Privacy Policy
Last updated: October 2026
1. Who We Are
Tracker Galore Ltd ("Tracker Galore", "we", "us") operates the Tracker Galore salon management platform. This policy explains what personal data we collect, why we collect it, and how we protect it. We are a data controller for account holders (salon owners and staff). For client data you store about your own customers, you are the data controller and we are your data processor.
2. Data We Collect About You
Account data: your name, email address, and (optionally) a Google account identifier when you sign up or sign in with Google. Salon data: your salon's name, plan, and billing information (processed by Stripe — we do not store card numbers). Usage data: log data, session information, and feature usage to help us improve the platform. This is not sold to third parties.
3. Data Your Salon Stores
Through Tracker Galore, you may store information about your clients — names, contact details, appointment history, and payment records. You are the controller of this data. You are responsible for having a lawful basis for processing client data and responding to client rights requests. We process this data solely on your instructions to provide the Service.
4. Instagram messages (Inbox)
If a salon connects its Instagram professional account through Facebook Login (our Meta app is named Salonello), we receive and store direct messages sent to and from that account. This includes message text, attachments (images, video, audio and files), story replies and mentions, the sender's Instagram-scoped ID, their username and profile name where Instagram provides them, and timestamps.
We use this data only so the salon's own staff can read and reply to messages in the inbox. We do not use it for advertising or profiling, and we do not sell it.
Only staff of the connected salon, and any branches that salon chooses to share its inbox with, can see these messages. The Instagram access token is stored encrypted.
Attachments are kept for up to 12 months. Messages are kept while the salon's account is active, then deleted as described in Data Retention. Disconnecting Instagram in Inbox setup removes the stored access token straight away.
The salon is the data controller for these messages and we process them on its behalf.
To have Instagram messages deleted, contact the salon you messaged (or, for salons, your administrator), who can ask us to delete them.
5. How We Use Your Data
Providing the Service: authenticating you, running the salon management features. Billing: managing your subscription via Stripe. Email communications: sending account-related emails (password resets, invitations, appointment confirmations) via Resend. Improving the product: understanding usage patterns to build better features. We do not sell your data. We do not use your data for advertising.
6. Data Sharing
We share data only with sub-processors bound by appropriate data protection agreements: Neon (database hosting), Stripe (payment processing), Resend (transactional email delivery), Twilio (SMS reminders, if enabled), Google (sign-in, if used), and Replit (application hosting). Meta (Instagram and Facebook): Instagram messaging, only if your salon connects Instagram.
7. Data Retention
We retain your account data for as long as your account is active. When you close your account, data is retained for 30 days before permanent deletion to allow you to export anything you need.
8. Your Rights
Under UK GDPR you have the right to: access the personal data we hold about you, have inaccurate data corrected, request erasure of your personal data, object to or restrict processing, and data portability — export your salon data via the Reports section at any time. To exercise any of these rights, contact your salon administrator.
9. Cookies
We use a single session cookie to keep you signed in. We do not use advertising or tracking cookies. No cookie consent banner is required as we only use strictly necessary cookies.
10. Security
We use industry-standard measures to protect your data: TLS encryption in transit, bcrypt password hashing, and access controls that limit who can see what.
11. Contact
For privacy questions, contact your salon administrator.