Privacy Policy

Who handles your data

You can reach us at [email protected].

Two parties are involved in almost every record. The salon you booked with decides what it records about you and why — it is the salon that writes the notes, sets the prices and sends the campaigns. So for your bookings, the notes written about you and the salon's campaigns, the salon is the controller. Grafiko's operator is the processor for that data: it stores and processes the data on the salon's behalf.

For other data, the controller is the operator named above. That means your account, if you created one; salon owner and staff accounts; the log of messages sent; the counters that protect our forms; and the mail you send us.

What we hold about clients

When you book, the salon's page asks for what a salon needs to hold an appointment for you:

• Your name, and your email address and phone number. If a salon books you in over the phone, one of those may be missing, and the booking still works.
• The language you prefer, so we know which language to write to you in.
• A password, if you chose to create an account. It is stored only as a scrypt hash — we cannot read it, and we cannot tell you what it is.
• Your appointments: the salon, the service, the stylist, the date and time, the status, the price recorded at the moment you booked, and who created or cancelled the booking.
• Notes salon staff write about an appointment or about you as a client. These are free text, written by people, and visible only to the salon that wrote them.
• Waitlist entries and recurring series you are part of.
• Ratings and reviews, if you leave one after a visit: the star rating (1 to 5), the comment if you write one, and which visit and stylist it is about. A review that is not hidden appears on the salon's public page with the stylist's name and without yours. The salon can hide a review.
• What the salon records when it closes out a visit: the amount taken, how much of it was a tip, the payment method (cash, card, bank transfer or other), a note on why the amount differs from the price, when it was recorded and which staff member recorded it. This is the salon's own record of its takings; Grafiko does not process the payment.
• The contact name and phone number a salon keeps for you in its own client list, which may differ from those on your account. Only that salon sees them.
• A record of what you accepted when you created an account or registered a salon: which version of the Terms and of this Privacy Policy, when, in which language, and the minimum age you confirmed (16 for a client account, 18 for a salon owner or staff member). The age is your own declaration; Grafiko does not check it.
• Your marketing consent history with each salon. From 4 October 2026, every time consent was given or withdrawn, when, and how — on an online booking form, in your account settings, at the salon desk on your word, or through an unsubscribe link — and, where a salon employee entered it, which staff member recorded it. For consents given before that date we hold only the time of the latest grant and the latest withdrawal, and the method is not recorded.

One thing to know about email addresses

Grafiko does not verify email addresses. If someone types your address into a salon's booking form, the confirmation email arrives with you. If that happens, ask the salon and it will be removed.

You can also ask us to remove it: [email protected].

What we hold about salon staff and owners

If you work at a salon that uses Grafiko, we hold:

• Your name, email address, phone number, preferred language, and password hash.
• Your role in the salon (owner, manager, staff) and whether your account is invited, active or disabled.
• Your job title, biography and profile photo, if the salon added them. These are shown publicly on the salon's booking page — that is their purpose. The photo is stored in our database and served from our own address, not a third party's.
• Your working hours, days off and one-off exceptions, and which services you perform.
• The appointments assigned to you, and the reports the salon derives from them, including what was charged and what was recorded as taken, and how many clients you saw.
• Your name against records you make: a visit you closed out, and a marketing consent you recorded at the desk for a client.

What we do not collect

This section exists because most privacy policies quietly leave room for these things. Grafiko does none of them. There is one thing it does hold that points at a person, and it is set out here rather than left for you to find.

Every public form — signing in, signing up, registering a salon, asking for a password reset, booking, and changing a booking from the link in your email — is throttled against the network address your request arrives from. So we store that address in an hourly counter, only as a SHA-256 hash and not as the address itself: the hash, which form it was, the hour, and how many attempts it holds. A hash is still personal data. The email addresses counted in the same table are also stored only as a SHA-256 digest, so that a copy of the database gives up no address directly. Nothing you typed and no outcome is kept beside it. These counters are also the one thing Grafiko deletes on a schedule — see How long we keep it.

• No analytics, no tracking pixels, no advertising cookies, no session recording, no A/B testing tools.
• No card numbers or bank details. Grafiko does not process payments at all today.
• No location data, no identity documents, no photographs of clients.
• No social sign-in, so nothing arrives here from Google, Facebook or anyone else.
• No third-party scripts on any page, and fonts are served from our own address rather than loaded from an external service.

Cookies

Grafiko sets only what it needs to function. There is no advertising or analytics cookie anywhere on the site, which is also why you are not being asked to dismiss a cookie banner.

• A session cookie once you sign in, so you stay signed in. It cannot be read by scripts in your browser, and it lapses after about 30 days without use.
• Two supporting cookies from the same sign-in library: one guards against cross-site request forgery, one remembers where to return you after signing in.
• A language cookie (NEXT_LOCALE) remembering whether you chose Georgian or English.

Who else sees your data

A short list, and it is the whole list.

• The salon you booked with sees its own records. Salons cannot see each other's clients, appointments or notes — the separation is enforced on the server for every single action, not merely hidden in the interface.
• Resend, our email delivery provider, receives the recipient's address and the full content of each message we send. Messages are sent from Ireland (EU), but Resend states that it stores account data, including email metadata and logs, in the United States.
• Cloudflare, a network intermediary through which every request to grafiko.ge passes. It sees your network address and the data your browser sends to and receives from our pages, because the encrypted connection ends with it.
• Mail written to [email protected] passes through Cloudflare's email routing and is delivered to a Gmail mailbox (Google), where we read it.
• Our hosting and database provider: Amazon Web Services (Frankfurt, Germany).
• Backup copies of the database are made every night on the same server, which belongs to the hosting provider named in the previous item. Each copy is also sent to Amazon Web Services (AWS) storage in Ireland (EU), where it is kept encrypted and deleted automatically after 30 days. In addition, AWS takes a daily copy of the server disk in Frankfurt and keeps the latest 7. Copies made before 13 October 2026 also remain with the previous hosting provider, UpCloud (Frankfurt, Germany; Helsinki, Finland), until they are deleted.
• Grafiko's own operators can open a salon's records — read-only — to answer a support request. Every such view is kept in a support access log: which operator, which salon, and what they opened.
• Other platform screens are not scoped to one salon — the email log, which holds every message's recipient and subject, and a salon's record showing its owner's contact details. Unlike the support views above, these are not recorded.
• Nobody else. Grafiko does not sell personal data and does not share it for advertising.

The emails we send

Two kinds, and they behave differently.

Transactional email is part of the booking: the confirmation, a reminder before the appointment (by default 24 hours before, though each salon can change that or switch reminders off), a notice when a waitlisted slot opens, a notice when the salon cancels or moves your booking, a confirmation when you cancel or move it yourself, a password reset link, and an invitation if a salon adds you as staff. These contain the salon name, the service, your stylist's name and the appointment time. A salon's owner and managers get a notice of each new booking, with the client's name, email and phone number where the client gave them, and a notice when a client asks for their data to be deleted. We also write to salon owners about the service itself, for example when the terms change materially or when billing is about to start.

Transactional email has no unsubscribe link, because it is the thing you asked for by booking. If you do not want it, tell the salon before you book.

Marketing email is separate, is sent by a salon rather than by us, and only ever reaches people who opted in. Every marketing email carries an unsubscribe link that works without signing in, and the standard unsubscribe header — so mail apps that support it can offer their own unsubscribe button.

We also keep a record of every message we send, which is how an operator can answer whether last night's reminders actually went out. Each entry holds the recipient address, the subject, which template produced it, the outcome — accepted by the provider, rejected by it, or logged without being sent because no provider is configured — the provider's own message id where there is one, the error text if it failed, the salon and the account it belongs to where those are known, and the time. Nothing in this log is deleted automatically, but the recipient address is replaced when the account is erased.

Marketing consent

The consent box on a booking form is unticked by default, and consent is never implied by the act of booking.

A salon can also record consent you gave in person at the desk. If you receive marketing you do not remember agreeing to, use the unsubscribe link, or your account page, which lists every salon that may write to you — and tell us: that combination should never happen.

Withdrawing is recorded as a withdrawal, not as an absence of consent. This matters: it means a later booking at the same salon cannot silently subscribe you again. Getting back on the list requires you to agree again, explicitly.

The link in your confirmation email

Your confirmation and reminder emails contain a link with a secret code in it. That code is what lets you open the booking, reschedule it or cancel it without signing in.

It follows that anyone holding that link can do the same. The code does not expire. Forward the email only to someone you would be content to have cancel the appointment.

The link shows that one booking and nothing else — unless it's part of a repeating booking, in which case it opens every visit in that series too. Either way, it is not a way into your account or into anyone else's appointments.

How long we keep it

Stated plainly, because this is where policies usually promise a schedule that the software does not keep: Grafiko deletes nothing in the database automatically, with the single exception below. No retention period is set in advance and there is no scheduled clean-up. Appointments, client records, staff notes and withdrawn consents stay in the database until they are deleted on request — from inside the app by the person or the salon, or by someone on our side for anything else — as described below.

The exception is the abuse counters described under What we do not collect. The same hourly job that sends appointment reminders also clears counters whose time window began more than 24 hours ago, so a stored hashed network address is deleted within about 1–2 days (25–48 hours) of the request that recorded it. That is the only automatic deletion inside the database, and the only personal data in it that any automatic deletion touches. Backup copies are deleted on their own schedule, described below.

Deletion happens on request: a signed-in client deletes their account from their account page, and a salon erases its client records from the client's page. When a salon asks to close its account (Settings → Request account closure → Request closure), we delete the owner's personal data (name, email, phone, the account itself) within 10 working days of the request and confirm to the owner when it is done; a person deletes the salon's remaining data by hand within 30 calendar days of the request; backup copies may still hold it for up to about 30 more days, on the schedule below. Any other request is carried out by a person, by hand. No fixed retention period is set for the database yet. Until one is, the period is set by this rule: data is kept until the person or the salon deletes it, or until the salon asks to close its account. After that the periods described above apply.

Three things remain after deletion, each on a different period. The salon's appointment and payment records stay, no longer connected to you; how long they are kept is set by the salon's own tax and accounting duties, not by Grafiko. The trace of your marketing consent or refusal is kept as a hash (HMAC) for 1 year. The record of your request and how it was handled is kept longer, as evidence that it was fulfilled on time: until the time limit for bringing a court claim, or a complaint to the State Audit Office, about that request has expired; after that it is deleted by hand.

Mail sent to [email protected] is not in the database. It sits in a Gmail mailbox, and deleting it there is done by hand. Ordinary correspondence — questions, plan changes, support — is kept for 1 year after the matter is closed, then deleted. We do the deleting every three months, removing closed conversations older than one year, so such a message can remain for up to about 15 months after the matter closed. A message deleted in Gmail stays in its trash for up to 30 days before Google removes it. A data-rights request (erasure, a copy, a correction) sent to that address, and the record of how we handled it, are kept longer, as described above.

Backups have their own period. A full copy of the database is made on the server every night. The latest 7 copies are always kept; beyond those, copies older than 14 days are deleted.

Each night's copy is also sent to AWS storage in Ireland (EU), where it is kept encrypted and deleted automatically 30 days after it is made. In addition, AWS takes a daily copy of the server disk in Frankfurt and keeps the latest 7. So data removed from the database can remain in backups for up to about 30 days, and in copies made before 13 October 2026 that remain with the previous hosting provider, UpCloud, until they are deleted.

Your rights

The Georgian Law on Personal Data Protection gives you rights over data held about you. In particular you may ask for:

• Information on what data is held about you, and a copy of it.
• A copy of your data in a structured, machine-readable format (data portability), where it is processed on the basis of your consent or a contract. For us that is a JSON file.
• Correction of inaccurate data.
• Blocking of your data.
• Deletion of your data, where the law allows it.
• That processing stop, if you object to it.
• Withdrawal of consent you previously gave, at any time.
• Information on who your data has been passed to.

How to exercise them

We will ask you to confirm who you are before acting, because acting on an unverified request is itself a data breach.

Send your request to [email protected].

Where the record belongs to a salon — your appointments, the notes written about you — we will pass the request to that salon, since it is the salon that decides about that data, and we will tell you that we have.

If you are signed in, you download your data or delete your account from your account page. If you booked as a guest, ask the salon where you booked for a copy or for erasure: your bookings and the notes written about you are held by that salon, and it decides about them. A salon owner cannot delete the account there: the owner requests closure from Settings or by writing to [email protected]. We delete the owner's personal data within 10 working days of the request and confirm to the owner when it is done, and a person deletes the salon's remaining data by hand within 30 calendar days. A salon team member asks the salon owner to remove them from the team first, then deletes the account. If the owner does not remove them, the team member can also write to [email protected] and we answer within 10 working days.

You correct your name and phone number yourself on your account page. An email change is done on request, within 10 working days.

When you delete your account, your reviews, waitlist entries and marketing consents are removed in every salon at once. The rest, meaning bookings and the notes written about you, each salon where you booked erases itself: we send it the erasure request.

You can withdraw consent to marketing email yourself, from your account page or with the unsubscribe link in any message we send.

We give you information and a copy within 10 working days. In a special case, with reasons, that period can be extended once by a further 10 working days, and you are informed at once if it is. Correction and deletion are done within 10 working days, and that period is not extended. Marketing consent stops within 7 working days of the request. These periods are set by the Personal Data Protection Law of Georgia.

A blocking request is decided within 3 working days: the decision, or the grounds for refusing, and exactly what was stopped. Today that is marketing email only. Bookings and reminders continue until the request is decided.

A request to stop processing is decided within 10 working days, with the grounds.

These requests are free of charge. If we refuse one, the answer comes with the reason and with how to appeal.

Three things remain after deletion. First, the salon's appointment and payment records, which the law requires the salon to keep: they are kept without your name, phone number or email. Second, the record that you once agreed to marketing email or refused it: the law requires it to be kept for one year after marketing ends, so it is kept without your name or any open contact detail, only as a hash (HMAC), and deleted after that. Third, the record of your request and how it was handled: only steps, dates and a hash, without your name, email or phone number.

If you believe your data has been processed in breach of the law, you can complain to the State Audit Office of Georgia or go to court (Article 22 of the Personal Data Protection Law of Georgia).

Security

What the software actually does:

• Passwords are stored as scrypt hashes with a random salt per user, never as text.
• Sessions live in a signed cookie that scripts in your browser cannot read.
• Password reset links can be used once and stop working after an hour.
• Every action that requires you to be signed in re-checks who you are and which salon you may touch. The booking actions, which by design have no signed-in user, re-check that the salon, service and stylist you chose belong together and that the time is genuinely free. Access is not merely hidden from the page — it is refused at the point of change.
• The cron endpoint that sends reminders refuses to run at all if its secret is not configured, rather than running unprotected.

What we are not claiming about security

No certification, audit or penetration test has been carried out, and this page does not claim encryption at rest, because nothing in the software configures it.

Hosting arrangement: Amazon Web Services (Frankfurt, Germany). The guarantees that come with it are the hosting provider's, not ours.

Children

Client accounts are for people aged 16 or older. Salon owners and staff members must be 18 or older. You state your age yourself when you create an account, and Grafiko does not check it. If an adult books an appointment for a child, the adult is responsible for the details entered.

Why we are allowed to process your data

Each purpose has its own legal ground under Article 5 of the Georgian Law on Personal Data Protection:

• Your booking, reminders and the visit record — performing your agreement with the salon (Article 5(1)(b)). The salon decides about this data.
• Your account, and salon owner and staff accounts — performing the agreement made under these terms (Article 5(1)(b)).
• Marketing email — your consent (Article 5(1)(a) and Article 12). You can withdraw it at any time.
• The form-protection counters and the log of messages sent — our legitimate interest (Article 5(1)(i)): protecting the forms from automated attacks, and being able to show that a message was actually sent.
• The trace of your marketing consent after deletion — a legal duty: Article 12(9) requires it to be kept (Article 5(1)(d)).
• The record of your request and how it was handled — to show that we answered within the time the law sets (Article 5(1)(i)).

Data outside Georgia

Grafiko's servers and backups are in the European Union, and some services belong to US companies. So your data reaches these countries:

• Germany (Frankfurt) — the server, the database and daily disk copies (Amazon Web Services).
• Ireland — nightly database copies (Amazon Web Services) and sending email (Resend).
• United States — Resend keeps email metadata and logs; every request to the site passes through Cloudflare.
• United States — mail written to [email protected] is kept in a Gmail (Google) mailbox.
• Finland and Germany — copies made before 13 October 2026, held by the previous hosting provider (UpCloud) until they are deleted.

Changes to this policy

When the text changes, the version and date at the top change with it. This is the pilot version and may change after legal review. We will publish a material change on this page in advance.