legal, accounting, and security obligations. Salons can request deletion of their data as described below.

Security

We use encryption in transit, access controls, and other safeguards designed to protect personal information. No method of transmission or storage is completely secure, but we work to protect your data and to notify you of incidents where required.

Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to object to or restrict certain processing. Salon owners and staff can exercise these rights, or ask questions, by emailing support@dowhat.salon. If you are a salon’s client, contact that salon and we will assist them.

Cookies & analytics

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Services are used so we can improve them. You can control cookies through your browser settings.

Children

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from children.

International transfers

We are based in Canada and may process and store information in Canada and other countries where we or our service providers operate, with safeguards required by applicable law.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, additional notice.

Contact us

Questions about this policy or your information? Email support@dowhat.salon. We’re based in Toronto, Canada.