Privacy Policy

For salon guests

If you are a guest of a salon that uses A-Hub, your records belong to that salon. The salon decides what it keeps and how it uses it; One 2 One Inc runs the software on the salon's behalf. Anything you want done with your record — see it, correct it, stop the messages, remove it — you ask the salon, and they can do it. This section describes what the software holds and what happens to it.

What the salon holds about you

• Your contact details. Name, phone number or numbers, and email address.
• Your birthday, where the salon has it — the day and the month are what the software uses. If your record came across from the salon's previous booking system, that older record can still contain the year.
• Your appointment and purchase history. Visits you booked, the services, who you saw, what you bought and what you paid.
• Forms you filled in at the salon — intake and consent paperwork, and your signature on it.
• The messages we sent you. The texts and emails themselves, whether they were delivered, and the record of what you agreed to receive and when.
• A card on file, if you saved one — but never the card number. Your card number is entered directly into the card processor and never reaches A-Hub. What is stored here is the card brand, the last four digits, and a token the processor gives us so the salon can charge the same card again with your agreement.
• Calls and messages with the salon.If you call and the salon's automated receptionist answers, the call may be recorded and the greeting tells you so before you speak. Texts and online chats with the salon are kept as a conversation.

How long it is kept

• Text and chat conversations: what was actually said is deleted after 30 days. The record that the conversation happened is removed after 13 months.
• Voicemail: the written-out text of a voicemail is cleared after 12 months by default — the salon can set a shorter or longer window. The record that you left a voicemail stays.
• Recorded calls: the salon chooses how long recordings are kept and switches automatic deletion on in its settings. The starting values are 30 days, or 365 days for a call the salon has flagged for review. Ask the salon what it has set.
• Your appointment and purchase history:kept as the salon's business records.
• If you tell us to stop: that record is kept indefinitely, on purpose — it is the only way to keep honoring it.

Texts and emails, and how to change them

There are two kinds. Appointment messages — confirmations, reminders, receipts, and the code that signs you in to book online — go to the number or address you gave the salon for your visit. Offers and news are separate and need you to sign up for them in writing first; giving the salon your number to book an appointment is not a sign-up for offers. The full description of both is on the SMS Consent & Opt-In page.

• Stop the texts: reply STOP to any text. It stops everything on that number.
• Choose instead of stopping: every email we send carries a Manage preferenceslink. It opens a page where you turn “visit reminders and receipts” and “offers and news” on or off separately, for text and for email. Texts do not carry that link — a text carries STOP instead.
• The unsubscribe link at the bottom of an email turns off offers and news. It leaves your appointment reminders and receipts alone; use the preferences page if you want those off too.
• Or just tell the salon. They can record it for you.

Seeing, correcting or removing your record

Ask the salon. There is no self-service page for this, and that is deliberate: the salon is the one who can confirm who you are. When a salon marks a guest as not to be contacted, A-Hub stops contacting that guest on every channel, permanently. Some records — what you bought and paid — the salon has to keep for tax and accounting.

Your information is not sold

Your details are never sold, rented or handed to anyone for advertising. The guest pages carry no advertising cookies and no marketing trackers.

Who else handles it

The companies listed under Service providers below handle guest information too: Supabase stores it, Vercel runs the software, Twilio delivers texts and carries phone calls, and Resend delivers email. Two more apply to guests specifically:

• The card processor (Kort, on the Tilled platform) takes and holds card details. A-Hub does not receive them.
• Anthropic— the salon's automated receptionist uses an Anthropic model to write its replies, so what you write in a chat or say on a recorded call may be sent to that service to produce an answer. Spoken words are turned into text by a speech-to-text service reached through Vercel.

Where your record came from

Salons that moved to A-Hub from an earlier booking system brought their guest records with them, so your details, your visit history and any contact preference you set there may have arrived that way rather than from something you did in A-Hub.

Information we collect

Your employer enters or generates the following data on your account:

• Profile. Your name, email, phone number, role (stylist, mentor, front desk, admin, apprentice), home location, hire date, and optional birthday.
• Time clock. Punches you make at the kiosk, including the timestamp, location, and a photo captured at the moment of the punch. Photos exist solely to verify identity at shared kiosks and are automatically deleted after 180 days.
• Performance data. Daily log entries you submit (services performed, retail sales, pre-bookings, add-ons), attendance records (time off requests, callouts, sick time), and apprentice-program progress where applicable.
• Communication logs. Email and SMS notifications A-Hub sends to you, along with delivery status and opt-out state.
• Notification preferences.Your selections from the Notifications section of your profile, indicating which categories of email and SMS you've enabled.

How we use it

Your data is used solely for internal operations of the business that employs you: payroll calculation, schedule management, performance review, attendance tracking, and operational notifications.

We never sell your information. We neveruse your phone number, email, or any other personal data for marketing — our own or anyone else's. We never share your data with third parties for advertising purposes.

Service providers

A-Hub uses the following service providers to deliver the application. Each handles your data on our behalf under their own privacy and security commitments:

• Supabase — database and authentication. Stores profile, time clock, and performance data. supabase.com/privacy
• Vercel — application hosting. vercel.com/legal/privacy-policy
• Resend — transactional email delivery. resend.com/legal/privacy-policy
• Twilio — SMS message delivery. twilio.com/en-us/legal/privacy

Data retention

• Active employee data: retained while you are employed and for the legal record-keeping period required by applicable employment and wage law after your employment ends.
• Time clock photos: automatically deleted after 180 days. Photos older than 180 days are purged daily by an automated process.
• Email and SMS message logs: retained for 12 months for delivery troubleshooting and carrier compliance, then deleted.
• Opt-out records: retained indefinitely. If you opt out of SMS or email, we keep a record so we honor it permanently unless you re-opt-in.

Your rights as an employee

• Inspect. You can see your own profile, time clock history, daily log entries, and attendance records on your A-Hub dashboards at any time.
• Correct.Submit corrections through your employer's admin — they can edit profile data and approve time-clock correction requests.
• Delete. Request deletion through your employer. Some data must be retained to satisfy employment and wage-law record-keeping requirements; we delete what we can.
• Manage notifications. Use the Notifications section of your profile to toggle email categories on or off. Reply STOP to any A-Hub SMS to opt out of SMS.

SMS notifications

• Program: A-Hub operational notifications.
• Description: SMS messages from A-Hub deliver time-clock alerts (missing punches, correction-request status), time-off and sick-request updates, and other employer-driven operational notifications related to your job.
• Consent: SMS is opt-in. Your number is in A-Hub because your employer added it, but no SMS is sent until you affirmatively enable SMS notifications in the Notifications section of your profile. Continued use of A-Hub does not by itself constitute SMS consent.
• Frequency: Variable. Messages are event-driven and typically arrive a few times per month per recipient. There is no recurring promotional schedule — we never send marketing or solicitation messages.
• Message and data rates may apply. Your wireless carrier may charge for incoming SMS depending on your plan. We do not charge for messages.
• HELP keyword: Reply HELPto any A-Hub SMS. You'll receive an auto-reply with a link to this policy and the support contact below.
• STOP keyword: Reply STOP to any A-Hub SMS at any time to opt out. Your opt-out is honored immediately and permanently across all A-Hub SMS — you will receive one final confirmation, then no further messages until you re-opt-in via your profile.
• Phone numbers are never sold or shared. We do not provide phone numbers to third parties for marketing under any circumstances.
• Support: support@a-hub.app
• Mailing address: One 2 One Inc · 330 SW Powerhouse Dr Ste 130 · Bend, OR 97702

Cookies and tracking

A-Hub uses session cookies to keep you signed in. We do not use advertising cookies, marketing pixels, or third-party analytics trackers.

Security

All data is encrypted in transit (TLS). Database access is row-level-security gated so employees can only read their own records and the records their role permits. Administrative actions are written to an audit log so changes to your data are traceable. PINs used at the time-clock kiosk are stored as one-way bcrypt hashes — never as plain text.

Biometric and image data

Time clock photos are stored to verify identity at shared kiosks and are deleted after 180 days. We do not run facial-recognition analysis on these photos, do not extract biometric identifiers, and do not share them with third parties. Several U.S. states (notably Illinois, Texas, and Washington) have biometric-information laws that may give residents additional rights regarding facial geometry or other biometric identifiers. A-Hub does not currently operate in states where these laws apply most strictly, but if you reside in or are employed in one of these states, contact your employer's admin to discuss your options.

Children's privacy

A-Hub accounts are for adults employed in licensed businesses. We do not knowingly create an A-Hub account for anyone under 18.

Salons do serve guests under 18, and a salon may hold a booking record for one. Those records are entered by the salon, not by the child, and a parent or guardian should book on a child's behalf. A-Hub does not knowingly collect information directly from a child, and the guest pages are not directed at children.

Changes to this policy

We may update this policy from time to time. The effective date at the top of the page reflects the most recent version. Material changes will be communicated via in-app announcements; continued use of A-Hub after the effective date constitutes acceptance.

Contact

Questions about this policy or your data: support@a-hub.app.

One 2 One Inc · 330 SW Powerhouse Dr Ste 130 · Bend, OR 97702.