Privacy Policy

Last updated: 9 October 2026

Who we are

Hathly ("we") is operated by Step Bros Ltd, a company registered in England and Wales (company no. 16231004, registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ). Hathly provides a booking diary for salons, barbers, beauty rooms, tattoo and piercing studios at hathly.com ("salons" below, whatever the trade). For the account details of the salons who sign up, we are the data controller. For the client records a salon keeps in its diary (their customers' names, phone numbers, appointment history and notes), the salon is the data controller and Hathly is a data processor acting on the salon's instructions.

What we collect

• Salon account data: business name, email address, a securely hashed password, and billing status.
• Diary data entered by the salon: client names, phone numbers, email addresses, appointment details, notes and colour formulas. Each salon's diary lives in its own isolated database, and personal fields are encrypted at field level (AES-256-GCM) before they are stored.
• Photographs: a salon can take or upload before-and-after photos of a client's work and save them against that client's visit. They are stored encrypted, served only to that salon's logged-in users, and are only ever shared outside the app if the salon chooses to and the client has agreed. Deleting a client deletes their photos.
• Booking-page data: if you book an appointment through a salon's public booking link, the name and contact details you enter go into that salon's diary only.
• Deposits and voucher payments: if a salon asks for a deposit, or you buy a gift voucher, your card details are entered on a page served by Stripe and go to Stripe and to that salon's own Stripe account. Hathly never receives or stores card numbers; it stores only a payment reference, the amount and whether it was paid, so the booking can show as paid.
• Technical data: standard server logs (IP address, request time) kept briefly for security and troubleshooting. We do not use advertising trackers or analytics cookies; the only cookie is the session cookie that keeps a salon signed in.

How we use it

To run the service a salon has asked for: showing their diary, sending appointment reminders and booking messages on their behalf, taking subscription payments, and responding to support requests. We do not sell or share personal data with anyone for marketing. Ever.

Who helps us run Hathly

We use a small number of processors to operate the service: Hetzner Online GmbH (server hosting, Germany/EU), Stripe (our subscription payments, and client deposits and gift vouchers paid into a salon's own connected Stripe account — card details go to Stripe and Hathly stores only a payment reference), Resend (delivery of reminders, booking confirmations and password resets by email, from EU servers), Twilio (text and WhatsApp messages, only where a salon has that switched on), and Apple (delivery of push notifications to the iOS app, described below). Each only receives what it needs to do its job.

The iPhone app and notifications

The Hathly app for iPhone is a window onto the same diary as the website; it collects nothing the website doesn't. If you turn notifications on, your phone gives us a device token — a long random identifier issued by Apple that lets us send a notification to that phone and nothing else. We store it against your salon, and when a client books online we send Apple a short message for that token, such as "Cut & blow dry — Thu 10 Oct at 10:30". The notification never carries a client's name. Signing out of the app removes the token; so does deleting the app, after Apple tells us it is no longer valid. We do not collect your location, contacts, or anything else from the device, and the app contains no advertising or analytics software.

Consent forms and health information

Tattoo studios, piercers and beauty salons can ask clients to complete a health questionnaire and sign a consent form before an appointment. Those answers, the wording agreed to, and the signature are stored encrypted in that business's own database, and the business is the data controller for them. Because a consent record is only useful if it can be relied on later, we also record the date and time it was signed, the IP address it was signed from and the browser used. Where a piercing client is under 18, the parent or guardian's name, relationship and signature, and the piercer's note that ID was seen, are recorded in the same way. Health information is special category data under UK GDPR and is never used for anything other than the appointment it was given for — it is not analysed, shared or used for marketing. Reference pictures a client sends before an appointment, and aftercare and follow-up messages sent afterwards, are handled the same way. To have any of it removed, contact the business directly.

Messages sent on a salon's behalf

Salons can send appointment reminders, aftercare check-ins, service follow-ups and occasional offers to their own clients. Those messages come from the salon, using contact details the client gave the salon — Hathly only carries them. Every promotional message contains a one-tap link that removes that person from the salon's future messages permanently; reminders about an appointment they have actually booked are not marketing and continue. A salon can also mark a client as "do not message" from inside the app.

How long we keep it

Salon and diary data are kept while the account is active. A salon owner can delete the account at any time from Settings → Delete account, inside the app or on the website; that permanently deletes the entire diary database — every client, booking, photo and form — and the login, and cancels any subscription at the same time. Encrypted backups are kept for 14 days and then removed. If you are a salon's client and want your details removed, contact the salon directly — it controls its own diary — and we will support any deletion it asks us to carry out.

Your rights

Under UK GDPR you can ask for access to, correction of, or deletion of your personal data, and you can complain to the ICO (ico.org.uk). Salons can export their client list from inside the app at any time and can delete their account — including every client record — from the app's settings.

Contact

Questions about privacy: email support@hathly.com.