Who this covers
Gloss Front runs Gloss Front, a website platform for salons. Two different groups of people appear in this policy and it is worth separating them at the start.
- Salon owners and their staff — our customers, who have an account with us.
- People who visit a salon’s website — not our customers. We hold very little about them, and the salon is the one they have a relationship with. Each salon’s site carries its own privacy policy for that.
What we collect from salons
- Your account — name, email address, and a password we never store. Passwords are hashed with argon2id, which is a one-way operation: we cannot read yours, and neither can anyone who obtains the database.
- Everything you put on your website — services, prices, photographs, staff profiles, opening hours, blog posts. It is your content and it stays yours.
- Billing details — which plan you are on and when it renews. Card numbers go straight to Stripe and never reach our servers.
- What you connect — if you link Meevo, we read your services, staff, locations, clients and appointments into your account so your website can use them. We never write anything back to Meevo; no code path exists to do so.
- Enquiries from your website — the messages your visitors send you through your contact form, so you can read and answer them.
- A record of significant actions — who deleted what, and when. It exists so a question about a change has an answer.
What we collect from your visitors
Deliberately close to nothing. We count page views and button presses so you can see whether your website is working. There are no advertising cookies, no cross-site tracking, and no third-party trackers on your site unless you add them yourself under Website → Tracking.
We do not store full IP addresses. A visitor is counted using a hash that is rebuilt from scratch every day, so the same person cannot be followed from one day to the next, and no statistic can be traced back to an individual.
If you switch on live availability, a visitor asking about times sends that date to your booking software. That is the only thing on a published page that reaches a third party on a visitor’s action.
Who else sees any of it
We do not sell data, and we do not share it for anyone else’s marketing. The companies below see specific things because they do a specific job:
- Stripe — payments, when card payments are switched on. They see your billing details; we see whether you paid.
- Meevo — only if you connect it, and only to read. They are your existing provider and already hold this data.
- Google — for reCAPTCHA on public forms, when it is switched on, and for the AI writing assistant. Text you send to the assistant reaches Google; we do not send it anything you have not asked us to write about.
- Your own email provider — email campaigns leave through your mailbox, on your provider, under your address. Your campaign volume never touches ours.
We will disclose data if the law requires it. If that ever happens and we are permitted to tell you, we will.
Where it is kept, and for how long
- Anything you delete goes to your Trash and is recoverable for thirty days. After that a nightly job removes it for good and there is no copy.
- Deleting your salon does the same thing to the whole account: the website goes offline immediately, and after thirty days everything is destroyed.
- Visit statistics are aggregated over time. Because they were never tied to a person, what remains is a count.
- We keep the records tax and accounting law requires us to keep, for as long as it requires.
How it is protected
- Passwords are hashed with argon2id and are not recoverable.
- Stored secrets — your Meevo credentials, payment keys — are encrypted at rest with AES-256-GCM.
- Sessions are held on our servers rather than in a token you carry, so removing someone’s access ends it on their very next request rather than whenever a token happens to expire.
- Everything travels over HTTPS, including every salon subdomain.
No system is beyond reach, and we are not going to claim otherwise. If we ever discover a breach affecting your data, we will tell you what happened and what we are doing about it.
What you can ask for
A copy of what we hold, a correction, or deletion. Email support@glossfront.com from the address on your account and we will do it — there is no form and no charge. You can also delete your salon yourself from Trash inside your admin, which starts the thirty-day clock immediately.
Depending on where you live you may have further rights under the GDPR, the CCPA or the law where you are. We apply the same answer to everybody, so asking is enough.
Changes to this policy
If we change something that matters we will email account holders rather than quietly updating the date at the top. The date is there so you can tell.
Looking for the policy on a salon’s own website? That is a separate document on their own address, about their salon. This one covers only Gloss Front.
Getting in touch
Write to support@glossfront.com about anything on this page. A person reads it — there is no form and no ticket queue. Our registered office is Morris Plains, New Jersey, USA.
This is a draft, not legal advice. It describes accurately how Gloss Front works today, which is the half a lawyer cannot write for us. It has not been reviewed by one, and it should be before Gloss Front relies on it.
See also Privacy policy · Terms and conditions · Refund policy