Privacy
What we hold, why we hold it, and what we will never do with it. In plain words, because a privacy notice nobody can read protects nobody.
Last updated 1 September 2026
Who holds your data
myPocketSalon is operated by DarkSolutionsUK (Ben Darlington), a sole trader trading from 19 Osier Court, Thornton-Cleveleys, FY5 4QS. For a salon's own account details that business is the data controller; for a salon's client list it is the processor, acting on the salon's instructions. Data protection questions go to privacy@mypocketsalon.app.
Two kinds of person
This product has salons and it has their clients, and the difference matters. A salon is our customer. A salon’s clients are the salon’s — we hold their details on the salon’s behalf and under the salon’s instructions. In data protection terms the salon is the controller of its own client list and we are its processor.
What we hold about a salon
Your name and email, which come from the account you sign in with. Your salon’s name, address, phone, opening hours, services and prices. Your branding. What you have taken, what we have charged and what has been paid out to you.
What we hold about a salon’s clients
Whatever the salon puts in: name, email, phone, appointment history, notes the salon writes, patch test dates, and whether they have agreed to marketing. We store it so the salon can run its diary. We do not use it for anything of our own.
Health information
A consultation or patch-test form can ask about allergies, skin conditions, medication and pregnancy. That is health information, which the law treats as a special category. It is collected only when a salon asks for it, only with the client’s explicit agreement on the form itself, and it is held for the salon alone — never used, shared or analysed by us. The signed form is kept as the salon’s record.
Why we are allowed to
We hold a salon’s account details because we have a contract with the salon. We hold a client’s booking details because the salon needs them to provide the appointment, and we send the confirmation and reminder on the same basis. We keep records of payments because tax law says we must. We look for fraud in payments because it is in everyone’s legitimate interest that we do. Marketing to a client happens only with that client’s consent, and health information only with their explicit consent.
Card details
We never see them. Card numbers go straight to Stripe, who are the ones authorised to handle them; we receive back that a payment happened, for how much, and the last four digits. There is no card number in our database to lose.
What we send to a salon’s clients
In the salon’s name, never ours: a confirmation when they book, a reminder before the appointment, and — only where the salon records that the client agreed to it — a note when a regular is overdue. That last one is marketing and carries a one-click unsubscribe. An unsubscribe is final and cannot be switched back on from inside the app.
What we never do
We do not market our own product to your clients. We do not sell or share your client list. We do not let another salon, or anyone who referred you, see your diary, your clients or your takings. A referrer sees the commission a salon generated and nothing else about it.
Who else is involved
Stripe, for payments and payouts — card details go to them, not us. Google, whose mail service delivers the emails above. OpenAI, in the United States, which powers the assistant: when a salon or a client asks it something, the words of that question and the diary details needed to answer it are sent to OpenAI under their data-processing terms and the UK’s international transfer addendum, and are not used to train their models. Miluma, which publishes the social posts a salon approves. Hetzner, who host the servers, in Germany. The sign-in service, which is run by the same operator under the Darks Games name. Each of them sees only what that job needs, and none of them may use it for anything else.
How long we keep it
A salon’s data for as long as the salon has an account. Records of payments for six years after the payment, because tax law requires it. A client’s consultation and patch-test forms for as long as the salon instructs — three years after their last appointment unless the salon says otherwise, which is what their insurers ask for. Conversations with the assistant on our public pages for ninety days. Server logs for thirty days. When a salon closes its account, everything else is deleted within thirty days.
Getting your data out
Settings has a Your data panel: clients, appointments and takings, each as a spreadsheet, downloadable whenever you like. There is nothing to request and nobody to ask. If you want your account deleted entirely, write to us.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to privacy@mypocketsalon.app. If you are unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
We use no advertising cookies and no third-party tracking. The app stores a sign-in token in your browser so you do not have to log in on every page, and remembers a referral code if you arrived through someone’s link. That is all.