Privacy policy

SaloonERP is a product of Lacspace Corporation Pvt. Ltd., registered in India and Nepal, with offices in Nagpur and Kathmandu. When you use the product we act as a data processor for your salon's customer records, and as a data controller for your own account details.

That distinction matters: your customers' data belongs to you. We hold it on your behalf and act on your instructions.

Account data. Your name, email, phone, workspace name and billing contact.

Salon data you enter. Customers, appointments, invoices, staff, stock and settings. We do not mine this or use it to train anything.

Technical data. IP address, browser and device type, and timestamps, kept in server logs for security and debugging.

We do not collect payment card numbers. Card details go directly to your payment provider and never touch our servers.

To run the service you asked for: showing your queue, issuing invoices, calculating reports and keeping an audit trail you can rely on.

To keep the service secure — rate limiting, fraud detection and investigating anything that looks wrong.

To contact you about the service. We do not sell your data or share it with advertisers, because we do not have advertisers.

While your workspace is active, and for 90 days after cancellation so an accidental cancellation is recoverable.

After 90 days, salon data is deleted from live systems. Encrypted backups roll off within a further 30 days.

Financial records may be retained longer where Indian or Nepali law requires it.

A small number of infrastructure providers process data on our behalf: our hosting provider, our database provider, and our email delivery provider. Each is bound by a processing agreement.

We will disclose data to authorities only where legally compelled, and we will tell you unless we are legally forbidden from doing so.

You can export everything as CSV from Settings at any time, on every plan, without asking us.

You can ask us to correct or delete your account data by emailing us. We respond within 30 days.

If one of your customers asks you to delete their record, you can do it yourself in the dashboard — no support ticket required.

TLS in transit, encryption at rest, argon2id password hashing, short-lived access tokens and httpOnly refresh cookies.

Full detail is on our security page.

If we change anything material we will email every workspace owner at least 14 days before it takes effect, and note it in the changelog.

The date at the top of this page always reflects the last substantive change.