Privacy Policy

What you give us. Your name, business name, business type, email address, phone number, mailing or shipping address (for example, to send review cards), and billing details. At checkout, we also collect your answers to a few questions about your business. For plans, that is your website or main social link, your booking link, and anything we should know or avoid. For a website build, it is whether you own your domain, your current website or main social link, your booking link, and what the site must include or avoid. We also collect your onboarding form answers, what you share on strategy calls and onboarding calls, and the content you upload (footage, photos, brand assets, customer lists and other material).

When you contact us. The contact form on our website asks for your name, business name, email, phone, industry, website, social handle, the plan you are interested in, and a message.

About your customers. When we run your automations, we process your customers' and bookings' details, and the calls, texts, direct messages, website chats and emails handled by missed-call text-back, the AI receptionist, AI booking, review requests and follow-up. This includes their contact details, birthday and language, booking history, their consent to receive messages, intake forms, signed consent forms and waivers (which may include health information they give you), deposits and invoices paid through your own payment account, and leads from your Facebook and Instagram lead ads. We also process the reviews and social data returned by the platforms you connect.

About your team. See Section 1a.

Automatically. Your IP address, device type, browser, operating system, pages viewed, links clicked, time on page, the page that sent you to us, and similar usage data. We use cookies and similar tools to run the site, measure traffic and measure our ads, including the Meta Pixel (see Section 11).

From others. Details from the social and review accounts you connect (Instagram, Facebook, TikTok, YouTube, Google Business Profile and your own payment account), and public review pages you point us to; payment confirmations from Stripe; and the details you enter when you book a call through our booking page, which is provided by Google Calendar. If you fill in a form in one of our ads on Facebook or Instagram, Meta passes us the details you enter.

If you give us information about your team, such as names, phone numbers, email addresses, roles, the bookings each person handles, or photos and footage of them, we use it only to provide the Services to your business. For example, we use it to send a team member filming instructions if you ask us to. You confirm that you have told your team what you share with us and that you have their consent. A team member can reply STOP to any text from us, and can contact us to see, correct or delete their information. When you tell us someone has left your team, we stop contacting them.

We use personal information to: provide the Services (making your videos and branded posts, posting to the accounts you connect, and running your automations); set up and support your account; run the Dashboard, reports and exports; process payments, renewals and refunds; reply to enquiries and prepare for calls; record referrals and apply referral rewards; show work in our portfolio unless clients opt out (see Section 9 of our Terms); communicate about your account, billing, production and support; send marketing only with your consent (see Section 8); improve the Services and measure our advertising; prevent fraud and security incidents; and meet our legal obligations. We do not sell personal information, and we never share your customer lists with anyone for their own marketing.

You retain ownership of content you upload. By uploading content you grant SalonGrid Studio a limited, non-exclusive, royalty-free license to use it solely to produce, edit, brand, caption, store, and post the finished videos and branded posts you approve to the accounts you connect. This license ends when your subscription ends and we delete your content under Section 10. You warrant you have the right to use every face, voice, likeness, logo, song, and other element in your content, including model releases, and that it does not infringe any third party's rights. You are responsible for, and will indemnify us against, claims arising from content you uploaded.

AI video formats (AI Talking, AI Commercial, and UGC Product) and AI conversational features (booking and chat assistants, the AI receptionist, drafted review replies, writing suggestions, translation drafts, monthly recommendations and our in-Dashboard assistant) are powered by third-party generative AI services; your prompts, scripts, brand inputs, and, for the conversational features, message content may be sent to and processed by external AI providers under their own terms, which may retain prompts and outputs. Finished videos are yours to use for your own business marketing, as set out in Section 9 of our Terms. If you ask us to make an AI presenter from a real person, we process that person's photos and voice recordings with their signed consent, and stop using the presenter if they withdraw it. If you prefer your content not be processed by external AI providers, do not order those formats or enable those features.

We use trusted providers in these categories: cloud hosting, databases and storage for the Dashboard (in Canada); payments (Stripe); the messaging and CRM platform that runs your automations, phone number, calendars, customer messages and social posting; email delivery for Dashboard emails; AI services (video generation, writing and translation drafts, booking, receptionist and follow-up); email and text delivery; review and social platform connections; call booking and file storage (Google, for our booking page and for the Drive folder you connect); advertising measurement (Meta, through the Meta Pixel); fonts; and error monitoring. Each provider may use your information only to provide its service to us and must protect it. Stripe, Google and Meta also handle some information under their own privacy policies, as described in Sections 7, 10a and 11. We do not let providers market their own products to you.

We share personal information only: with the service providers in Section 5; with your consent; to comply with the law; to protect rights and safety and enforce our Terms; and in a business transaction, such as a merger or sale, where the new owner is bound by this policy or an equivalent one. We do not sell personal information. We do use the Meta Pixel to measure and show our own ads, as explained in Section 11.

Payments are processed by Stripe. You can pay by credit or debit card, Apple Pay, Google Pay or Link. When you pay, your card details go directly to Stripe (or through Apple or Google if you use their wallets), and we never see or store your full card number. Stripe shares with us what we need to run your account: your name, business name, email, phone, billing address, the card brand, its last four digits and expiry date, what you bought, and your answers to the checkout questions. Stripe calculates sales tax from your billing address. Stripe handles payment information under its own privacy policy. Plan, cancellation and refund terms are in our Terms of Service.

We follow Canada's Anti-Spam Legislation (CASL). We send commercial emails and texts only with your consent. That can be express consent, or implied consent where CASL allows it (for example, while you are a client, or for a limited time after you ask us about our services). On our contact form, you choose whether to get tips and offers by email by ticking a box, and the box is never ticked for you.

Every commercial message we send identifies SalonGrid Studio and includes our email address, support@salongridstudio.com, and a free way to unsubscribe: a link in emails, or reply STOP to texts. We act on an unsubscribe within 10 business days, and we keep records of consent. Messages about your account, billing, production and support are not marketing, and they continue while you are a client.

Strategy calls and onboarding calls may be recorded for training and quality. If a call is recorded, we tell you at the start and ask for your verbal consent. Recordings are stored securely, and you can ask us to delete any recording you appear in.

Website enquiries. Details you send through our contact form or when you book a strategy call, and the alert email with those details that goes to our team inbox, are kept for 24 months from the last time we were in contact with you and then deleted, unless you become a client. If you ticked the box to receive tips and offers, we keep your name and email for that purpose until you unsubscribe.

Clients. While your subscription is active, we keep your data while it is in use. When your plan ends, your account stays open in read-only mode for 90 days so you can view and export everything. After 90 days, we delete your account data, including customer contact data, Dashboard data, conversation logs and uploaded footage, from our active systems. We keep records of consent and account activity for 3 years, and billing records for seven years for tax purposes. Deleted data leaves our backups within 90 days. Aggregated information that cannot identify anyone may be kept indefinitely. Your Google Drive folder is yours, and we never delete anything from it.

Website-only clients. We keep your build details for as long as your site is live, unless you ask us to delete them. Deleting them never takes your site down.

We act on earlier deletion requests as far as the law allows.

During onboarding, you can connect your Google account so we can deliver files into a SalonGrid Studio folder in your own Google Drive. We ask Google for its most limited Drive permission. That means we can see only the folder we create for you and the files our app puts there or that you choose to share with it. We cannot see anything else in your Drive. We use this access only to copy each video and post you approve, and your monthly exports, into a folder in your Drive. The folder belongs to you, and it stays with you if you leave. You can remove our access at any time in your Google Account settings; after that, new files will be available in the Dashboard instead. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Our public website uses cookies and similar technologies for three things: making the site work (for example, security), measuring traffic, and measuring our advertising.

The Meta Pixel. Our website uses the Meta Pixel, a tool from Meta (the company behind Facebook and Instagram). When you visit, it sends Meta information such as the pages you view, when you view them, the page that sent you to us, your IP address, and details about your browser and device, along with cookie identifiers. If you are logged in to Facebook or Instagram, Meta may link this to your account. We use it to measure how our ads perform and to show our ads to people who have visited our site. Meta handles this information under its own privacy policy and may use it to improve its services.

Your choice. When you first visit our site, a card in the bottom corner of the page asks whether you accept the Meta Pixel, with Decline and Accept all side by side. The pixel does not load, and nothing is sent to Meta, unless you choose Accept. If you decline, the site works exactly the same. You can change your choice at any time from the Cookie settings link in the footer. You can also: block or delete cookies in your browser settings, or turn on your browser's tracking protection; manage the information Meta receives from websites in your Facebook or Instagram settings (Accounts Center, then Ad preferences); and opt out of interest-based ads from participating companies at youradchoices.ca.

The Services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18 through our website. If a client's content includes a person under 18 (for example, a young customer in a video), the client is responsible for getting consent from a parent or guardian before sending it to us. We will delete it on request.

You can ask us to see the personal information we hold about you, to correct it, or to delete it, and you can withdraw your consent to how we use it, subject to legal and contract limits. Contact us using Section 14. We will confirm your identity, answer within 30 days, and not charge you. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d'accès à l'information.

Depending on where you live, you may have more rights. In Quebec (Law 25), these include the right to be informed, to have your information moved to another organization (portability), and to know about, and challenge, decisions made only by automated means. In the EU or UK (GDPR), they include restriction, objection and portability. In California, they include the right to know and to opt out of sale or sharing.

For privacy questions, requests or complaints, contact our Privacy Officer, the owner of SalonGrid Studio: by email at support@salongridstudio.com; or through the contact form on our website.

We are based in Canada and our providers may process data in Canada, the US, the EU, the UK, and elsewhere. Where we transfer data out of your country we rely on recognized mechanisms, including Standard Contractual Clauses, and equivalent safeguards. Once your Dashboard is live, your Dashboard data, uploads and backups are stored in Canada. Some of our providers, including the platform that runs your automations, our payment processor, Google and our AI provider, process data on their own systems, mostly in the United States.

We use reasonable administrative, technical and physical safeguards, including encryption in transit and at rest, access controls, two-step verification for our team (and available for you), and limits on sign-in attempts. No system is perfectly secure.

If a breach involving your personal information creates a real risk of significant harm, we will notify you within 72 hours of confirming it. If we do not have all the facts by then, we will tell you what we know and follow up. We will also report the breach to the Office of the Privacy Commissioner of Canada and, where Quebec law applies, to the Commission d'accès à l'information, and we will keep a record of every breach for at least 24 months. If a breach affects information about your customers or team, we will tell you within the same 72 hours, so that you can meet your own obligations.

We process your data to perform our contract, with your consent (marketing and non-essential cookies, withdrawable anytime), for our legitimate interests (operating, securing, and improving the Services), and to comply with legal obligations.

For the public website and our own marketing, we decide how personal information is used (we are the controller). For content and data you load into the Dashboard, including your customers' and team's information, we generally act on your instructions (as a processor or service provider), and you are responsible for it, including getting the consents needed. Our sub-processors (the categories in Section 5) must use data only to provide their service, keep it confidential, and keep it secure. We do not keep, use, sell or disclose the data you load for any purpose other than providing the Services.

Features like AI booking bots and automated follow-up use automated processing to send messages and schedule actions; these do not produce legal or similarly significant effects without human involvement. You may request human review where applicable.

We may update this policy. When a change is material, we update the "Last updated" date and email active clients before it takes effect. Continued use after a change indicates acceptance.