Privacy policy
This policy explains how ZalonFlow handles personal data: on this website, for the salons that use ZalonFlow, and for the people who book with those salons. We keep it short and only collect what we need.
1. Who we are
ZalonFlow is a service of NFlow Solutions, a sole proprietorship (eenmanszaak) registered with the Netherlands Chamber of Commerce (KVK) under number 73838306, VAT number NL002463537B15, Gretha Hofstralaan 64, 3136 LS Vlaardingen, the Netherlands. In this policy “we” and “us” mean NFlow Solutions.
Questions about privacy: info@zalonflow.nl.
2. Two roles: controller and processor
- We are the controller for visitors of zalonflow.nl, for people who contact us, and for the accounts and billing of the salons that use ZalonFlow.
- We are a processor for the data of a salon's customers and staff. Each salon decides what it does with that data and is the controller. We only process it on the salon's instructions, under a data processing agreement. If you booked with a salon, please read that salon's privacy notice and contact the salon first; we help the salon answer your request.
3. What we collect and why
| Who | Data | Purpose | Legal basis | How long |
|---|---|---|---|---|
| Visitors of zalonflow.nl | IP address and technical data in the hosting provider's logs | Delivering and protecting the website | Legitimate interest | Only in the hosting provider's own short-term security logs; we do not store or analyse them |
| People who contact us | Name, email or chat details, salon name, your message | Answering you, a demo or a trial | Legitimate interest, or steps before a contract | Up to 2 years after the last contact |
| Salon owners, admins and staff with a sign-in | Name, email address, language, sign-in records, actions in the admin (audit log) | Providing the service, security, support | Contract (salon owner); for staff logins we act for the salon under the data processing agreement; security: legitimate interest | While the salon uses ZalonFlow; audit log 2 years |
| Salons (billing) | Company name and details, contact person, invoices, payment status, Stripe customer reference | Invoicing the subscription | Contract, legal obligation | 7 years (Dutch tax law) |
| Anyone using a form in ZalonFlow | A one-way hash of an IP address, email or link, and a count | Protection against abuse | Legitimate interest | 1 day |
We do not sell personal data, we do not use it for advertising, and we do not make automated decisions about people. For a salon's customers and staff we act as processor; we act as controller only for our own billing, security logs and short-lived abuse protection listed above.
4. Cookies
This website (zalonflow.nl) sets no cookies and uses no analytics or tracking. Fonts are served from our own website.
The ZalonFlow app uses only cookies that are needed for it to work, so no consent banner is shown:
zf_adminandzf_platform: keep a salon admin or our own team signed in (httpOnly).zf_platform_enrol: a few minutes, while our team sets up two-step sign-in.zf_admin_lang,zf_platform_langandzf_lang: remember the chosen language.
On a salon's booking page, “Remember my details” stores your details in your own browser only if you tick the box. The booking pages use Cloudflare Turnstile to block bots. It sets no ZalonFlow cookie; Turnstile may keep a small technical value in your browser only to tell people from bots, and it is not used for tracking.
5. Who receives data
We use these service providers. Each has an agreement with us and only receives what it needs.
| Provider | What for |
|---|---|
| Cloudflare | Hosting of the website and the app, bot protection (Turnstile) |
| Supabase | Database and file storage, stored in the European Union (Frankfurt); support access from outside the EU only under the standard contractual clauses |
| Stripe | Our subscription billing. Online payments from a salon's customers go to the salon's own Stripe account, under the salon's own agreement with Stripe |
| Resend | Sending emails |
| Meta (WhatsApp Business) | WhatsApp messages, only for salons that switch on the WhatsApp add-on and only to people who agreed |
| Google Fonts | Font files in the salon admin (your browser requests them from Google) |
| DeepL | Only if switched on: translating a salon's own texts, such as treatment descriptions (no customer data) |
Some of these companies are based outside the European Economic Area or have support staff there. Where data leaves the EEA, it is protected by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
We may also share data when the law requires it, for example with the tax authorities.
6. Security
Data is stored in the EU and sent over encrypted connections. Each salon's data is kept separate and checked by automated tests. Sign-in uses one-time links, our own team uses two-step sign-in, and important actions are logged. We do not store card numbers: Stripe handles card data.
7. Your rights
You can ask us to see, correct or delete your data, to limit its use, to receive it in a common format, or object to its use. Email info@zalonflow.nl; we answer within one month. If your data is held for a salon, we pass your request to that salon and help it answer.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
8. Changes
We update this policy when the service changes. The date at the top shows the latest version. Salons are told about important changes by email.