Privacy Policy

Who we are

NailIQ™ is a salon booking and operations platform operated by 1500257 B.C. LTD. from Vancouver, British Columbia, Canada. This policy explains what personal information we collect, how we use it, and your rights under British Columbia's Personal Information Protection Act (PIPA) and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Our mailing address is 1500257 B.C. LTD., 13742 102 Ave, Surrey, BC V3T 1N8. You can reach us at hello@nailiq.ca or at nailiq.ca.

What we collect

• Salon owner: phone number, salon name, business address, and opening hours.
• Bookings: client first name, phone number, selected service, staff, and appointment time. A booking may also include an email address when one is provided.
• Account activity: sign-in events and basic usage logs needed for security and reliability.
• Optional analytics, after you choose Allow and only when analytics is configured: a page category and booking-flow milestones such as service selected, time selected, confirmation reached, completion, or abandonment.
• Business contacts for outreach: business name, public business email, business address, and public website or booking information. See "Business contacts for outreach" below.

Why we collect it

We use this information to provide the booking and walk-in queue service: showing your booking page to clients, confirming appointments, displaying the live receptionist dashboard, and enabling sign-in. If you separately opt in to analytics, we also use aggregate funnel milestones to identify confusing or broken steps and improve the service.

We use publicly available business contact information to send limited business-to-business emails to nail salon businesses about NailIQ. NailIQ does not use a salon's end-customer information for NailIQ's own marketing. A salon may message its own customers through NailIQ.

Business contacts for outreach

When we contact a nail salon business about NailIQ, we may hold the business name, a public business email, the business address, and public website or booking information.

We collect this information from publicly accessible business sources. Before relying on CASL implied consent, we assess whether the business email address was conspicuously published by the recipient or on their behalf, whether a no-solicitation statement was present, and whether our message is relevant to the recipient's business role. We keep a record of the source and date of collection and the basis for contact.

We use it to identify the business and to send the limited business emails described under "Commercial electronic messages (CASL)."

We keep this information only for as long as we need it for that purpose. If you ask us not to contact you, we delete the outreach record and keep a minimal do-not-contact record so we can honour that request. The application does not set a fixed number of days for that record.

This is personal information under British Columbia's Personal Information Protection Act (PIPA). PIPEDA also applies where federal law covers the activity. You can ask for access, correction, or deletion, or withdraw consent, by emailing hello@nailiq.ca.

Optional analytics and your choice

The Google Analytics script is not added unless you choose Allow and analytics is configured. NailIQ's own analytics events are limited to a page category and booking-flow milestones. The event parameters NailIQ sends do not include your name, phone number, email, booking notes, form contents, salon identifier, full page path, or query string. Page views sent by NailIQ use the site origin rather than the full address, and the configuration clears the referral address. NailIQ's analytics configuration turns off Google advertising signals and ad-personalization signals. NailIQ does not store the analytics browser identifier on booking, customer, salon, or account records. Google may still process browser, device, and network information as the analytics provider.

Choosing not to allow analytics does not turn off booking or the dashboard. You may change or withdraw your choice with the Privacy choices control shown on the site when analytics is configured. The application does not set a separate retention period for analytics data held by Google.

Service providers and where information is processed

NailIQ and its service providers may process or store personal information in Canada and the United States, and personnel or providers in other locations may have access where necessary to provide the service. Those locations may have different privacy laws. We use contractual and other safeguards appropriate to the information and disclose the providers and processing purposes in this policy. Use of NailIQ is not, by itself, a blanket consent to every transfer.

We will notify affected users and the relevant authorities of a privacy breach as required by law.

• Supabase stores salon, booking, account, and related database records, including authentication data, so NailIQ can run the service. The production database region documented for this project is the United States (us-east-1).
• Vercel hosts the website and server functions and processes the request data needed to serve pages. This may be processed in the United States.
• Twilio delivers SMS and phone-verification codes. It receives the phone number and the message content needed to send or check those messages. This may be processed in the United States.
• Resend sends email. It receives the recipient address and the message content. This may be processed in the United States.
• Stripe processes card payments, deposits, and subscriptions when a salon uses Stripe. Card details are collected by Stripe. This may be processed in the United States.
• Square processes card payments, deposits, and saved cards when a salon uses Square. Card details are collected by Square. This may be processed in the United States.
• Google receives the limited analytics events described above, and only after you choose Allow and analytics is configured. This may be processed in the United States.
• When an owner or staff member chooses Google sign-in, Google processes that sign-in. This is separate from optional analytics and does not depend on the analytics choice. This may be processed in the United States.
• OpenAI processes nail try-on photos and, when voice features are used, voice-session data, so those features can run. This may be processed in the United States.
• Anthropic processes booking-chat messages and the salon details needed to answer them, when that feature is enabled. When a salon uses the client summary, Anthropic can also receive that client's name, phone number, visit and spending history, no-show information, favorite service, and preferred contact channel. Reminder and first-visit drafts can include the client's name and appointment details such as the service, salon, and time. This may be processed in the United States.
• Fly.io hosts the voice bridge used for phone voice sessions. That service is configured in the United States (region sjc).
• When a salon has an enabled Wix connection, Wix can receive the appointment time, service, and the customer's name, phone number, and email address from that booking, so the appointment can be created on Wix. This may be processed in the United States.

Runtime errors are stored in NailIQ's own database. Before storage, the application redacts email addresses, phone numbers, and secret-like values it recognizes. That redaction does not guarantee every identifier is removed.

Payment information

When a salon collects a deposit or keeps a card on file for a no-show fee, Stripe or Square processes the card, depending on the salon's payment setup. NailIQ's booking records store the card brand, the last four digits, a provider card reference, and the consent record. They do not include a field for the full card number. You can ask to remove a saved card from the card link in a booking, where that link is available, or by contacting hello@nailiq.ca. The salon is the merchant for these charges.

California residents

If the CCPA/CPRA applies, you may exercise applicable rights to know, access, delete, correct, opt out of sale or sharing, and limit certain uses of sensitive personal information. Submit a request to hello@nailiq.ca; we will verify it as required by law.

We do not sell your data

NailIQ does not sell personal information. NailIQ does not use a salon's end-customer information for NailIQ's own marketing. Service providers listed above process information to provide the service, not as a sale by NailIQ.

Retention

Account and salon data is kept while the account is active and as needed to provide the service, resolve disputes, and meet legal duties. After an account deletion request, we aim to delete or de-identify active salon data within 30 days. Information in backups, security logs or records we must retain may remain for a limited period and will be protected from ordinary use until deleted or overwritten.

Booking records are kept for the salon's operations while the account is active, and longer when needed for disputes, no-show evidence, or a legal duty. The application does not set one expiry date for every booking.

An email verification code for a booking is accepted for 10 minutes after it is created. A phone verification session is accepted for 15 minutes after it is created. A link to verify a salon email address expires 24 hours after it is sent. The application enforces these expiry times. It does not delete those records on a fixed schedule after they expire.

SMS and email delivery records may include the destination, delivery status, and a short preview of the message (up to 120 characters for the preview NailIQ stores). The application does not set a deletion date for those records. They are deleted or anonymized when they are no longer needed for the salon's operations, disputes, security, or a legal duty.

The application does not set a retention period for analytics data held by Google.

Business contact information collected for outreach is kept only as long as we need it for that purpose. After you withdraw consent or ask us not to contact you, we keep a minimal do-not-contact record and delete the rest of that outreach information.

Your rights under PIPA and PIPEDA

You may request access to or correction of personal information we hold about you. You may also ask us to delete it or withdraw consent where applicable. Deletion is subject to legal, security, dispute-resolution and other permitted retention requirements; privacy laws do not provide an unconditional right to delete all information.

The Privacy Officer is a role responsible for NailIQ's privacy practices under British Columbia's PIPA and, where applicable, PIPEDA. Contact the Privacy Officer at hello@nailiq.ca or at the mailing address below. The Privacy Officer owns the 30-day account-deletion aim and the commitment to honour unsubscribe requests within 10 business days. You may also contact the Office of the Information and Privacy Commissioner for British Columbia to make a complaint.

SMS Privacy

When you opt in on a salon's booking page to receive SMS appointment confirmations and reminders, the phone number you provide is used for those appointment-related messages with that salon, and for the sign-in or booking checks that number is already used for. It is not limited to a single message type.

Twilio processes the phone number and message data to deliver and support SMS on the salon's behalf, subject to its service terms and privacy obligations. NailIQ does not authorize Twilio to use this information for its own marketing. NailIQ does not sell phone numbers, and NailIQ does not use these phone numbers for its own marketing. We do not do phone or SMS cold outreach.

Where a salon asks for text-message consent, that choice is shown separately from optional marketing consent. You may opt out by replying STOP to a message. Reply HELP for assistance. Message frequency varies, and message and data rates may apply.

Commercial electronic messages (CASL)

Canada's Anti-Spam Legislation (CASL) applies to commercial electronic messages. NailIQ (1500257 B.C. LTD.) sends two kinds of messages.

(a) Transactional and service messages to salons and their customers. These include booking confirmations and SMS reminders with links to reschedule or cancel. They relate to a booking or account the recipient already has.

(b) Limited business-to-business commercial electronic messages by email to nail salon businesses. We send these with express consent, or where CASL implied consent applies after the assessment described under "Business contacts for outreach." A published business email does not, by itself, create implied consent.

NailIQ's own commercial emails identify the sender as NailIQ (1500257 B.C. LTD.). They include our mailing address, 13742 102 Ave, Surrey, BC V3T 1N8, a way to reach us at hello@nailiq.ca or nailiq.ca, and an unsubscribe mechanism. We honour unsubscribe requests within 10 business days.

We do not do phone or SMS cold outreach. NailIQ does not use a salon's end-customer information for NailIQ's own marketing.

You can withdraw consent to these commercial emails at any time with the unsubscribe link, or by emailing hello@nailiq.ca.

Quebec residents

For Quebec-specific requests, contact hello@nailiq.ca.

Contact

Privacy questions, access or correction requests, deletion requests, and consent withdrawal: hello@nailiq.ca

Mailing address: 1500257 B.C. LTD., 13742 102 Ave, Surrey, BC V3T 1N8. Website: nailiq.ca.