App Privacy Policy

1. What this policy covers

This policy explains how we handle personal information in the Affinage Pro mobile application and the associated prescriber web application (together, the “Platform”).

It is separate from, and additional to, the privacy policy for our online store at affinage.com.au. That policy covers shopping on our website. The Platform does more than a shop: salons record consultations about their own clients, including photographs. This policy covers that. Where the two conflict in relation to the Platform, this policy prevails.

The Platform is operated by International Hair Cosmetics Group Pty Limited (ABN 84 657 769 661), trading as Affinage Professional (“Affinage”, “we”, “us”, “our”). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

It should be read with our Terms and Conditions, which set out the salon’s obligations when entering client information.

2. Two kinds of people, two different roles

The Platform involves two groups, and our role differs for each.

Salon users — our customers

Salon owners and stylists who hold an account. We are the entity responsible for their personal information and deal with them directly.

Salon clients — the salon’s customers

Members of the public whose details a salon records. We hold this information on behalf of the salon. The salon decides what to record and is responsible for obtaining the client’s consent before entering anything, including express consent before taking or uploading a photograph. We do not use client information for our own marketing, and we do not sell it.

If you are a salon client and want your records changed or removed, ask your salon first — they control the record. You can also contact us at enquiries@affinage.com.au and we will help.

3. What we collect

From salon users

• Name and email address — to create the account and sign you in.
• Password, if you set one. Stored only as a one-way hash; we cannot read it.
• Salon details — salon name, business address, contact number and contact person.
• Your Shopify customer identifier and account email, if you sign in with Shopify, so we can recognise your salon on return visits.
• Your role and salon, which determine what you can see in the Platform.

About salon clients, entered by the salon

• Name, email address, phone number and the client’s preferred contact method.
• Business address details of the salon the record belongs to.
• Photographs — profile photographs and before/after hair photographs taken with the device camera or chosen from its photo library. These may show the client’s face.
• Consultation records — the services performed, colour and styling notes, and the date of the visit.
• Hair assessment answers — responses to questions about hair type, condition, scalp and haircare goals.
• Prescriptions — the recommended products and regime, the discount code issued, and whether it was sent.
• Purchase records — where a client buys using a prescription discount code, the order total and the resulting salon revenue share.
• Free-text notes a stylist chooses to add.

Collected automatically

• Search terms you type when looking for a client in the app, sent to our server to run the search.
• Standard server logs, including IP address and request details, kept for security and troubleshooting.

The app requests access to your camera and photo library only when you attach a photograph, and to Face ID only if you switch on the optional app lock. Face ID is handled entirely by your device; we never receive your biometric data.

What we do not collect

We do not collect location data, contacts, health records, browsing history outside the Platform, or advertising identifiers. The app contains no third-party advertising or analytics software. We do not track you across other apps or websites, and we do not sell personal information.

4. Why we use it

• To operate the Platform and sign you in.
• To let a salon keep a history of a client’s consultations so any stylist there can continue the work.
• To produce a haircare regime and email it to the client at the salon’s instruction.
• To issue and validate discount codes, and to calculate what a salon has earned.
• To show a salon its own activity totals in the dashboard.
• To keep the Platform secure, diagnose faults, and meet our legal obligations.

We do not use client photographs or consultation records for marketing, for training artificial intelligence models, or for any purpose other than delivering the service to the salon.

5. Who else handles it

We use a small number of service providers to run the Platform. They may process personal information only to provide their service to us.

• Vercel — application hosting, and storage of uploaded photographs. Photographs are stored in private storage and are served only to signed-in users of the salon that owns them.
• Neon — the database, hosted in Australia.
• Resend — sends prescription emails and sign-in links.
• Anthropic — generates draft regime text. We send only the hair assessment answers and our product catalogue. We do not send photographs, names, email addresses or phone numbers to the AI provider, and the content sent is not used to train their models.
• Shopify — verifies your salon account when you choose “Continue with Shopify”, and registers prescription discount codes against our store.

We may also disclose personal information where required by law, to protect our legal rights, or to a purchaser in connection with a sale of our business.

6. Where it is stored

The database is hosted in Australia. Some providers listed above may process or store data overseas, including in the United States. Where information is transferred outside Australia, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

7. Keeping it safe

• All traffic is encrypted in transit using HTTPS.
• Passwords are stored only as one-way hashes and are never readable by us.
• Sign-in credentials on your device are held in the iOS Keychain.
• Photographs are held in private storage and require a valid signed-in session to view.
• Records are scoped to a salon — one salon cannot see another salon’s clients.
• An optional Face ID lock can be switched on in the app’s settings.

No system is perfectly secure. If a data breach occurs that is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by law.

8. How long we keep it

Client records are kept for as long as the salon maintains its account, because they are the salon’s business records and a client’s colour history keeps its value over years. A salon may delete individual client records at any time.

When a salon user deletes their own account in the app, we close the account and erase that user’s name and email address so they can no longer be identified or sign in. Consultation and prescription records created for the salon’s clients are retained as the salon’s business records — they belong to the salon and to its clients, not to the individual stylist who typed them.

We retain records for longer only where law requires it, for example tax and financial records.

9. Your choices and rights

• Access and correction. You may ask for a copy of the personal information we hold about you, and ask us to correct it if it is wrong.
• Deleting your account. Salon users can delete their own account, either in the app or signed in on the web: Settings → Delete Account. Either way it is immediate, so there is no need to contact us. See Delete Your Account for what is erased, what the salon keeps, and what to do if you cannot sign in.
• Client records. If you are a salon client, ask your salon — they control the record. We will assist, and will act on the salon’s lawful instruction.
• Device permissions. Camera, photo library and Face ID access can be withdrawn at any time in the iOS Settings app.
• Complaints. Contact us at enquiries@affinage.com.au. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Children

The Platform is a professional tool and is not directed at children. Salon users must be adults. A salon must not record a minor’s details or photograph without the consent of a parent or guardian.

11. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. Where a change is significant, we will take reasonable steps to tell salon users.

12. Contact us

Privacy questions or requests: enquiries@affinage.com.au.

International Hair Cosmetics Group Pty Limited, trading as Affinage Professional, ABN 84 657 769 661, Australia.