Privacy & data

Privacy Policy

This policy explains how eHairPOS collects, uses, stores and protects data, and how you can exercise your own data rights. Please read it in full before using the service.

Last updated: 5 November 2026

01Scope

This policy applies to the eHairPOS website (www.ehairpos.com), the eHairPOS, eHairBOSS and eHairGO apps, and the related cloud salon-management services (together, “the Service”).

The Service is provided to businesses such as hair salons, barbershops, studios and salon chains. By using the Service you confirm that you have read and understood how we handle data.

02Who we are, and who controls the data

eHairPOS builds and operates the Service and is the data controller for website traffic data and platform operational data.

Customer records that a salon creates in the Service (name, contact details, hair history, wallet balance, visit history) are collected for purposes the salon itself decides, so the salon is the data controller towards its customers. We act as a processor handling that data on the salon's instructions and under this policy.

Customers with questions about their own data (for example a wallet balance, a visit record, or whether to stop notifications) should contact the salon first; we support the salon within the statutory time limits.

03Data we collect

We collect only what the features need, in four categories:

  • Website traffic data: device and browser type, operating system, referring URL, pages viewed and time on page, approximate region (we do not collect precise location).
  • Salon account data: shop name, owner or contact person, phone, email, store and branch information, staff accounts and permission settings.
  • Business data entered by the salon: customer name and phone, hair and note history, appointments, orders and payments, member wallet balance and top-ups, commission and performance data.
  • App and device data: device model, OS version, app version, crash and performance reports, push-notification tokens.

04How we use data

  • Delivering features: checkout, payments, online booking, members and wallet balances, commission splits, reports and notifications.
  • Account and security: verifying identity, blocking malicious logins and abuse, keeping the operation logs needed for investigation.
  • Support and auditing: handling issue reports, payment disputes and refund checks.
  • Improvement: understanding usage in de-identified or aggregate form to improve features and performance.

We never sell, rent or hand salon or customer data to third parties for advertising.

05Who we share data with

We disclose data only in the following cases:

  • Your staff: within the permissions the salon sets, staff see only the data their role needs.
  • Hosting and infrastructure providers: for compute, database, backup and storage, bound by contract to process data only on our instructions.
  • Platform and notification services: Apple App Store and Apple Push Notification service (APNs) for app distribution and delivery.
  • Payment providers: if a salon enables online payment or top-up, the transaction is handled by a third-party payment provider; we keep only the result and transaction reference, never full card numbers.
  • Legal requests: when a court or competent authority makes a lawful request, we cooperate as required by law and keep the necessary records.

06How long we keep data

  • Account and profile data: from sign-up until the salon ends the Service.
  • Orders, payments and wallet records: kept for at least 5 years to meet book-keeping and tax record rules.
  • Website traffic and system logs: up to 12 months, then deleted or de-identified.
  • After a salon ends the Service: a 30-day export window, after which data is deleted or de-identified under this policy, except records the law requires us to keep.

Backups are rotated on a fixed schedule, so deletion requests take full effect once the backup cycle completes.

07Your rights and how to exercise them

Using the contact channels at the end of this policy, you can ask us to:

  • confirm whether we hold your data and let you review it;
  • give you a copy of it;
  • complete or correct data that is inaccurate;
  • stop collecting, processing or using your data;
  • delete your data;
  • hand your data to you or a party you nominate in a readable format (portability).

Website and platform data: we act within 30 days of confirming your identity and explain any refusal.

Records a salon holds about you: ask that salon, which decides based on its own arrangement with you; we can help it retrieve or delete the matching records.

To protect other users, we may first ask you to prove your identity or your link to the data.

08How we protect data

  • Encrypted transport: the website and apps use HTTPS/TLS.
  • Access control: tiered staff permissions, logged sensitive actions, and least-privilege access for our own team.
  • Resilience: regular backups kept in separate locations so data can be restored.
  • Incident response: if a breach risk is found, we notify affected salons as soon as it is verified and follow applicable reporting rules.

09International transfers

The Service runs on cloud infrastructure, so data may be stored or processed in data centres chosen by our providers, including locations outside Taiwan.

Where Apple services are used (app distribution, push notifications), Apple processes that data under its own privacy policy.

For cross-border processing we require providers by contract to offer protection comparable to this policy.

10Cookies and browser storage

The website uses necessary cookies and browser local storage to keep forms secure, remember your language and store your consent choices; analytics and marketing items only run after you agree.

The full list, purposes and lifetimes are in the Cookie Policy & Usage Notice, and you can change your choices at any time from “Cookie settings” in the footer.

11Children

The Service is a business tool and we do not knowingly collect data from anyone under 16. If we learn such data was collected without a parent or guardian's consent, we delete it promptly.

12Changes to this policy

We may update this policy as features, laws or providers change; the new “Last updated” date appears on this page.

If a change affects the purposes of collection or your rights in a material way, we give advance notice in the app, by email or with a notice on the website.

Contact and complaints

Questions about this policy, how we handle data, or your rights? Reach us through any channel below; we reply within 30 days of confirming your identity.