Privacy policy

1. Who we are

Same Roof is run by Sam Allen, trading as Same Roof, in London. Same Roof Ltd is being set up and will take over Same Roof and this policy; we'll update this page when it does. Contact for anything about your data: hello@sameroof.uk.

Who decides what happens to your data depends on who you are:

• Salon owner with a Same Roof account: we are the controller.
• Stylist or renter at a salon on Same Roof: your salon is the controller for renting, rent and invoices, and we process that data for them. We are the controller for your own account.
• A client who books with a stylist: the stylist, who runs their own business, is the controller. We process your booking for them.
• A visitor to sameroof.uk: we are the controller.

Where we process data for a salon or stylist, they decide how it's used, so please contact them first. We'll pass on any request that reaches us.

2. What we collect

• Salon owners: name, email, salon name and address, invoice details you enter in Settings, plan and billing history.
• Stylists and renters: name, email, mobile, chair and days, chair bookings, rent, invoices and Direct Debit status (from GoCardless).
• Stylists' clients: name, mobile, email, appointments, and notes the stylist keeps, which can include allergies and patch-test dates.
• Everyone who signs in: email sign-in codes, passkey public keys, sign-in times, and the device and browser used.
• The iPhone app also stores a push notification token if you turn notifications on, photos you choose for your booking page, and contacts you pick to import into your client list. The app only reads the contacts and photos you select.

We don't hold card numbers or bank account details: Stripe and GoCardless collect those on their own secure pages. We use only the cookies needed to keep you signed in and remember your salon. There are no advertising or tracking cookies, and the app doesn't track you across other apps or websites.

3. Why we use it

• To run your account, sign you in and provide the service: contract.
• To bill salons and keep accounts and tax records: legal obligation and contract.
• To keep the service secure, stop fraud and fix faults: legitimate interests (keeping the service safe for everyone).
• To email owners about their plan and important service changes: contract. Marketing only with your consent, and you can unsubscribe at any time.
• Everything we do for salons and stylists as their processor: their instructions, under the lawful basis they choose.

We don't use your data for automated decisions that have legal or similarly significant effects on you.

4. Who we share it with

Only the providers that run Same Roof, and only for that purpose:

• Supabase: database and sign-in (London).
• Vercel: hosts the app (London region).
• Resend: sends sign-in codes, invoices, confirmations and reminders.
• Stripe and GoCardless: payments, into the salon's own accounts.
• Expo and Apple: deliver push notifications to the iPhone app.
• Google Workspace: our email.
• Cloudflare: our domain and website.

We'd also share data if the law requires it, or with a company that takes over Same Roof, which would have to keep to this policy. We never sell personal data.

5. Where it's stored

Our database is in London. Some providers are US companies or run parts of their service outside the UK. For those we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or on the UK International Data Transfer Addendum in the provider's data processing terms.

6. How long we keep it

• Accounts, salons, bookings and stylists' client lists: while the account is open, then deleted within 30 days of it closing (after an export, if you ask for one).
• Invoices and billing records: 6 years after the end of the financial year they relate to, as tax law requires.
• Security and sign-in logs: a short period, then deleted automatically by our providers.
• Support emails: 2 years after the conversation ends.

You can delete your account at any time in the app (Me, then Delete my account) or on the website (Account, then Delete my account).

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, limit how we use it or stop using it where we rely on legitimate interests, or send it to you or another provider in a common file format.

Email hello@sameroof.uk. We'll reply within one month, and we may ask you to prove who you are first. Where we process data for a salon or stylist, we'll pass your request to them and help them answer it.

8. Complaints

If you're unhappy with how we've handled your data, please complain to us first at hello@sameroof.uk, or in any other way that reaches us. We'll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Changes to this policy

We'll update the date at the top when this policy changes, and email account holders about any significant change.