Privacy Policy

1. Who We Are

Helena at SoBella Salon is a hair salon located at 214 E Mountain St, Suite 102, Kernersville, NC 27284. We operate this website to allow clients to book appointments, make payments, and view our work. We are the data controller for personal information collected through this Site.

2. Information We Collect

Information you provide directly when booking:

• Full name — to identify your appointment.
• Email address — to send booking confirmations, reminders, and receipts.
• Phone number — to send SMS appointment reminders (if you provide it).
• Appointment notes — any preferences or requests you enter during booking.

Information collected automatically:

• Push notification token — if you opt in to browser push notifications via OneSignal, a device token is stored to send you appointment alerts.
• Theme preference — we store a cookie remembering whether you prefer the light or dark colour scheme.
• Cookie consent choice — a cookie records whether you have accepted or declined non-essential cookies.
• Server logs — standard web server access logs may record your IP address, browser type, and pages visited. These are used for security monitoring and are not linked to your booking profile.

Payment information:

Payments are processed entirely by Stripe, Inc. We never see or store your full card number, CVV, or billing address. We receive only a payment confirmation and a Stripe payment reference. Stripe's privacy policy is available at stripe.com/privacy.

3. How We Use Your Information

• To confirm, manage, and reschedule your appointments.
• To send automated reminders before your appointment (email and/or SMS).
• To send payment receipts and billing-related communications.
• To allow you to view and manage your own appointments at /my-appointments.
• To generate anonymous, aggregate statistics (e.g. number of bookings per month) for salon management.
• To comply with applicable legal and tax obligations.

We do not sell your personal data, use it for advertising, or share it with third parties for their own marketing purposes.

4. Legal Basis for Processing

We process your personal data on the following grounds:

• Contract performance — processing your booking and taking payment.
• Legitimate interests — sending appointment reminders, preventing no-shows, and operating the booking system securely.
• Consent — push notifications and non-essential cookies, where you have opted in.
• Legal obligation — retaining payment and financial records as required by law.

5. How We Share Your Information

We share your data only as necessary to operate the service:

• Stripe, Inc. — payment processing. Stripe Privacy Policy.
• Twilio, Inc. — SMS appointment reminders, if you provide a phone number. Twilio Privacy Policy.
• OneSignal, Inc. — browser push notifications, if you opt in. OneSignal Privacy Policy.
• Hosting provider — your data is stored on our web hosting servers. Our provider is contractually required to keep it secure.
• Legal requirements — we may disclose information if required by law, court order, or governmental authority.

6. Data Retention

• Appointment records — retained for 3 years from the appointment date for business and tax records, then deleted.
• Payment records — retained for 7 years as required by U.S. tax law.
• Push notification tokens — retained until you unsubscribe from notifications or your token expires.
• Server logs — retained for 90 days, then automatically overwritten.

7. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — ask us to delete your data, subject to retention obligations.
• Portability — request your appointment data in a machine-readable format.
• Withdraw consent — unsubscribe from SMS or push notifications at any time.

To exercise any of these rights, email us at support@i8o8.com. We will respond within 30 days.

8. Data Security

We implement reasonable technical measures to protect your data, including HTTPS encryption in transit and restricted access to data files on our server. No method of internet transmission is completely secure; we cannot guarantee absolute security but are committed to protecting your information.

9. Children

This Site is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has submitted their information, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will update the "Last updated" date above. We encourage you to review this page occasionally.

11. Contact