Privacy Policy

Last Updated: September 20, 2026

SlonAxis (“SlonAxis,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose and safeguard information when you use our salon and beauty business management platform, website and services (collectively, the “Services”).

SlonAxis is operated as a sole proprietorship based in New Delhi, India. Our full contact details are in section 12.

This policy is designed to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) of India.

1. Our two roles

SlonAxis handles two different kinds of personal data, and our obligations differ for each.

Where we act as a processor, the salon is the Data Fiduciary. The salon decides what data to collect, what messages to send and when to delete. We act on the salon’s instructions and on the rights requests described in section 9.

2. Information we collect

2.1 Information salons provide to us

• Account information: your name, business name, email address, phone number and password.
• Business data: branches, services, pricing, staff details, shifts and inventory.
• Payment information: we use Zoho Payments as our payment processor. We store transaction records; full card numbers are handled by Zoho Payments and never reach our servers.

2.2 Information salons collect about their own customers

Salons record their customers’ names, phone numbers, appointment history, billing history and preferences. SlonAxis stores this on the salon’s behalf. You, the salon, are responsible for having a lawful basis and the necessary consent to collect this data and to message these customers — see section 4.

2.3 Information collected automatically

• Usage data: IP address, browser type, operating system, pages visited, and timestamps.
• Cookies: functional and analytical cookies used to keep you signed in and to understand how the Services are used. We do not use advertising cookies and we do not run third-party ad trackers on the SlonAxis application.

3. How we use information

• To provide, operate and maintain the Services.
• To send the transactional messages a salon has configured, to that salon’s own customers.
• To process transactions and manage subscriptions.
• To provide support and respond to enquiries.
• To detect, prevent and address fraud, abuse and technical faults.
• To send administrative notices, such as changes to these terms.

We do not use your data, or your customers’ data, to train advertising models, to build cross-business profiles, or for any purpose unrelated to running the Services.

4. WhatsApp data

This section describes exactly what SlonAxis does with data obtained through the WhatsApp Business Platform and Meta’s APIs. It is deliberately specific.

4.1 What we obtain from Meta

When a salon connects its own WhatsApp Business Account (WABA) to SlonAxis through Meta’s Embedded Signup, we receive and store:

• an access token for that salon’s WABA;
• the salon’s WABA identifier and phone number identifiers;
• the salon’s WhatsApp message templates and their approval status;
• the public profile (name and profile identifier) of the person who completed the connection, used only to confirm who authorised it.

4.2 What we obtain while messaging

• Customer phone numbers (WhatsApp IDs) of the people the salon messages.
• Message content — the template used and the values filled into it, such as the customer’s name, appointment time, service name and bill amount.
• Delivery status — sent, delivered, read, or failed, with the failure reason.
• Reachability and suppression signals — whether a number is not on WhatsApp, has blocked the salon, or has asked to stop receiving messages.

4.3 How that data is used — and the limits

• WhatsApp data is used only to send and track that salon’s own messages to that salon’s own customers, and to show the salon whether each message arrived.
• WhatsApp data is never sold, rented or licensed to anyone.
• WhatsApp data is never shared with, visible to, or pooled across other salons. Each salon’s data is isolated by tenant and access is enforced at the database layer. One salon cannot see another salon’s customers, messages or delivery results.
• WhatsApp data is not used for advertising, audience building, lookalike targeting or enrichment, and is not passed to any data broker.
• We do not send marketing or promotional WhatsApp messages. SlonAxis sends only the five transactional events listed below.

4.4 The only messages SlonAxis sends

SlonAxis sends a WhatsApp message only when one of these five business events occurs in the salon’s own account, and only if the salon has switched that message on:

1. a customer record is created (welcome);
2. an appointment is booked (confirmation, and an optional reminder before the appointment);
3. an appointment is rescheduled;
4. an appointment is cancelled;
5. a bill is paid (receipt).

There is no bulk send, no broadcast list and no promotional campaign feature.

4.5 Access token security

Salon access tokens are encrypted at rest using AES-256-GCM with a key held outside the database, in the messaging service’s secret store. Tokens are decrypted only in memory, only at the moment a message is sent or a status is read. Tokens are never logged, never returned by our API, and never shown in the SlonAxis app.

4.6 Customer opt-out

A customer can stop the messages at any time by replying STOP to the salon’s WhatsApp message or by blocking the number. We record that and stop sending to that number for that salon. See Data Deletion Instructions.

5. Sharing your information

We do not sell personal data. We share it only in these situations:

• Service providers who operate parts of the Services for us, under contract and only for that purpose:
  • Meta Platforms — the WhatsApp Business Platform, to deliver messages;
  • Zoho Payments — payment processing;
  • Supabase — application database and authentication, hosted in Mumbai, India;
  • Cloudflare — application hosting, edge delivery and object storage;
  • MSG91 — transactional email delivery.
• Legal compliance — where required by law, or in response to a valid request from a court or government authority.
• Business transfer — if SlonAxis is involved in a merger, acquisition or sale of assets, data may transfer, subject to this policy.

6. Where data is stored

Application data is stored in India (Supabase, Mumbai region). WhatsApp message delivery necessarily involves Meta’s infrastructure, which operates internationally. Cloudflare serves and caches our web assets from its global edge network.

7. Data security

• All traffic is served over TLS.
• WhatsApp access tokens are encrypted at rest with AES-256-GCM (section 4.5).
• Database access is restricted per tenant by row-level security, so one salon’s queries cannot reach another salon’s rows.
• Webhooks from Meta are verified before they are accepted.
• Administrative access is limited to personnel who need it.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify affected users and the Data Protection Board of India of a personal data breach as required by the DPDP Act.

8. Data retention

8.1 After you close your account

We delete your account data within 30 days of a verified deletion request or account closure. Copies may persist in encrypted backups for up to a further 90 days while those backups age out; they are not accessible to other users and are not used for any purpose.

9. Your rights

Under the DPDP Act, 2023, you have the right to:

• access a summary of the personal data we hold about you and how it is processed;
• correct data that is inaccurate, and complete or update data that is incomplete;
• erase your personal data where we no longer need it for the purpose it was collected;
• withdraw consent you previously gave, at any time;
• nominate another person to exercise these rights if you die or become incapacitated;
• complain to us, and thereafter to the Data Protection Board of India.

Salons can exercise most of these directly in the SlonAxis app. For anything else, or if you are a customer of a salon, see our Data Deletion Instructions or write to privacy@slonaxis.com. We respond within 30 days.

10. Children

The Services are not directed at children and we do not knowingly collect the personal data of a child under 18 without verifiable parental consent, as required by the DPDP Act. If you believe a child’s data has been provided to us, contact the Grievance Officer and we will delete it.

11. Changes to this Privacy Policy

We may update this policy. We will post the new version on this page and update the “Last Updated” date. Where a change materially affects how we handle your data, we will give notice in the SlonAxis app or by email before it takes effect.

12. Contact and Grievance Officer

SlonAxis Main Road, Badli Industrial Area Samaypur Badli, New Delhi, Delhi 110042 India

Privacy enquiries: privacy@slonaxis.com General support: support@slonaxis.com · +91 93103 58046

Grievance Officer

Appointed under the Information Technology Act, 2000 and the DPDP Act, 2023:

Name: Rahul Sharma Email: grievance@slonaxis.com Address: Main Road, Badli Industrial Area, Samaypur Badli, New Delhi, Delhi 110042, India

We acknowledge grievances within 3 working days and resolve them within 30 days. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.