Privacy Policy

RoseBook is operated by codeclutch (“we”, “us”, “our”). Our legal name for this product is RoseBook by codeclutch. We provide online salon booking, appointment scheduling, client records, staff rosters, inventory and LKR billing for salons, spas, nail studios, barbershops and similar businesses in Sri Lanka.

For questions about this policy or your personal data, email [email protected]. We are based in Sri Lanka and this policy is written to be read with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (the “PDPA”).

This policy applies to personal data processed when you:

• Visit the RoseBook website, including pages such as this Privacy Policy.
• Create or use a RoseBook salon account at https://cloud.rosebook.app (owners, managers, stylists and other staff).
• Book or request an appointment through a salon’s public booking page, digital price chart, or a pre-filled WhatsApp booking message generated by RoseBook.
• Contact us by email or otherwise for support, sales or onboarding.

It does not apply to websites, apps, payment apps or messaging services that we do not control — for example WhatsApp, SMS carrier networks, or a salon’s own Instagram page — except to the extent we send data to them at your request or on a salon’s instructions, as described below.

RoseBook plays two different roles under data protection law. Understanding which one applies to your data is important for knowing who to contact.

When we are the controller

We decide how and why data is processed, and we are the controller, when it is about:

• Your RoseBook user account (name, email, login, role, support history).
• The salon business profile you give us to run the product (salon name, branding, opening hours, billing contact).
• Website and product usage needed to operate, secure and improve RoseBook.
• Invoices and subscription records for the software itself, if you pay us for a plan.

When we are the processor

When a salon stores its own customers’ details in RoseBook — names, phone numbers, WhatsApp numbers, visit notes, photos, loyalty points, bookings, invoices sent to those customers, and similar records — the salon is the controller of that data. We process it only to provide the software the salon has asked us to run.

If you are a salon client and want to access, correct or delete your appointment or profile data, start with the salon you booked with. They control that record. We will help the salon respond where the law or our contract with them requires it.

We only collect what we need to run the product, support you, and meet legal duties. The categories below depend on how you use RoseBook.

Website visitors

When you browse the marketing site we may automatically receive technical data such as IP address, browser type, device type, referring page, and timestamps. This site does not currently run third-party advertising or analytics pixels. If we add analytics later, we will update this policy and, where required, ask for consent.

Salon owners, managers and staff

• Identity and contact: name, email address, phone number, and login credentials (passwords are stored hashed, not in plain text).
• Account and role: whether you are an administrator, manager, stylist or another role, plus invitations sent to join a salon.
• Salon profile: business name, address or city, logo, theme colour, opening hours, currency (LKR), service menu, and other settings you configure.
• Staff operations: service assignments, weekly availability hours, and activity recorded in the audit log.
• Operational records you create: appointments, clients, inventory, purchase orders, expenses (including receipt images), point-of-sale sales, refunds and reports.
• Support: emails, onboarding notes and any files you send us when you ask for help.

Clients of salons that use RoseBook

A salon may store, and we then process on that salon’s behalf:

• Identity and contact: name, phone number, WhatsApp number, email address, and profile photo.
• Booking data: services, date and time, assigned stylist, status (confirmed, in progress, completed, cancelled, no-show), notes, and reschedule history.
• Visit and clinical-style notes the salon chooses to keep: allergies, colour formulas, consent notes, private comments, and before-and-after photos.
• Loyalty and commercial data: visit count, loyalty points, last visit, lifetime spend, invoices and optional SMS receipts.
• Messages: SMS confirmation, reminder, reschedule and cancellation threads tied to a booking.
• Public booking inputs: whatever you type on the salon’s booking page or include in a WhatsApp booking request generated from that page.

Salons decide which of these fields they use. Some information (for example health-related notes or photos) may be sensitive. We process it only because the salon stored it in the product to serve you.

Payment and billing data

RoseBook’s point of sale records how a salon’s customer paid (for example cash, card or digital wallet) together with the bill contents, discounts, tax and invoice details, all in Sri Lankan Rupees. We are not a bank or card acquirer. Card-by-card payment data, if a salon takes cards through a third-party terminal or wallet, is handled by that provider — not stored as full card numbers in RoseBook.

If you subscribe to RoseBook itself, we collect the business contact and billing details needed to invoice you. Payment card data for software subscriptions, if collected, is handled by our payment provider and is not stored on our servers as full card numbers.

• Directly from you, when you create an account, fill settings, add staff, take a booking, check out a client, upload a photo or receipt, or email us.
• From salon staff, when they type or upload their customers’ details into the product.
• From clients, when they use a salon’s public booking page or send a WhatsApp booking request that was pre-filled by RoseBook.
• Automatically, through cookies and similar technologies needed to keep you signed in and to protect the service (see Cookies below).
• From devices and servers, as logs that record access, errors and security events.

We use personal data for the following purposes:

• To create and authenticate accounts, keep sessions signed in, and apply role-based access so stylists, managers and owners only see what they should.
• To run the salon calendar, client book, service menu, staff rosters, inventory, POS, expenses and reports.
• To publish the salon’s public booking page and digital price chart from the live service menu and availability the salon configured.
• To send booking confirmations, reminders, reschedules, cancellations and optional SMS receipts when the salon (or you) asks us to.
• To pre-fill a WhatsApp message so a client can send a booking request to the salon.
• To show dashboards, revenue and expense charts, audit logs and other operational views.
• To store and deliver images the salon uploads (logos, service photos, client photos, expense receipts) via cloud storage and a content delivery network.
• To provide onboarding and support in English, Sinhala or Tamil during Sri Lankan working hours.
• To bill for the software, prevent fraud, enforce our terms, and keep the platform secure.
• To meet legal obligations, including tax, accounting and requests from competent authorities where the law requires us to disclose data.
• To improve reliability and features, using aggregated or de-identified information where we can.

We do not sell personal data. We do not use salon client records to advertise our own products to those clients. We do not use sensitive notes or photos for marketing.

Where we are the controller, we rely on one or more of the following grounds under Sri Lankan law (and, where another country’s law also applies, the closest equivalent):

• Contract: processing needed to provide the RoseBook service you signed up for (account, hosting of your salon workspace, support).
• Consent: where we ask for it, for example optional SMS to a number you or the salon provided, or optional marketing email from us about RoseBook. You can withdraw consent at any time; withdrawal does not affect processing already carried out.
• Legitimate interests: securing the platform, preventing abuse, understanding how the product is used so we can keep it working, and contacting existing customers about service changes. We balance these interests against your rights.
• Legal obligation: keeping records required by law, responding to lawful requests, and protecting rights in a dispute.

Where we are the processor for a salon, we process client data on the salon’s documented instructions, which include using RoseBook’s features they enable (booking, SMS, POS, photos, and so on). The salon is responsible for having a lawful basis to collect that data from their customers — including consent where the PDPA or other rules require it, for example before sending marketing SMS.

RoseBook can send transactional SMS related to appointments (confirm, remind, reschedule, cancel) and optional SMS receipts. Messages are addressed to the mobile number stored on the booking or client profile. Delivery uses telecommunications networks in Sri Lanka (including networks such as Dialog, Mobitel, Hutch and Airtel) through our SMS delivery providers. Those providers and carriers see the destination number and message content in order to deliver it.

WhatsApp booking works differently: RoseBook builds a pre-filled message from the salon’s live menu and availability. When the client sends it, the message travels on WhatsApp (a Meta service) to the salon’s WhatsApp number. Meta’s terms and privacy policy then apply to that conversation. We do not operate WhatsApp, and we do not read your private WhatsApp chat history beyond what a salon later types into RoseBook.

We do not send promotional SMS on our own behalf to salon clients. If a salon uses client numbers for marketing, that salon is responsible for consent and opt-out under applicable law.

The RoseBook application uses cookies and similar storage that are necessary to run the product:

• Authentication cookies (typically HttpOnly) so we can keep you signed in and refresh your session without storing access tokens in the page.
• Security and session cookies to prevent abuse and associate requests with your account.
• Short-lived preferences that remember UI choices such as a view or filter, where we use them.

These cookies are essential. If you block them, you will not be able to log in or use the app reliably. The marketing website does not currently set advertising cookies. If we later add non-essential cookies (for example analytics), we will describe them here and obtain consent where the law requires it.

We share personal data only as needed to operate RoseBook:

• Inside the salon workspace: other authorised users of that salon (for example a front-desk user can see bookings; a stylist may see their own chair). Access is role-based.
• Infrastructure providers: hosting, databases, backups, email delivery, error logging, cloud object storage and CDN for images.
• SMS and telecommunications providers, to deliver messages the salon or you requested.
• WhatsApp / Meta, only when a client (or salon) actually sends a WhatsApp message as described above.
• Payment providers, if you pay us for a subscription, and only to process that payment.
• Professional advisers (lawyers, accountants) under confidentiality, where needed.
• Authorities, if we are legally required to disclose data, or to protect people from serious harm.
• A buyer or successor, if we reorganise or sell the business, in which case this policy will still apply or you will be notified of changes.

Every processor we use is expected to handle personal data only on our instructions (or the salon’s, as relevant), to keep it secure, and not to use it for their own marketing. We do not sell, rent or trade personal data.

RoseBook is built for businesses in Sri Lanka, but some infrastructure (hosting, storage, CDN, email or SMS gateways) may be located in other countries. That means personal data may be transferred outside Sri Lanka.

When we transfer personal data abroad we take steps intended to keep it protected, such as using reputable providers, encryption in transit (HTTPS), access controls, and contractual terms that require the recipient to protect the data. If the PDPA or a future direction of the Data Protection Authority of Sri Lanka requires a specific transfer mechanism, we will follow it.

We keep personal data only as long as needed for the purposes above, including legal, tax and security needs.

• Account and salon workspace data: for as long as the salon account remains open, then for a limited period afterwards so we can close the account cleanly, resolve disputes and meet record-keeping duties.
• Client records inside a salon workspace: until the salon deletes them, or until the salon account is deleted and any required retention window has ended. The salon controls day-to-day deletion.
• SMS and booking message logs: for as long as they remain attached to the booking or client thread, and for a period in backups.
• Audit logs: for a period sufficient to investigate unauthorised changes to bookings, stock and sales.
• Support emails: for as long as needed to finish the request and for a reasonable follow-up period.
• Backups: may linger for a short time after deletion until they rotate out. We do not restore deleted personal data into the live product except to recover from an incident.

If you ask us to delete an account we control, we will do so subject to data we must keep by law (for example invoices) and residual backup copies.

We take technical and organisational measures appropriate to a multi-tenant salon system, including:

• HTTPS for data in transit.
• Hashed passwords and cookie-based sessions; we do not put access tokens in frontend code for you to copy around.
• Role-based access so staff see only what their role allows.
• Audit logs of changes to bookings, stock and sales.
• Isolation of salon workspaces so one business cannot open another’s book.
• Access to production systems limited to people who need it for operations and support.

No method of transmission or storage is perfectly secure. Please use a strong unique password, keep your devices updated, and only give staff the role they need. If you believe an account has been compromised, email us immediately at the address below.

If we are the controller of your data (typically: you have a RoseBook login, or you contacted us directly), you may have the following rights under the PDPA, subject to legal limits:

• To be informed about how we process your data (this policy).
• To request access to the personal data we hold about you.
• To request correction of inaccurate or incomplete data.
• To withdraw consent where processing is based on consent.
• To request erasure or restriction in the circumstances the law allows.
• To object to certain processing, including processing based on legitimate interests.
• To complain to us, and to the Data Protection Authority of Sri Lanka.

To exercise these rights, email [email protected] from the address on your account where possible, and tell us what you want us to do. We may need to verify your identity before we act. We will respond within the time the PDPA requires.

Some requests may be refused or limited where the law allows — for example if fulfilling them would reveal another person’s data, or if we must keep a record for tax or a legal claim.

If a salon stored your details in RoseBook, that salon is the controller. You should contact them first to:

• See or correct your profile, notes or photos.
• Cancel or reschedule a booking (you can often do this through the salon; some changes are also available from the salon’s side of the product).
• Ask them to stop SMS reminders, or to delete your record, subject to any invoices or legal records they must keep.

If the salon does not respond, or you believe we processed your data in a way that is not on the salon’s instructions, email [email protected]. We will look into it and, where appropriate, work with the salon. We cannot always delete a live booking record without the salon’s involvement, because that record belongs to their business operations.

RoseBook is a business product for salon operators. We do not knowingly offer accounts to children. A salon may store a minor’s details (for example a child’s haircut booking made by a parent). In that case the salon is responsible for collecting that data lawfully, including involving a parent or guardian where required.

If you believe we have collected a child’s data in a user account in error, contact [email protected] and we will delete it.

The website and app may link to codeclutch, WhatsApp, payment apps, or other sites. Their privacy practices are their own. Read those policies before you share data with them.

We may update this Privacy Policy from time to time — for example if we add analytics, a new messaging channel, or if the law changes. The “Last updated” date at the top will change. For material changes we will provide a more prominent notice (for example a note in the app or an email to account holders). Continued use of RoseBook after an update means you should read the new policy; where the law requires consent, we will ask for it.

For privacy requests, questions or complaints:

• Email: [email protected]
• Product: RoseBook (RoseBook by codeclutch)
• Vendor: codeclutch — https://codeclutch.tools
• Website: https://dev.rosebook.lk
• Application: https://cloud.rosebook.app

If we cannot resolve your concern, you may contact the Data Protection Authority of Sri Lanka, which supervises the PDPA.