Privacy Policy

This Privacy Policy explains how Slash40 Salon (the “Service”) collects, uses, stores, and protects information when a customer messages a participating hair salon through Instagram, Facebook Messenger, or LINE. The Service is an AI-powered booking assistant that helps salons answer enquiries and manage appointments automatically.

1. Who we are

The Service is operated by HADA CORPORATION COMPANY LIMITED, a company registered in the Kingdom of Thailand (“we”, “us”, “our”). Slash40 Salon is the product name under which we provide the Service to participating hair salons.

For any privacy matter you may contact us at admin@hadacorporation.com.

2. The salon’s role and our role

Each participating salon decides why and how customer information is used in order to serve its own customers, and is therefore the data controller for that information. We provide the messaging and booking technology and process the information on the salon’s behalf and under its instructions, acting as a data processor.

Data belonging to one salon is stored and queried separately from that of any other salon. Salon staff can only access information relating to their own salon.

3. Information we collect

When a customer sends a message to a participating salon, we may process:

• Message content — the text a customer sends (for example, an enquiry about prices, or a request to book, change, or cancel an appointment).
• Platform-provided identifiers — the messaging platform’s user ID (for example, an Instagram-scoped ID or a LINE user ID) and public display name, used to route replies to the correct conversation.
• Booking details — information the customer provides to make an appointment, such as preferred date, time, service, and stylist.
• Operational records — technical logs of message handling (timestamps, processing status, error records) used to keep the Service working correctly.
• Usage records — counts and volumes that measure how much the Service is used, initially linked to the conversation so that faults can be traced, and later reduced to salon-level totals.

We do not collect passwords, payment card numbers, government identification numbers, precise location, or contacts. We do not access a customer’s follower list, media, or other profile data beyond what is described above.

4. Sensitive personal data

We do not ask for, and the Service is not designed to collect, sensitive personal data such as health information. A customer may nonetheless choose to mention such details in a message (for example, a scalp condition or an allergy relevant to a treatment). Where that happens, we process the message only to answer the customer’s request and to inform the salon, we do not use it for any other purpose, and it is removed together with the conversation log within the retention period set out in section 10. Customers are encouraged not to include health or other sensitive information in messages unless it is necessary for the appointment.

5. How we use information

• To read and understand a customer’s message and generate a helpful reply.
• To create, look up, change, or cancel appointments at the customer’s request.
• To recognise returning customers so that the salon can offer continuity of service.
• To send appointment reminders where the salon has enabled them.
• To notify salon staff when a customer needs human assistance.
• To answer frequently asked questions (location, hours, pricing, and similar).
• To monitor and troubleshoot the Service so that messages are not lost.

We do not use customer information for advertising, profiling, or automated decisions that produce legal or similarly significant effects.

6. Automated (AI) processing and disclosure

Replies are generated with the assistance of a third-party AI language model. The assistant is designed to always identify itself as an AI booking assistant rather than as a human. Message text is sent to the model provider solely to generate the reply; it is not used to train the provider’s models and is not shared for advertising purposes. Salon staff may take over any conversation at any time.

7. Legal basis and consent

We process a customer’s message because the customer has chosen to contact the salon and expects a response, and because processing is necessary to take steps at the customer’s request prior to and in performance of the requested booking. Processing is limited to what is necessary to answer the enquiry and manage that booking. Where the Personal Data Protection Act B.E. 2562 (2019) of Thailand applies, we rely on the contractual necessity and legitimate interest bases set out in that Act.

8. Data sharing and service providers

We do not sell personal information and we do not share it with data brokers. Information is shared only with:

• The salon the customer contacted, so that its staff can serve the customer.
• Service providers (sub-processors) that operate the infrastructure, strictly to deliver the Service:

• LINE Corporation — message delivery over the LINE Messaging API.
• Meta Platforms, Inc. — message delivery over the Instagram Messaging and Messenger Platform APIs.
• Supabase, Inc. — database and storage hosting.
• n8n GmbH — workflow automation hosting.
• OpenAI, L.L.C. — AI language model used to generate replies.
• Telegram FZ-LLC — internal operational alerts to our technical staff.

We may also disclose information where required by applicable law or valid legal process.

9. International data transfers

Our database is hosted in the Singapore region (Southeast Asia). Certain service providers listed above may process data in other countries, including the United States and the European Union. Where personal data is transferred outside Thailand, we require our service providers to apply appropriate safeguards and to process the data only on our documented instructions.

10. Data retention

We keep each category of information only for as long as it serves the purpose for which it was collected:

• Booking records (appointment date, service, stylist, customer name, contact details, attendance status, and the price charged) are retained for 60 months after the appointment. Because these records evidence a completed transaction, they fall within the retention period that the Accounting Act B.E. 2543 (2000) and the Revenue Code of Thailand require a business to observe for accounting records and supporting documents. At the end of that period the information that identifies the customer — name, contact details, and the messaging platform identifier — is permanently removed, leaving only an anonymised transaction record (date, service, stylist, and amount) that contains no personal data.
• Conversation content (the text of messages and the short-lived conversation state used to continue a chat) is retained for up to 12 months from the date of the message, so that a booking dispute can be resolved and the assistant can be corrected if it answers poorly. It is then deleted.
• Usage records are held in a form linked to a conversation for up to 12 months. After that the link to the individual is permanently removed, and only salon-level totals remain; those anonymised totals contain no personal data and may be kept indefinitely for capacity planning and billing.
• Operational and error logs are retained for up to 90 days.

A customer may request earlier deletion at any time (see the next section). Where a customer asks us to delete a booking record that we are still required to keep under the accounting and tax rules above, we restrict its use to that legal purpose only and delete it as soon as the requirement ends.

11. Data deletion & your rights

Customers may request access to, correction of, deletion of, or restriction of processing of their personal data, and may object to processing or withdraw consent. To request deletion, follow the instructions on our Data Deletion page, or contact us using the details below. We will remove the associated conversation and booking data upon a verified request, normally within 30 days.

12. Data security

Access tokens and personal data are stored in access-controlled systems protected by row-level access rules that separate each salon’s data. Access is limited to what is required to operate the Service. Communication with messaging platforms and with our database uses encrypted connections (TLS).

13. Children’s privacy

The Service is intended for salon customers and is not directed at children. We do not knowingly collect data from children. If we learn that we have collected data from a child without appropriate consent, we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent revision.

15. Contact

For any privacy question or data request, contact:
HADA CORPORATION COMPANY LIMITED
Email: admin@hadacorporation.com