Privacy Policy

1. Introduction

This Privacy Policy describes how BookWithZara ("We," "Us," or "Our") collects, uses, discloses, retains, and protects personal information. It applies to salon owners who subscribe to Our service, to the customers who book appointments through salons using Our service, and to visitors of Our marketing website at bookwithzara.ca.

We are committed to protecting Your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, substantially similar provincial legislation.

2. Who We Are and How to Reach Us

BookWithZara is operated by Jawand Bajwa as sole proprietor, Winnipeg, Manitoba, Canada.

Our Privacy Officer is Jawand Bajwa. Contact for any privacy question, access request, correction request, or complaint:

Email: jawandbajwa10@gmail.com
Subject line: Privacy — [type of request]

We aim to respond within thirty (30) days.

3. Information We Collect

3.1 From Salon Owners (Our direct customers)

When You sign up for or use Our service, We collect:

• Identity + contact: full name, business name, email address, phone number, business address.
• Business details: salon type, services offered, prices, hours, stylist names and biographies, business logo and photos.
• Payment information: Interac e-Transfer sender email; once card payment is available via Stripe, We do not store card numbers — Stripe processes and stores payment data under their own privacy policy.
• Account credentials: a bcrypt-hashed PIN for each admin and stylist login. We never store PINs in plaintext.
• Session data: random session identifiers stored in a cookie, allowing You to stay logged in.
• Correspondence: emails, support tickets, and feedback You send Us.

3.2 From Customers of Salons Using Our Service

When an end-customer books an appointment through a salon's BookWithZara page, the salon collects (and We store on the salon's behalf):

• Full name, email address, phone number.
• Chosen service, stylist, and appointment time.
• Notes the customer chooses to add (e.g. "first-time visit," "allergy to X").
• Booking history (past appointments made through the same salon).

The salon owner is the primary controller of this information; We process it under their instructions to deliver the booking service, send confirmations and reminders, and support cancellation and rescheduling.

3.3 From Visitors of bookwithzara.ca

When You visit Our marketing website, Our server automatically records limited technical data in access logs: Your IP address, browser type and version, the pages You requested, referring URL, and timestamp. This data is used for security, debugging, and aggregate usage patterns. We do not currently run behavioural analytics (Google Analytics, Meta Pixel, or similar) on bookwithzara.ca.

4. How We Use Information

We use personal information for the following purposes:

• Provide, operate, and maintain the Service, including sending booking confirmations, reminders, cancellation notices, and receipts;
• Process payments and issue invoices;
• Authenticate salon owners and stylists;
• Respond to support requests;
• Send service updates and, with Your consent, occasional product news;
• Monitor and improve reliability and performance (via aggregated logs and error telemetry);
• Detect, prevent, and address fraud, abuse, and security incidents;
• Comply with legal obligations and enforce Our Terms of Service.

5. Legal Basis for Processing

Under PIPEDA We rely on:

• Consent — express, when You submit a form or subscribe; implied, when the collection is obvious in context (e.g. filling in Your name to book an appointment).
• Necessity for performance of a contract — processing information needed to deliver the Service You have subscribed to.
• Legitimate business interest — for security, fraud prevention, and infrastructure operation, where such interests are not outweighed by Your privacy rights.
• Legal obligation — where retention or disclosure is required by law.

6. Third-Party Service Providers and Data Location

We rely on the following third-party service providers to operate the Service. Where personal information is transferred outside Canada, We use contractual safeguards to maintain a comparable level of protection.

Provider	Purpose	Data location
Google Firebase / Firestore (Google LLC)	Primary database — salon data, bookings, customer records	Toronto, Canada (northamerica-northeast2)
Oracle Cloud Infrastructure (Oracle Corporation)	Application server hosting	Toronto, Canada
Resend (Resend, Inc.)	Sending booking confirmations, reminders, receipts	United States
Google Calendar API (Google LLC)	Optional per-salon booking sync (opt-in)	Global (Google infrastructure)
Sentry (Functional Software, Inc.)	Error monitoring and performance telemetry (no personal booking data sent — application errors only)	United States
Stripe (Stripe, Inc.)	Credit-card payment processing (rolling out; applies only when You elect card billing)	Canada / United States
Let's Encrypt (Internet Security Research Group)	SSL certificate issuance	Global

We do not sell personal information to third parties. We do not share personal information with advertisers.

7. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy:

• Active accounts: data is retained while Your subscription is active.
• Cancelled accounts: data is preserved for thirty (30) days to allow reactivation or export, then permanently deleted.
• Invoices and financial records: retained for six (6) years to comply with Canadian tax and accounting law.
• Customer of Your Salon booking history: retained by the salon as long as their subscription is active; deleted along with the salon at the end of the 30-day post-cancellation window.
• Security and audit logs: up to ninety (90) days.
• Email delivery logs (Resend): retained according to Resend's own retention policy (typically 30 days).
• Support correspondence: retained for two (2) years unless You request earlier deletion.

8. Cookies and Similar Technologies

Our service uses a small number of technical cookies necessary for the Service to function:

• Session cookies — a random session identifier that keeps You logged in. Expires when You log out or after a period of inactivity. Marked HttpOnly, Secure, and SameSite=Strict.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies on Our marketing website. If this ever changes, We will update this Policy and, where required, request Your consent.

9. Data Security

We implement technical and administrative safeguards to protect personal information, including:

• HTTPS/TLS 1.2+ encryption for all traffic to and from the Service;
• Bcrypt hashing (12 rounds) for all PINs — plaintext PINs are never stored;
• Firestore security rules that deny direct client access, with all reads and writes brokered through Our authenticated backend;
• Rate limiting on all sensitive endpoints (login, booking, admin actions);
• Content Security Policy headers to reduce cross-site scripting risk;
• Origin/Referer verification on all state-changing requests;
• Access to production systems restricted to Our owner over SSH with key-based authentication (no password login);
• Weekly encrypted Firestore backups.

No system is perfectly secure. If We become aware of a security incident that materially affects Your personal information, We will notify You and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA's breach-notification requirements.

10. Your Rights Under PIPEDA

You have the right to:

• Access the personal information We hold about You;
• Correct information that is inaccurate or incomplete;
• Withdraw consent to Our processing (which may end Our ability to provide the Service);
• Request deletion of Your data (subject to legal retention requirements above);
• Export Your data in a machine-readable format;
• File a complaint with Us or with the Office of the Privacy Commissioner of Canada.

To exercise any right, email jawandbajwa10@gmail.com with subject line "Privacy — [type of request]". We will respond within thirty (30) days.

Customers of a salon using Our service: for access, correction, or deletion of Your booking data, please contact the salon directly first — they control that data. If they cannot help within a reasonable time, contact Us and We will facilitate.

11. Children's Privacy

Our Service is not directed to children under the age of thirteen (13), and We do not knowingly collect personal information from children under 13. If You believe a child has provided Us personal information, contact Us and We will delete it.

12. International Users

The Service is provided from and directed primarily to Canada. If You access the Service from outside Canada, You do so on Your own initiative and are responsible for compliance with any local laws. Personal information will be processed and stored in Canada (with limited exceptions where third-party providers are located in the United States, as listed in Section 6). If You are a resident of the European Union or United Kingdom, please contact Us before subscribing to discuss GDPR / UK GDPR arrangements — We do not currently maintain an EU representative.

13. Automated Decision-Making

We do not use personal information for automated decision-making that produces legal or similarly significant effects on You. Booking availability is determined by the salon's configured hours, services, and stylist calendars — not by profiling.

14. Marketing Communications

Transactional emails (booking confirmations, reminders, receipts, invoices, and important service notices) are sent as part of the Service and are not opt-out. If We ever send product-news or marketing emails, You may opt out at any time using the unsubscribe link in every such email, in accordance with Canada's Anti-Spam Legislation (CASL).

15. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version at this URL with a new "Last updated" date. For material changes, We will notify You by email at least thirty (30) days before the change takes effect. Continued use of the Service after a change constitutes acceptance of the updated Policy.

16. Complaints

If You believe We have handled Your personal information in a way that violates PIPEDA or this Policy, please contact Us first — most concerns can be resolved directly. If You are not satisfied with Our response, You may contact:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: www.priv.gc.ca