1. Processing
LUO processes account, client, staff, service, appointment, schedule, message, inventory and related operational data to provide selected functions. Processing continues while the service is used and for a limited period afterwards for export, backup recovery and mandatory retention.
2. Salon instructions
Instructions include settings, permissions, confirmed actions and requests by authorised users. LUO will flag an instruction that evidently conflicts with applicable requirements and may suspend it pending clarification.
3. Salon obligations
The salon maintains a lawful basis, provides notices to clients and staff, keeps data accurate, grants minimum necessary access and ensures lawful messaging. Special-category data must not be uploaded unless a feature clearly supports it and safeguards have been separately agreed.
4. LUO safeguards
LUO uses access controls, encryption in transit, audit logs for critical actions, backups, request limits, secret management and incident response. See Security.
5. Confidentiality
Access is limited to personnel who need it for operation or support, subject to confidentiality and least-privilege requirements.
6. Subprocessors
LUO may use infrastructure, messaging and AI providers. The current list, purpose and location are published on the Subprocessors page. Material changes are posted before a new provider is engaged where practicable.
7. Requests and incidents
LUO assists with access, correction, restriction, export and deletion requests. Confirmed incidents affecting salon data are communicated without undue delay together with information then available to support the salon’s obligations.
8. Transfers and localisation
Database location and permitted transfers depend on selected infrastructure and market. Before international commercial launch, LUO documents storage countries, transfer mechanisms and any required localisation.
9. Return and deletion
After termination, a salon may request export for 30 days. Working data is then deleted or de-identified except where retention is legally required. Backups expire under the rotation schedule and are restored only for incident recovery.
10. Information rights
On reasonable request LUO provides information about safeguards and compliance, subject to other customers’ confidentiality and infrastructure security.