Privacy

Who we are

Loomora is run by Loomora LLC, a Florida limited liability company. You can reach us at hello@loomora.app for privacy, payment questions. We do not publish a street address.

What we collect

Salon owners

• Your email address (to sign you in and email you).
• The salon’s details you enter: name, address, phone, opening hours, policy text, licence number, Instagram handle, cover photo, Google review link, and time zone. These are shown on the salon’s public page.
• Your plan, trial dates and how we bill the salon (set by us).

Team members

• Your email address and name (for your account).
• What you put on your card: name, photo, bio, Instagram handle, phone number and booking link. The card is public.
• Your services, prices, hours, cancellation rule; your clients’ bookings (below).

Clients (people who book)

• When you book: your name, your mobile number, your email address if you give one, the service, price and time, and the booking’s status.

Everyone

• Visits: for a salon’s public page we count page views (which salon, and when) and taps on a team member’s booking link (which team member, which salon, when). We do not store a visitor identifier, cookie, IP address or device for these counts.
• Sign-in links: we store only a hashed copy of each link, its email address and when it expires.
• Our invite list: if you ask for an invite on loomora.app: your email, salon name, your role, how your salon is set up (booth rental, commission, both or working alone), how many people work there and the tool you use now.
• Photos you upload (cover photo, team member photo).
• Technical logs. Our hosting provider may keep standard server logs for a limited time that can include IP addresses. We use them only to run and secure the service.
• Fonts. The pages on loomora.app load their fonts from Google Fonts. When a page loads, your browser asks Google for the fonts, so Google receives your IP address and browser details. We do not send Google anything else.
• Rate limits. To stop abuse we count requests per IP address in the server’s memory for a short time. This is not saved in our database.

Who sees it

• A client’s booking is seen by the team member she booked with. The salon owner sees a list of the salon’s bookings for the next 14 days (without clients’ phone numbers or emails). A team member’s client list is visible only to her. Other team members do not see it.
• The public sees the salon page, including team member cards and photos, and nothing about clients.
• Loomora’s small team can see the data needed to run and support the service.
• Our service providers see what they need to do their job, as listed below. No one else sees it.

We do not sell personal information. We do not share your mobile number with anyone for marketing.

Who we share it with

• Microsoft Azure. What it does: hosts the site, the database and uploaded photos. What it sees: everything stored, as our hosting provider. Our hosting provider may keep standard server logs for a limited time that can include IP addresses. We use them only to run and secure the service.
• Resend. What it does: sends our emails. What it sees: the recipient’s email address and the email’s content.
• Google Fonts (Google). What it does: provides the typefaces used on our pages. What it sees: a visitor’s browser contacts Google to download fonts, so Google sees the visitor’s IP address and browser details.

A salon owner or team member who uses Loomora can also be an independent business with her own duties to her clients.

How long we keep it

• Today nothing is deleted on a schedule. We keep bookings and accounts for as long as the salon uses Loomora, and we remove what you ask us to remove (“Asking for removal or a copy”). The only thing that is cleaned up automatically is a time held while someone is mid-booking, which is released when it expires.
• Backups and logs may keep copies for a short time after removal.

Asking for removal or a copy

• Ask for a copy or for removal. Write to hello@loomora.app from the email address you gave us, or tell us the mobile number you booked with. We reply within 30 days. There is no self-service download or delete button today.
• Correct your details. Owners and team members can edit what they entered. A client can ask the team member or us to correct a booking.
• Emails. Service emails about your bookings and account cannot be turned off while you use the service. We send no promotional email today.

Cookies

Owners and team members get a sign-in cookie when they sign in. Forms on the site set a security cookie that stops other sites from sending them for you.

The salon page remembers its colour theme, and the booking steps remember your choices as you go. Both are kept in your browser (localStorage and sessionStorage), not on our server.

The pages on loomora.app load their fonts from Google Fonts. When a page loads, your browser asks Google for the fonts, so Google receives your IP address and browser details. We do not send Google anything else.

Security

What the code does today: sign-in and security cookies are marked Secure and HttpOnly and sent over HTTPS only; browsers are told to use HTTPS (HSTS) in production; sign-in links are stored only as hashes and work once; requests to sign in, book and the invite request form is rate-limited; uploaded photos are stored in Azure storage with access by the app’s managed identity, not a stored key. No system is perfectly secure and we cannot promise that nothing will go wrong.

Children

Loomora is for salons and their clients and is not aimed at children. A parent might book for a child; we do not check anyone’s age. We do not knowingly collect information from children under 13 except as part of a booking a parent or guardian makes for them.

Changes to this page

When we change this page in a way that matters, we change the date at the top and email salon owners. The version date is the one at the top of this page.