How we handle your personal information
In one sentence: we collect what your booking needs, Square holds and confirms it, and one cookie protects the booking form.
Lash & Beauty Lounge ("we," "our," or "us") operates our websites lashandbeautylounge.ca and spaliciousfunbar.ca, both from the same beauty salon at 1451 Wheatcroft Drive, Oshawa, ON L1L 0W5, on one Square account and one customer directory. This policy explains what personal information we collect, why, who else it reaches, and what you can ask us to do about it, and it applies the same way whichever website you used. It describes our own practices. Every text message and email a client of either website receives comes from Lash & Beauty Lounge, whichever site was used to book.
Canadian privacy law requires an organization to name a person accountable for its handling of personal information (PIPEDA, Schedule 1, clause 4.1). Ours is:
Write or call about anything in this policy, including a request to see, correct or delete your information.
We follow the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how a private sector business in Ontario handles personal information, and Canada's Anti-Spam Legislation (CASL), which governs commercial electronic messages. The Office of the Privacy Commissioner of Canada publishes the ten principles PIPEDA is built on, and this policy follows them. We do not claim to follow the European GDPR, Quebec's Law 25, or California's privacy laws. They do not apply to this salon.
When you book or contact us, you give us your full name, email address and phone number. We pass these straight to Square, which creates or updates your Square customer record; we keep no separate copy of them ourselves.
If you book an at-home appointment, you also give us your street address and your postal code. We send the street address to Square, inside your booking's own free text, so the stylist knows where to go, and we do not store it ourselves. Only your postal code is sent to Google, to measure the driving distance from the salon (see section 8); the drive figure is kept indefinitely against the postal code, which is an area rather than a home, and the postal code itself is kept on your appointment record.
Any note you type when booking, which may mention an allergy or a condition if you choose to tell us, travels the same way, to Square, inside your booking's own free text. We do not store it ourselves.
If a service uses a consultation questionnaire, we read your answers once, at the moment you book, to decide whether the booking needs a consultation first. We never store your answers.
Your health history form is on paper at the salon, not on this website. You fill it out on your first visit, and again on a later visit if your health history has changed. It stays at the salon, in the salon's own records. It is never uploaded to this website, never sent to Square, and never leaves the salon. Section 12 says how long it is kept, and section 13 explains how to see or correct it.
What we keep on this website: your appointment date, time and services, what they cost, whether a payment succeeded, and the Square customer number that lets us find your Square record. We keep no other detail about you locally.
We also photograph work we perform on you, only with your permission. See section 9.
What our systems receive automatically: your IP address and browser information reach our website host as part of any normal request, and reach our bot protection provider when the bot check runs while you are booking. See section 7.
We use this information to:
Booking an appointment is how you consent to this. You can withdraw consent at any time by contacting us, subject to the records we must keep by law and to any appointment already under way. We do not sell, rent or trade your personal information, and we do not share it for anyone else's marketing.
We use six other organizations to run parts of the business. They act on our instructions, and we stay accountable for what happens to your information in their hands (PIPEDA, Schedule 1, clause 4.1.3).
That is the complete list of organizations this website reaches. We will also disclose personal information where the law requires it, such as a court order or a lawful demand from an authority.
Square, Cloudflare, Google and the artificial intelligence services we use process in the United States and potentially elsewhere. Cordia Bt., which builds and maintains this website, is in the European Union.
While your personal information is in another country, that country's courts and authorities may be able to access it, and no contract we sign can change that. We stay accountable to you for it throughout, and we require every provider to protect it comparably to the way we do. The Office of the Privacy Commissioner's guidelines on transborder data flows explain this in full.
We set no advertising, analytics or tracking cookies, and we build no profile of visitors. Every cookie this site sets, what it is for, and how long it lasts, is listed in our Cookie Policy.
To stop automated software from flooding our booking form and our at-home distance check, our booking page may run a Cloudflare Turnstile check. When it runs, your browser contacts Cloudflare directly, and Cloudflare receives whatever technical signal the check itself needs to tell a person from a program.
Cloudflare acts for us when it performs the check. It also uses what it collects there for its own purposes, acting for itself under its own Turnstile Privacy Policy, which we do not control. If you would rather the check did not run, contact us and we will book you by phone or email instead.
Selected services can come to you, and the travel surcharge depends on the driving distance. Your street address is sent to Square with your booking, inside the booking's own free text, so the stylist knows where to go -- it is never sent to Google and never stored by us. Only your postal code is sent to Google, to turn it into an approximate map point, and that point is then measured against the salon's own location to work out the driving distance. No name, email address, phone number or street address is sent with it. The drive figure is kept indefinitely against the postal code -- a postal code is an area, covering a whole side of a city block or more, not a home -- so we keep the figure the same way we would keep a fact about that area rather than about you. Your postal code is also kept on your own appointment record, for as long as that record is kept (section 12).
Google's handling of what it receives is governed by the Google Privacy Policy.
We photograph work we perform on you, only with your permission. Tell us at the time if you would rather not be photographed, and that is the end of it. A photograph stays in a private library only salon staff can reach until it is placed somewhere on the site, in the gallery, on a service, or in the page text. The moment it is placed that way it becomes visible to any visitor, and it stops being visible only if it is taken out of use again. We remove a camera's location data from a JPEG or PNG photograph before it is stored.
To write a description of a photograph or find near duplicates among our pictures, we may send the image to an artificial intelligence service outside Canada, which routes it to the provider of the model doing the work. A description is kept only once a staff member has looked at it and chosen to save it. Where a photograph shows you, sending it is a disclosure of your personal information. Tell us at any time if you would rather your photographs were not used this way, and we will remove them from the library.
Your appointment is created in Square, the booking and payment system this salon uses. Square sends you your confirmation, any change to your appointment, and any reminder, by text message and by email, using the phone number and email address you gave when booking. This website sends you no booking email of its own. Square's own privacy notice, linked in section 4, covers what Square sends and what it holds.
Separately from what Square sends, this website emails the salon about a consultation needed before a treatment, a refill that may be wrong, an at-home visit that needs re-ordering, a rebooking after a no-show, or a cancellation made in Square, so staff know to expect you and can act before or around your visit. Those emails are delivered by the company that hosts this website, named in section 4. If you email the salon directly, your message reaches the salon's mailbox and we keep it there.
Nothing is sent unless you ask for it. Canada's anti-spam law requires your consent before a commercial message is sent to you, and signing up is never a condition of booking, of a price, or of anything else.
The confirmation of your appointment, a change to it, and a reminder about it are part of the service you booked, and they are sent whether or not you have signed up for anything.
If you sign up, your email goes to Square, not to us. Our booking confirmation screen and the footer of every page on this site carry a plain link to Square's own hosted signup page. What you type there travels to Square directly, and we do not see it or automatically learn whether you signed up. Square holds your subscription and the record of your consent that actually governs it, and Square sends the messages. Every message Square sends carries a working unsubscribe link. You can also write to the Privacy Officer in section 1 and we will ask Square to take you off the list.
You may ask us at any time to see your information, correct anything that is wrong, or have it removed. Email the Privacy Officer named in section 1. We read your linked Square customer record and your appointment history, and log the request. We will respond within 30 days. Guidance on your right of access is published by the Office of the Privacy Commissioner.
What deletion does. We remove the link between your appointment history and your Square customer record: your Square customer number and your postal code (if you booked at home) are cleared from every appointment, payment and Square booking record on this site, and we ask Square to delete its own copy of your customer profile. There is no local copy of your name, email, phone or street address to remove, because we never kept one.
What deletion does not reach, stated plainly rather than promised away:
Ask us and we will remove any of the above by hand where we are able to. We are telling you the limits of the automatic process, not refusing your request.
Your paper health history form is part of what you can ask to see, correct or have removed. It is kept at the salon rather than on this website, so ask the salon directly and it will be found by hand.
Removal is not always permanent and is not always complete. Square keeps its own records on its own terms, described above, and Ontario law may require certain records to be kept for a minimum period even after your Square customer profile is removed.
Your name, email, phone and address are held by Square, under Square's own security. What this website holds, your appointments under a Square customer number, sits in our own database on our own hosting. The site is served over an encrypted connection. No system is perfectly secure, but we take reasonable steps to protect your information, and we will tell you if a breach creates a real risk of significant harm to you.
This website is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will remove it.
Contact the Privacy Officer in section 1 first, and we will investigate and reply. If you are still not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, which oversees PIPEDA.
We may amend this policy at any time. The version and effective date shown above tell you which one you are reading. That posted version is the one that applies to you, and every earlier version stays readable on our Document History page. Write to the Privacy Officer in section 1 and we will tell you what changed.