Privacy policy

Stamly is owned and operated by Inovix AS, organisation number 938 650 330. Responsibility for your information is split in two:

• Stamly is responsible for your account: your name, email address, phone number, sign-in and your settings in the app.
• The salon is responsible for your customer relationship with it: the appointments, notes, points and offers. Stamly processes that information on the salon’s behalf.
• If you are a staff member, the salon is responsible for what relates to the work: rota, time off, clock-ins and hours. Stamly also processes that information on the salon’s behalf.

You can ask the salon directly about an appointment or a note at that salon. You can also always write to us at hjelp@stamly.net.

When you are a customer

When you are a staff member at a salon

• Name, email address, role and which locations you work at.
• What customers see: your name in the calendar, title, the text about you and your profile picture, if you have chosen to show it.
• Your contact number, if you or the salon adds it, and your choice of whether your colleagues should see it.
• Rota and time off. Only you and the owner or your manager can see why you are away. Do not write more about the reason than the salon needs to know, particularly about health.
• The clock-ins and the hours you log: when you started and finished, the breaks, your note, and who approved the hours.
• Changes to your hours: the owner or manager can correct and delete your entries in the portal, and the log keeps a record of what the entry was before, for as long as the hours are kept.
• If you are still clocked in at the time the salon has chosen (23:59 by default), Stamly clocks you out, marks the entry as clocked out automatically and lets you know.
• The distance to the salon when you clock in or out. The app reads your location once, at the moment you tap, and stores only how many metres you were from the salon, not where you were.
• An invitation, if a salon adds you with an email address you already use in Stamly. It is kept until you respond.
• The appointments you carry out, and the changes you make in the system.
• Your notification choices and the address notifications are sent to on your phone.

When you own or manage a salon

In addition to what applies to staff: the salon’s name, organisation number and contact details, and information about the subscription.

When you book an appointment on a salon page

If you book an appointment on a salon page at stamly.net, you are a customer in the same way as in the app, and we process the same information: the email address you sign in with (or your account with Apple, Google or Microsoft), the name you give, your mobile number if you add one, and the appointment you book. The salon sees that the appointment was booked on the website. If you later sign in to the app the same way, you will find your appointment and your points there.

When a salon registers interest on the website

If you fill in the “Register interest” form, we store what you write: your name, the salon’s name and city, the email address or phone number, the number of staff and the message. A copy is sent by email to our mailbox, hjelp@stamly.net, so we see it straight away. We use it only to contact you about Stamly.

Log of changes

Important events are logged with who did what and when, for example a cancellation or an adjustment of points. The log cannot be changed, and at the salon only the owner can read it.

Between salons: nothing

Each salon sees only its own. A salon cannot see visits, points, services or notes you have at other salons, and it cannot look you up until you are a customer there.

When a salon gets to see you

A salon sees you only once there is a customer relationship. It arises when

• you connect to the salon in the app,
• you book an appointment there,
• you approve a request the salon has sent you, or show your code at the salon,
• the salon registers your phone number or email address at the front desk, and you do not already have an account.

If you already have an account, the salon is not told your name from the number or the address. You then have to approve first.

What the salon sees about you

Name, email address and membership number, phone number, profile picture, date of birth and gender if you have provided them, your appointments at the salon, points and rewards, the number of visits and no-shows, and the salon’s own notes. Staff see appointments and points for the locations they themselves work at. The owner sees all locations.

What you see about the staff

The name in the calendar, the title, the text they have written about themselves and the profile picture, if the staff member has chosen to show it. You do not see phone numbers, email addresses, working hours or time off.

Between colleagues

Colleagues see who is at work. The contact number is seen only by the owner and those who work at the same location, and only when the staff member has chosen to share it. They do not see why a colleague is away. Your clock-ins and hours are seen only by you, the owner and the manager of your location. The owner and the manager can export the timesheet as a file for payroll, with names, dates, hours and notes. The salon is responsible for that file.

If a salon adds you with an email address you already use in Stamly, you receive an invitation. The salon does not see your profile, and you do not become a staff member there, until you have accepted it.

Stamly

A few people at Stamly have access to the information when it is needed for operations and customer support.

Pictures

Profile pictures, logos and salon photos are stored at an address that anyone with the link can open without signing in. Do not upload a picture you do not want others to be able to see.

When you are a customer, you get:

• confirmation that an appointment has been booked, and a reminder before the appointment,
• notice that the salon has moved or cancelled your appointment,
• “Thanks for your visit”, with the amount and the points you received,
• messages the salon writes to you, and requests to become a customer.

Notifications are kept in the inbox in the app, and appear as notifications on your phone when you have turned them on. If your phone does not receive notifications from the app, for example because you booked on a salon page, confirmations, reminders and notice of a moved or cancelled appointment come by email, and by SMS if we do not have an email address for you. The code you sign in with comes by email. The code that confirms your mobile number comes by SMS.

Offers and news

You get offers only from salons you have said yes to, and only as long as “Offers and news” is turned on under Profile → Notifications. Offers are not sent between 22:00 and 08:00. If your phone does not receive notifications from the app, offers may come by SMS, but only from salons you have said yes to, and only when the salon has bought SMS for that purpose. The salon can record that you say yes or no to offers when you tell them at the salon.

You can turn off the reminder before the appointment under Profile → Notifications. It will then come neither on your phone nor in the inbox. Confirmations of appointments you have booked yourself are sent regardless of what you have chosen.

When you are a staff member

You are notified when hours you have logged are approved or rejected, when the owner or manager has changed or deleted an entry, and when you have been clocked out automatically. The owner and the manager are notified when hours and time off are waiting for them, and when a staff member deletes their account.

We do not sell information about you, and the apps have no ad tracking and no analytics tools. The information is shared with the salons where you are a customer, as described above, and with the providers we use to run the service:

Some of the providers may process information outside the EEA, including the American companies Twilio, Cloudflare, Stripe, Vercel, Sentry, Expo, Google, Apple and Microsoft. When that happens, it is done under the EU’s standard contractual clauses for the transfer of personal data. Otherwise, we disclose information only when the law requires it.

If you are a staff member at a salon, you delete your account in Stamly Business: Profile → About the app → Delete my account. If you do not have the app, write to us from the email address you sign in with. Rota, time off, clock-ins and hours belong to the salon as employer and remain there for the period the salon has chosen. If you delete your account in the customer app while you are a staff member, the deletion waits until you are no longer a staff member anywhere. If you delete it in Stamly Business, it is deleted the following night, including the customer account, with no grace period. How to delete your account, also without the app: stamly.net/en/delete-account.

You can change your date of birth and gender yourself under Profile → Personal details. If you want something deleted before the time limits above, write to us, and we will look at what the law allows.

You have the right to

• know what information we hold about you, and get a copy,
• receive the information you have given us in a format another service can read,
• have anything incorrect corrected,
• have information deleted that we no longer have a reason to keep,
• ask us to restrict its use, and object to use based on legitimate interest,
• withdraw consent at any time.

You can do a lot yourself in the app:

• Profile → Personal details: correct your name, date of birth and gender, add, change or remove your mobile number, and change or remove your profile picture. If you want to change the email address you sign in with, write to us.
• Profile → Notifications: turn off reminders, notifications on your phone, and offers and news from all salons.
• Profile → My salons: choose which salons can send you offers and news, and leave a salon.
• Profile → Privacy and consent: see which salons have access, share a copy of your information (JSON, which another service can read), and delete your account.

For everything else, write to hjelp@stamly.net. We reply within 30 days. If it concerns information a salon holds about you, you can also ask the salon. If you believe that we process your information in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no.

• Each salon is kept separate in the database. The rules for who sees what are enforced there, not just in the apps.
• Staff see appointments and customers for the locations they themselves work at.
• Customers sign in with a one-time code by email, or with Apple, Google or Microsoft, and have no password. Staff sign in with email and a password of at least ten characters, and can lock the app with Face ID or fingerprint.
• In Stamly Business, the sign-in is kept in the phone’s secure storage, and it disappears if the app is deleted.
• Customers pay at the salon, and we process no card details about them. Salons pay the subscription by card through Stripe, and Stamly never sees the card number.

You must be at least 13 years old to have your own account. Younger children can of course have their hair cut, but then an adult holds the account and books the appointment.

We count visits to stamly.net with Vercel Web Analytics, which is part of the service the website is hosted on. It does not use cookies, and does not follow you from day to day or to other websites. It records which page was opened, where the visit came from, the country, and what kind of device and browser were used. We see totals, not individuals.

We advertise on Google, and would like to know whether the ads work. That is why the website asks, the first time you visit, whether you accept ad measurement. If you say yes, the website loads the Google Ads tag. It sets cookies from Google that remember that you came from one of our ads, and notifies Google when you send “Register interest” or tap App Store or Google Play. The cookies last for up to 90 days. We do not use the measurement to show you ads elsewhere. If you say no, nothing is loaded from Google and no cookie is set. Your answer is remembered in the browser, and you can change it at any time with “Change consent” at the bottom of the page. The salon pages do not ask and measure nothing.

If you book an appointment on a salon page, the browser remembers your sign-in in the tab you are using, so you do not have to enter the code again for each step. This is not a cookie: it is not sent to anyone other than Stamly, it lasts an hour at most, and it is gone when you close the tab or tap “Sign out”. If you sign in with Apple, Google or Microsoft, the tab also remembers a one-time key while you are with them, and deletes it when you come back.

The bot check from Cloudflare sets no cookies, either on the website or in the portal. What it receives is set out in the list of providers.

The portal for salons uses five cookies, and none of them are used for tracking:

The portal counts visits with Vercel Web Analytics in the same way as the website, without cookies. Whatever comes after the question mark in the address, such as what you have searched for, is not sent.

We update the policy when the service changes. The date at the top says when that last happened. If we change something that matters to you, we will let you know in the app before it applies.

Write to hjelp@stamly.net about anything to do with privacy. You will find practical help with the app under Help.

Inovix AS, org. no. 938 650 330, Karl Johans gate 25, 0159 Oslo