Who this covers
Gloss Front runs Gloss Front, a website platform for salons. Two different groups of people appear in this policy and it is worth separating them at the start.
- Salon owners and their staff - our customers, who have an account with us.
- People who visit a salon’s website - not our customers. We hold very little about them, and the salon is the one they have a relationship with. Each salon’s site carries its own privacy policy for that.
- People who visit Gloss Front itself - this website, where salon owners read about the product before they sign up.
What we collect from salons
- Your account - name, email address, and a password we never store. Passwords are hashed with argon2id, which is a one-way operation: we cannot read yours, and neither can anyone who obtains the database.
- Everything you put on your website - services, prices, photographs, staff profiles, opening hours, blog posts. It is your content and it stays yours.
- Billing details - which plan you are on and when it renews. Card numbers go straight to Stripe and never reach our servers.
- What you connect - if you link Meevo, we read your services, staff, locations, clients and appointments into your account so your website can use them. We never write anything back to Meevo; no code path exists to do so.
- Enquiries from your website - the messages your visitors send you through your contact form, so you can read and answer them.
- A record of significant actions - who deleted what, and when. It exists so a question about a change has an answer.
What we collect from your visitors
Deliberately close to nothing. We count page views and button presses so you can see whether your website is working. There are no advertising cookies, no cross-site tracking, and no third-party trackers on your site unless you add them yourself under Website → Tracking.
We do not store full IP addresses. A visitor is counted using a hash that is rebuilt from scratch every day, so the same person cannot be followed from one day to the next, and no statistic can be traced back to an individual.
If you switch on live availability, a visitor asking about times sends that date to your booking software. That is the only thing on a published page that reaches a third party on a visitor’s action.
What we collect when you visit Gloss Front
This is about our own website, not a salon’s. We want to know which pages are useful and how people find us, so:
- One first-party cookie, holding a random number and nothing else, so we can tell a returning visitor from a new one and see the pages they read here. It is set by us, read only by us, and lasts a year.
- Roughly where you are - a city, region and country, looked up from your IP address in a database on our own server. The address itself is not stored and is never sent to anybody.
- How you arrived - the site that linked to us, or the campaign in the link, and the device type.
- What you tell us - if you leave your name and email, ask for a call back or book a meeting, we keep it with the pages you read before, and pass it to our own sales system so a person can get back to you.
If your browser sends a Global Privacy Control signal, we set no cookie and keep no record of your visit at all. Anything you choose to send us through a form still reaches us, because you asked it to.
Who else sees any of it
We do not sell data, and we do not share it for anyone else’s marketing. The companies below see specific things because they do a specific job:
- Stripe - payments, when card payments are switched on. They see your billing details; we see whether you paid.
- Meevo - only if you connect it, and only to read. They are your existing provider and already hold this data.
- Google - for reCAPTCHA on public forms, when it is switched on.
- The AI provider behind the writing assistant - Google, OpenAI or Anthropic, whichever we use at the time. Text you send to the assistant reaches that provider; we do not send it anything you have not asked us to write about.
- Your own email provider - email campaigns leave through your mailbox, on your provider, under your address. Your campaign volume never touches ours.
- Facebook and Instagram (Meta) - only if you connect an account on Social. We keep the page or account’s id and name and the sign-in Meta gives us, encrypted, and use it only to publish the posts you schedule and to show you the link to each one. We do not read your messages, followers or insights. Disconnect on Social > Accounts, or remove our app in Facebook or Instagram settings, and the sign-in is deleted; asking Meta to delete your data deletes the connection too.
We will disclose data if the law requires it. If that ever happens and we are permitted to tell you, we will.
Where it is kept, and for how long
- Anything you delete goes to your Trash and is recoverable for thirty days. After that a nightly job removes it for good and there is no copy.
- Deleting your salon does the same thing to the whole account: the website goes offline immediately, and after thirty days everything is destroyed.
- Visit statistics are aggregated over time. Because they were never tied to a person, what remains is a count.
- On Gloss Front itself, the pages a visitor read are kept for ninety days, and a visitor who never asked us for anything is forgotten after thirteen months. A request you sent us is kept until you ask us to delete it.
- We keep the records tax and accounting law requires us to keep, for as long as it requires.
How it is protected
- Passwords are hashed with argon2id and are not recoverable.
- Stored secrets - your Meevo credentials, payment keys - are encrypted at rest with AES-256-GCM.
- Sessions are held on our servers rather than in a token you carry, so removing someone’s access ends it on their very next request rather than whenever a token happens to expire.
- Everything travels over HTTPS, including every salon subdomain.
No system is beyond reach, and we are not going to claim otherwise. If we ever discover a breach affecting your data, we will tell you what happened and what we are doing about it.
What you can ask for
A copy of what we hold, a correction, or deletion. Email support@glossfront.com from the address on your account and we will do it - there is no form and no charge. You can also delete your salon yourself from Trash inside your admin, which starts the thirty-day clock immediately.
Depending on where you live you may have further rights under the GDPR, the CCPA or the law where you are. We apply the same answer to everybody, so asking is enough.
Changes to this policy
If we change something that matters we will email account holders rather than quietly updating the date at the top. The date is there so you can tell.
Looking for the policy on a salon’s own website? That is a separate document on their own address, about their salon. This one covers only Gloss Front.
Getting in touch
Write to support@glossfront.com about anything on this page. A person reads it - there is no form and no ticket queue.