Privacy Policy

Who we are

Salon Ads Studio builds and runs Google Ads for hair salons, barbershops and chair renters. This website is at salonadsstudio.com and the application lives at app.salonadsstudio.com.

Salon Ads Studio is operated by The SaaS Ads Studio Limited (Company No. 16972448), a private limited company registered in England and Wales. We are committed to protecting and respecting your privacy.

What this website collects

Very little. The free budget calculator runs entirely in your browser: nothing you type into it is sent to us, and reloading the page clears it.

The assessment on the homepage works out its figures in your browser too, and nothing you tap there is sent to us. If you then press "Start building my ads", we save your answers (the kind of business, your chairs, how your week usually goes, your typical booking and how many clients a chair sees), your salon's name and postcode, what the page showed you and your IP address, so that the application can greet you with your own numbers when you sign up.

Advertising cookies and your choice

With your permission, we use Google Ads measurement on this website and in the application to understand which of our ads lead to assessment clicks, signup visits, new accounts, successful listing updates, viewing a plan's price, starting checkout and a first payment. We send the event, its time and a random reference to avoid counting it twice. For a first payment, we also send the management fee before VAT, excluding your advertising budget. We do not send your assessment answers or Business Profile content for this measurement.

The Google Ads tag loads only after you accept advertising cookies. We do not use it to personalise advertising, and this setup does not add Google Analytics. Google may use its advertising cookies and identifiers to attribute these events to an ad. You can read how Google uses advertising information.

The cookie sas_ads_consent remembers your choice for 180 days across this website and app.salonadsstudio.com. If you accept, sas_ads_attribution keeps the Google click identifiers in your visit's web address for up to 90 days, so the application can retain attribution through sign-in and checkout. Google may also set cookies whose names start with _gcl_. A random reference in session storage, sas_ads_cta, helps avoid counting repeated button clicks during the same visit. It contains no contact details.

You can use the site and create an account if you decline. Choosing "No thanks" stops new browser advertising conversions and clears the advertising identifiers we keep in this browser. If you have used the application, a separate cookie, sas_ads_revoke, holds a random reference that can only withdraw advertising measurement for your account. We send it to our server to stop queued conversions too. If the connection fails, we retry when you next open or return to this site. You can change your choice here or through "Cookie preferences" in the footer. Information already sent to Google is not withdrawn by changing your browser choice. Essential sign-in and payment features continue to work.

Our hosting provider (AWS Amplify) keeps standard server logs for security and operations: your IP address, browser type and the pages requested, including the booking details Calendly adds to the address of our thank-you page. They are kept briefly and are not used to profile you.

The card in the corner

Some pages show a small card in the bottom corner from Max, our founder, offering a free call. There are two versions while we find out which one salon owners find more useful, and each browser is shown one of them at random.

So that it does not keep coming back, your browser keeps a note of which version it was shown and whether you closed it, clicked it or booked a call. The note sits in your browser's local storage under the name "sas-corner-card", with "sas-corner-card-session" for the current visit. While you are on the site it also holds which answers you have picked, but never your name, your salon's name or your email. It is not a cookie, and the note itself is never sent to us.

We count how often each version is shown, opened, clicked, closed and booked from. Each count carries only the version, what happened, the page and whether you were on a phone or a computer. No cookie, ID or IP address is kept with it.

If you answer the questions, we keep your answers, your first name, your salon's name and your email, so that Max can read them before your call and reply to you. They reach us by email and in our team's Slack, and we keep them for 12 months, or less if you ask us to delete them. To stop the form being abused, we also keep a scrambled version of your IP address for two days.

Calls are booked through Calendly, which collects your name, your email, your salon's name and the time you pick, under Calendly's privacy policy. Afterwards it sends you back to our thank-you page with your booking details in the web address. That page shows you the time, sends us only Calendly's booking reference so that we can count the booking, and clears the rest from the address bar.

The salon directory

Salons can be listed free in our salon directory. We ask first. A salon that hasn't paid is listed only once it switches its listing on in the application. A salon whose ads are running with us is listed unless it switches the listing off, because its page is public already. The listing shows your salon's name, what kind of business it is, its address and postcode, its phone number (unless you have switched calls off on your page), your booking, website and Instagram links, your services and the opening hours you typed in. Your free listing can also show the photos, prices, introduction and team details you add. Once your ads are running with us and your advertising page is live, your listing links to that page and is marked Featured.

These are the details you gave us or confirmed in the application, some of them first read from your Google listing when you set up. The directory never shows your Google rating or reviews, your email address or anything about your budget. To put your salon in the right region and city, we look up your postcode with postcodes.io, a free service built on Office for National Statistics data. Only the postcode is sent.

You can manage or hide your listing at any time from "Your listing" in the application. Changes normally appear within an hour. The application shows when publication is pending and when the public listing is live, and we email you when your first listing is ready. If you cancel and never switched your listing on yourself, it comes off. Its web address stays reserved for you, so switching it back on brings back the same address. Deleting your account removes your listing.

What the application collects (when you sign up)

When you create an account at app.salonadsstudio.com and connect your Google account, we request access to:

• Your email address and basic profile information (for signing you in)
• Your Google Business Profile, so we can read your listing and put right the few things on it that we are able to fix for you

We do not ask for access to any Google Ads account of yours. Your ads run in a Google Ads account that we open and manage for you, under our own Google Ads manager account, and we pay Google for it out of the ad budget you pay us. If you leave the listing permission off, the rest still works: we show you what is wrong with your listing instead of fixing it.

How we handle Google user data

Salon Ads Studio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms:

• What we access, for your listing. The Business Profile scope (https://www.googleapis.com/auth/business.manage). We read your listing: its name, address, phone number, categories, opening hours, website or booking link, services and description, and whether Google has verified it. We change only what you tick on your listing card, after showing you exactly what we would put there: your website button, your phone number, your description, your services list, your opening hours, your bank holiday hours, and whether your listing says you are open. We can also add photos you pick from your page, with the caption you gave each one; taking them off again removes only those. We never change your name, your address or your categories, and we never delete a photo of yours or a review. After every change we email you exactly what we sent to Google.
• How we use it. Only to provide features you can see in the application: fixing your listing, and using its name, services, opening hours, phone number and booking link to write your ads and your landing page, so that they say what your listing says. If you are listed in our salon directory, described above, your salon's name, address and phone number appear there too. You choose whether you are listed, in the application, at any time. Once your ads are running we look at your listing again each month, and if your phone number, website button or description has come off, we put it back and email you. We never put back something you changed yourself, and you can tell us to stop for any of them. When your description is missing or short, Claude (Anthropic's AI) writes versions for you to choose from, using only what you have told us about your salon, never the words already on your listing. Nothing else.
• How we store it. In our database with Supabase. Your Google access and refresh tokens are encrypted at rest and are never sent to your browser. Cached performance data is short-lived and refreshed from Google. For your listing we also keep a copy of each field we change, exactly as it was before we touched it, so that any change we make can be put back. Google lets us keep that copy for 30 days, so we delete it after 29. For each photo we add, we keep which of your photos it was and Google's name for it, so that we can take it off again.
• How we share it. We never sell, rent or trade it. It goes only to the processors listed under "Service providers" below, and only ever to deliver a feature in the application.
• We never use it to advertise to you. Your listing data exists to look after your listing and to write your ads. It is never used to target advertising at you, or to build an advertising or marketing profile of you.
• We do not use it to train AI models. We send account data to Anthropic's Claude API so it can analyse performance and recommend optimisations. Anthropic does not use data submitted through their API to train their models.
• Human access is limited. Someone at Salon Ads Studio sees your Google data only when you ask us for help and we need it to answer, when your plan includes human review of your account, when we are investigating a security or abuse problem, or when the law requires it.

Revoking access

You can disconnect your Google account at any time from the application or from your Google account's security settings. When you disconnect, we no longer have any access to your Business Profile, and the corrections we made to your listing stay on it. Your ads carry on in the account we manage for you until you cancel, because they never used your Google permission.

Your clients' information

Two features involve information about the people who book with you, rather than about you. In both, your clients' details are yours, and we handle them only to run the feature.

• Enquiries from your page. When someone fills in the callback form on your landing page, we store the name, phone number and message they typed, email them straight to you, and show them in your dashboard, so that you can ring them back. We never contact them ourselves.
• Booking counting (optional, and off unless you set it up). If you choose to send your booking system's notification emails to the private address we give you, we read each email once and keep only the non-personal facts: that a booking happened, the treatment, the time and the price. Your clients' names and contact details are never stored in our database. The emails themselves are received by our email provider, Resend, which keeps email for 30 days and then deletes it.

We never sell or share your clients' details, and we never use them to advertise to anyone. Reading a booking email involves sending its text to Anthropic's Claude API to pick out those facts. Anthropic does not use data submitted through their API to train their models.

Confirming your business with Google

Google checks who is behind every advert, and pauses ads it cannot match to a real business. Because your ads run in an account we manage for you, we complete that check for you, as your agency. Once you have paid, the application asks you one question to make that possible:

• If your business is a limited company, you pick it from the public register at Companies House. We keep its name, company number, registered office address and date of incorporation, as the register shows them, and give Google those details and the certificate of incorporation that Companies House publishes.
• If you trade as yourself, you take a photo of your driving licence or passport. Before it leaves your phone, the photo is resized and the location details a camera attaches are removed. It goes into private storage that only our server can read: not even your own account can open it again. The person on our team who submits it to Google is the only one who looks at it, and every time they do is recorded. We use it for nothing else, and we delete it as soon as Google accepts it, or 30 days after you send it, whichever comes first.

Google then shows your business's verified name and location to people who see your ads, under "About this advertiser" and in its Ads Transparency Center. What Google does with what it receives is covered by Google's privacy policy.

Payment information

Subscriptions are processed by Stripe. We never see or store your card details; we store only a customer ID and subscription ID to manage your subscription status. See Stripe's privacy policy for how they handle payment data.

Service providers

Your data is shared only with the providers needed to run the service, each contractually bound to protect it:

• Amazon Web Services: hosting for this website
• Supabase: the application's database, sign-in and server functions. Your account details, campaign settings and cached Google Ads figures are stored here, and so are this website's saved assessments, and the corner card's counts and answers
• Calendly: booking calls with Max
• Anthropic: the Claude AI models that analyse your account and draft the optimisations we recommend
• Stripe: payment processing
• Resend: service and product email: your monthly report, your enquiry alerts, and the account emails. If you switch on booking counting, your booking system's notification emails are received here too. It also brings us the corner card's answers
• Sentry: error monitoring, so we can find and fix faults in the application
• Companies House: the public register we search when you tell us which limited company is yours
• Google: the Google Ads API, where we send your ads, your keywords, your area and your page's address to run them in the account we manage for you; Google's check of who is behind your ads, described above; the Business Profile API you explicitly connect; the Places API, which finds your listing when you set up in the application; and Google Ads measurement of our own advertising, when you accept advertising cookies
• Slack and IPWhois: an internal alert when someone signs up, including approximate location worked out from IP address, and an alert with the corner card's answers when someone sends them

We may also disclose data when required by law or to protect our legal rights.

Data retention

Application account data is retained while your account is active and for 3 months after cancellation (so you can reactivate), after which it may be permanently deleted. You can request earlier deletion at any time.

Enquiries from your landing page follow the same rule, so you keep a record of who asked you to call for as long as you have an account. Booking counts are kept as figures only, with nothing in them that identifies a client.

A photo of your ID, if you send one for Google's check, is deleted as soon as Google accepts it, and never kept more than 30 days.

Answers sent through the card in the corner are deleted after 12 months, and the scrambled IP address kept with them after two days.

Your rights

Under UK GDPR you have the right to access, correct, export, restrict, or delete the personal data we hold about you, and to object to its processing. To exercise any of these rights, email hello@salonadsstudio.com. You also have the right to complain to the Information Commissioner's Office (ICO).

Changes to this policy

When we make changes, we update the "Last updated" date at the top of this page. Material changes to how the application handles your data will be notified by email.

Contact

Questions about this policy or your data: hello@salonadsstudio.com

Company: The SaaS Ads Studio Limited (Company No. 16972448), registered in England and Wales, trading as Salon Ads Studio.