Privacy Policy

When you book with a salon on Talock, the salon you booked with is the data controller — it decides why your data is used (to give you the service) and holds the direct relationship with you. Talock is the data processor: it operates the booking platform and processes your data on the salon’s instructions. The platform is operated by [legal entity name — pending registration], [registered address]. Contact for privacy questions: [privacy contact email].

The database, authentication and file storage are hosted in the United Kingdom (London region). The UK is recognised by the EU under an adequacy decision, meaning transfers of personal data from the EU/EEA to the UK are treated as going to a country with an equivalent level of protection. Some sub-processors listed below operate in the EU/EEA or under equivalent safeguards.

• Booking details — your name, phone number, email, preferred language, chosen services, staff, dates and appointment history.
• Account & sign-in — we authenticate you with a one-time code sent to your email (email OTP); no password is stored for customers.
• Communication preferences — e.g. whether you opted in to WhatsApp reminders, and web-push notification subscriptions if you enable reminders.
• Reviews — any rating and comment you choose to submit.
• Messages — content of chat messages you exchange with the salon.
• Technical data — limited request metadata used for security and rate-limiting.

• To provide the booking and manage your appointments — performance of a contract.
• Confirmations & reminders (email and, if enabled, web push) — legitimate interest in reducing no-shows and delivering the service you asked for.
• Marketing / WhatsApp messages — only with your consent, which you can withdraw at any time.
• Security, fraud and abuse prevention (including rate-limiting) — legitimate interest.
• Legal and accounting obligations — legal obligation, where applicable.

Talock relies on the following providers to run the service:

We do not sell your personal data. Data is shared with the salon you booked with and the providers above only as needed to run the service.

The booking assistant on each salon page is an automated AI system, labelled as such in the chat window before you interact with it, built on Anthropic Claude. It answers booking questions, checks availability, and can pass a message to the salon. It can make mistakes, its replies are marked machine-readably as AI-generated, and it never takes decisions with legal or similarly significant effect about you. Salon staff may also use AI-drafted reply suggestions in chat: a human always reviews and sends those messages. These disclosures are made under Article 50 of Regulation (EU) 2024/1689 (the EU AI Act). Message content you type is processed by Anthropic under data-processing terms and is not used to train its models.

We keep booking and account data for as long as you use the service and for the period the salon needs it for its records, then delete or anonymise it. Specific retention periods: [retention schedule to be confirmed]. You can ask for earlier erasure (see below).

Subject to applicable law, you can ask to:

• Access the personal data we hold about you;
• Rectify data that is wrong or out of date;
• Erase your data (“right to be forgotten”);
• Restrict or object to certain processing;
• Port your data to another provider;
• Withdraw consent at any time (e.g. unsubscribe from marketing) without affecting prior processing.

To exercise these rights, contact the salon you booked with, or Talock at [privacy contact email]. You also have the right to complain to a data-protection supervisory authority ([supervisory authority]).

We use strictly necessary storage to keep you signed in and to remember your language choice. We do not use third-party advertising cookies. Details: [cookie details to be confirmed].

We may update this policy as the service or the law changes. The current version is always at this page, with the “last updated” date above.