Privacy Policy

1. Two kinds of information

• About our customers: salon owners and their teams, and people who use our website. We decide how this information is handled, and this policy covers it.
• About salons’ clients: the names, contact details, appointments and everything else a salon keeps in FullColumn. The salon decides how that’s used, and we handle it for the salon under our Data Processing Agreement. If you’re a salon’s client, the salon is the place to start with any question about your information. We’ll help it answer.

2. What we collect about our customers

• Your name, email address, mobile number and role, and your salon’s details: its name, address, phone, ABN or GST number, time zone and settings.
• How you sign in: your password (kept only as a secure hash that can’t be read back), your two-step sign-in key (encrypted), and the devices you’re signed in on.
• Billing: your plan, invoices and payments. Stripe holds your card details; we never see or keep your full card number.
• What you tell us when you contact us, and our notes while we help you.
• Technical details: IP addresses, browser details and the times of requests, in logs we keep to run and protect FullColumn.
• Visits to our website: which pages are viewed, the site you came from, and your browser, kind of device and country, counted by Cloudflare Web Analytics without cookies.
• How your salon uses FullColumn (such as how many texts it sends), so we can bill you, help you and improve it.

3. The waitlist for other countries

FullColumn is in Australia for now. Salon owners elsewhere can join a waitlist on our sign-up page to hear when it comes to their country.

• What we collect: your name, email address, your salon’s name, country and city (if you give it), and how many people take appointments there.
• Why: to send you one email when FullColumn launches in your country, and to decide where it goes next (how many salons are waiting, and how big they are). We use it for nothing else, and send you no other emails because of it.
• How long we keep it: we delete it within 90 days after that email, or 2 years after you joined (or last updated your details) if FullColumn hasn’t come to your country by then.
• Getting removed: email contact@vplabs.io and we’ll delete your details.

4. What salons keep about their clients

Depending on how a salon uses FullColumn: clients’ names, mobile numbers, email and postal addresses, birthdays, appointments and visits, notes, colour formulas, alerts (such as allergies), consultation form answers with signatures (and when and from which IP address a form was signed), photos, purchases, account credit, messages, and whether they’ve agreed to marketing.

• Some of it, like allergies and consultation answers, is health information, which the law treats as sensitive. Salons are responsible for collecting it with their clients’ consent.
• A client’s saved card is held by Stripe, in the salon’s own Stripe account. FullColumn keeps only the card’s brand and last four digits.
• When a salon texts from a number shared between salons, we keep a record of which salon last texted each mobile from it, so a reply reaches the right salon.

5. How we use it

• To run FullColumn: signing in, bookings, messages, payments and the rest.
• To bill salons, and to help them when they ask.
• To keep FullColumn secure: to prevent fraud and misuse, and to look into problems.
• To tell salon owners about their account and important changes to FullColumn. We may also send owners news about FullColumn, which they can stop at any time.
• To meet our legal obligations.

We don’t sell personal information. We don’t use salons’ client information for our own marketing, for advertising, or to train artificial intelligence.

6. Cookies and analytics

• FullColumn uses cookies only to keep you signed in, and each is limited to the salon you’re signed in to. It keeps a few preferences in your browser, like how you like to see the calendar.
• There are no advertising or tracking cookies. Our website counts visits with Cloudflare Web Analytics, which uses no cookies, keeps nothing in your browser and doesn’t follow you to other sites.
• A salon can add its own Google Analytics or Meta Pixel to its booking page and gift voucher shop. That’s the salon’s choice, under its own privacy policy. Pages with private links (a client’s booking, forms, payments and the client area) never load them.

7. Who we share it with

Service providers who help us run FullColumn, only for that:

• Cloudflare, Inc. (United States (company); Oceania (salons’ data)): Hosting, databases and file storage. Salons’ data is stored in its Oceania region; its network carries traffic worldwide.
• Stripe (Australia and the United States): Billing salons for FullColumn, and the card payments salons take in their own Stripe accounts.
• Mobile Message (Australia): Texts to Australian mobile numbers.
• Twilio Inc. (United States): Texts to numbers in some other countries, when a salon texts them.
• ClickSend (Australia): Texts to numbers in some other countries, when a salon texts them.
• Resend (United States): Sending email.

Some of them store or access information outside Australia, mainly in the United States. We choose providers that protect it, and take reasonable steps to make sure they handle it in line with the Australian Privacy Principles.

We also share information when the law requires it, to protect someone’s safety, or with a buyer of FullColumn’s business, who would have to keep to this policy.

8. Keeping it safe

• Every connection is encrypted.
• Each salon has a database of its own, and its photos are stored privately and shown only to people with access.
• Passwords are stored as secure hashes, wrong guesses are limited, and two-step sign-in is available to everyone (and always on for our own staff). Keys such as two-step sign-in keys are encrypted.
• Salons choose what each team member can see, and can hide clients’ contact details from some of them.
• Our staff only see inside a salon when its owner lets them in, and every visit is recorded and shown to the salon.

9. How long we keep it

• A salon’s data, for as long as it uses FullColumn, and for 90 days after its trial or plan ends, so it can take its data with it or come back. Then we delete it, after telling the salon’s team by email.
• Each salon’s history is kept for 30 days, so deleted information leaves it within 30 days. A photo nothing uses any more is deleted after 31 days.
• Waitlist entries, until no more than 90 days after we’ve told you FullColumn is in your country (see the waitlist).
• Billing records, for as long as tax law requires.
• Technical logs, for a short time.

10. Seeing and correcting your information

• You can ask to see or correct the information we hold about you by emailing contact@vplabs.io. We’ll reply within 30 days.
• If you’re a salon’s client, ask the salon first: it can see, correct, download and remove your details in FullColumn, and we’ll help it if it needs us.
• You can ask us general questions without telling us who you are.

11. Data breaches

If a data breach is likely to cause serious harm, we follow the Notifiable Data Breaches scheme: we tell the people affected and the Office of the Australian Information Commissioner. If it involves salons’ client information, we tell the salons affected straight away and help them.

12. Questions and complaints

Contact our privacy officer at contact@vplabs.io, or by post at Level 32, 152 St Georges Terrace, Perth WA 6000. We’ll reply within 30 days. If you’re not happy with our answer, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, or 1300 363 992.

13. Changes to this policy

We’ll publish any change to this policy here, with its date. We’ll tell salon owners about important changes by email or in FullColumn.