How we handle data
Privacy Policy
Salon Malone makes phone calls to real people about their haircuts, so a privacy policy here is not a formality. This one is short, specific, and names every supplier that touches anything.
If you are one of the people we called and you want off the list forever, skip to section 6. It takes one sentence, and saying it on the call itself is enough.
Last updated Easecase, Inc. · 1111b South Governors Avenue, Dover, DE 19904, United States
Jump to a section
- 01We wear two hats, and this is the whole policy in one idea
- 02What we actually collect
- 03Why we hold each thing
- 04Who else touches it
- 05How long we keep it
- 06Getting your data out, or getting yourself off the list
- 07How it is kept
- 08Children, and people outside the United States
- 09Changes, and how to reach a human
01
We wear two hats, and this is the whole policy in one idea
The short version
Your business’s own account data is ours to be responsible for. Your clients’ contact data is yours — we only ever handle it on your instructions, which makes us the hired hands, not the owner.
Almost every question about this policy is answered by working out which hat applies.
Hat one: your account. We decide, so we are responsible.
When you sign up we hold information about your business — your salon name, who to contact, the email and phone number, your timezone, your average ticket, the offer text Malone reads out, and your billing status. We decide what to do with that, so for it we are the controller (or, if your local law prefers, the business).
Hat two: your list. You decide, so we only follow instructions.
When you upload a list of lapsed clients, that is your data about your customers. We store it, scrub it, dial it and report on it because you told us to, for that purpose and no other. For that data we are a processor (a service provider, in the American phrasing) acting on your documented instructions — which is a technical way of saying: it is your list, we are just the ones holding the phone.
Concretely, and without any wriggle room:
- We do not sell it. We are not that kind of establishment, and there is no version of this business where that changes.
- We do not use it to market anything to anyone, including to you.
- We do not use it to train models. The model that runs the call reads the transcript in the moment and that is the end of its involvement.
- We never mix one salon’s list into another’s. Every row is tied to the client that uploaded it.
- We delete it when you tell us to, subject only to the one exception below.
The one exception, and why it exists
If someone tells us to stop calling, their phone number goes onto a global suppression list shared across every campaign we run for every client. We keep that number — just the number, the reason and the date — precisely so that nobody ever calls it again, including you, including a different salon, including us in two years when everyone involved has forgotten. That is not us making use of your data. It is the only way never call me again can actually mean never.
This policy covers Salon Malone and startup25.com, both products of Easecase, Inc., a Delaware corporation, at 1111b South Governors Avenue, Dover, DE 19904, United States.
02
What we actually collect
The short version
Account details, the rows in the list you upload, one record per call attempt, and the suppression list. There is no fifth thing we are quietly hoovering up.
From you, when you become a client
Salon or med spa name, contact name, contact email, contact phone, timezone, whether you are a salon or a med spa, your average ticket, the offer text Malone reads, the front-desk phone number Malone gives out on voicemail, your billing status and your Stripe customer reference. Not your card number — that never touches our systems.
From the list you upload
Per contact row, whatever your export contains from among:
- Name and first name.
- Phone number, both as you sent it and normalised to a standard format.
- Email address, if your export has one. We do not email your clients.
- The consent flag on that row.
- Last visit date, and lifetime value if you include it.
- What our scrub decided: whether the row was kept or dropped, and the reason — no consent, suppressed, invalid number, missing number, duplicate.
From the calls
Every dial attempt writes one record, including the ones that fail: the outcome (booked, declined, opted out, voicemail, no answer, answered, failed), how long it lasted, when it started and ended, why it ended, what it cost us, a two-sentence summary written for you, and the structured result — the agreed time in the client’s own words, and whether they asked to be removed.
Calls are recorded and transcribed by our voice provider, so that the booking can be extracted afterwards and so that we can review calls for quality. The audio and the transcript are stored by that provider; what our database holds is the link to each of them, not a second copy. Where you are calling into a jurisdiction that requires notice or all-party consent for recording, meeting that requirement is your obligation as the sender of the calls — see section 3 of the Terms.
Bookings
The slot in the client’s own words, the estimated value at your average ticket, and when we emailed it to you.
The global suppression list
Phone number, the reason it is there (opted out, do-not-call, complaint, invalid, added by hand) and the date. Deliberately the bare minimum needed to keep a promise.
The website itself
startup25.com is a marketing page and an operator login. There are no advertising trackers, no third-party analytics, no session recorders and no marketing pixels on it. The one cookie we set is a signed, HTTP-only session cookie for the operator login, and it exists solely to keep whoever is running campaigns logged in. Our host keeps ordinary server logs.
03
Why we hold each thing
The short version
Every field is there because a call, an email, an invoice or a promise to leave someone alone needs it. If a field stopped being needed, it would stop being collected.
| What | Why it is there |
|---|---|
| Account details | To run your campaigns, send your reports, and invoice you. |
| Phone number and first name | To place the call and to greet the person by name. |
| Consent flag | To decide whether the row may be dialled at all. Without it, the row never enters the queue. |
| Last visit, lifetime value | To prioritise who is worth calling first and to estimate recovered revenue. |
| Call records | To enforce one attempt per person, to produce your Friday report, and to review calls for quality. |
| Recording and transcript | To extract the agreed appointment after the call and to check the agent behaved. |
| Suppression list | To make sure someone who asked not to be called again is never called again, by anyone we work with. |
For your account data, our lawful basis is performing our contract with you and our legitimate interest in running and defending the business. For contact data, the lawful basis is whatever you relied on when you collected the consent you warranted to us — you are the one who decided to call these people, and we act on your instruction.
04
Who else touches it
The short version
Five suppliers, named. Nobody else, no data brokers, no advertisers, and no list of “trusted partners” doing something unspecified.
Running a voice agent takes suppliers. These are ours, what each one does, and what each one can see:
| Sub-processor | What it does | What it can see |
|---|---|---|
| Vapi | Places the calls and runs the voice agent — telephony, speech-to-text, the language model and the synthesised voice. | Contact first name and phone number, the salon name and offer read aloud, the audio of the call, and the transcript. Recordings and transcripts are stored by Vapi. |
| Supabase | The database. Every table described above lives here. | Account records, uploaded contact rows, call records, bookings and the suppression list. |
| Resend | Sends the booking alert and the Friday report to you. | Your email address and the contents of those emails, which include the contact name, phone number and the slot they agreed to. |
| Stripe | Takes the payments. | Your billing details and card data, which Stripe holds and we never see or store. We keep your Stripe customer reference and subscription status. |
| Vercel | Hosts and serves the application. | Request and server logs — IP address, timing and errors — in the ordinary course of serving the app. |
Each of them is bound by its own terms and processes data on our instructions. If we add or change a sub-processor in a way that materially affects your data, we will update this page and, for a material change, email you.
Everyone else: no
- We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no advertising in this product to sell it to.
- We would disclose data if we were legally compelled to — a valid court order, subpoena or equivalent. We would tell you first unless we were forbidden from doing so.
- If the business is ever sold or merged, the data moves with it and this policy follows it. If a new owner wanted to change it materially, you would get notice and a way out before it applied.
05
How long we keep it
The short version
As long as your campaigns and our accounts need it — and forever for opt-outs, which is entirely the point of them.
- Account data: while you have an account, and afterwards for as long as we need it for tax, accounting and legal records — generally up to seven years for billing records.
- Contact rows and call records: for the life of your account, because the never-call-anyone-twice rule and your reports both depend on remembering what already happened. Deleted sooner on request.
- Recordings and transcripts: held by our voice provider under its retention settings; we hold only the links. Ask us and we will delete the links and ask the provider to delete the artifacts.
- Suppression entries: kept permanently, and this one is not negotiable for anybody. A do-not-call record that expires is not a do-not-call record. It is a phone number, a reason and a date — nothing that identifies the person beyond the number itself.
- Server and email logs: kept for the short periods our host and email provider retain them, for security and debugging.
06
Getting your data out, or getting yourself off the list
The short version
Ask and we will do it. The one thing we will never delete is a record that says somebody does not want to be called.
If you are the salon
Email dial@startup25.com and we will export or delete your list, your call records, or your entire account. We will do it within 30 days and confirm in writing when it is done. Deleting your account deletes your client record, your contacts, your calls and your bookings. It does not delete suppression entries, for the reason given above.
If we called you and you want it to stop
Two routes. Both work, and neither of them involves finding this page again.
- Say it on the call. “Stop calling”, “take me off the list”, “do not call me” — Malone answers done, you’re off the list and ends the call, and your number is written to the global do-not-call list before the call report has finished processing. It is immediate, it is permanent, and it applies to every salon and med spa we work with, not only the one that rang you. You do not need to repeat it to anyone.
- Email us. Write to dial@startup25.com with the number, and we will suppress it and confirm. We will also pass a deletion request to the business whose list it came from, because they collected the record and they hold the original.
Asking what we hold
Email us and we will answer within 30 days. We may ask you to confirm the number is yours before we hand over call records — otherwise anyone could ask for the record of anyone else’s phone call, which would be a worse privacy policy than this one.
Depending on where you live you may have rights to access, correct, delete, port, or object to the processing of your personal information, and to be free from discrimination for asking. Exercise any of them by email. We do not charge for it. Where the data was uploaded by a salon, we will usually route the request to that salon, since it is their record and their relationship — but a request to stop calling we act on ourselves, immediately, without asking anyone’s permission.
If you think we have got something wrong, tell us first — we would rather fix it than read about it. You can also complain to your data protection authority, and we will not hold it against you.
07
How it is kept
The short version
Small system, few doors. Everything encrypted in transit, a database whose public key can read nothing at all, and one admin login rather than a directory of accounts to phish.
- All traffic to and from the application runs over TLS.
- The database has row-level security enabled with no public policies at all: the key that could reach the browser can read nothing, and only the server, holding a private service key, can read or write. That key never leaves the server.
- There is one operator credential and no user accounts, no signup, and no password-reset flow — so there is very little to phish. The session cookie is signed and HTTP-only.
- Access to the database and to call recordings is limited to the people who run the service, and call reviews are done for quality, not curiosity.
If a breach affects your data, we will tell you promptly with what we know, what we have done about it, and what you should do — rather than a carefully worded paragraph three weeks later.
08
Children, and people outside the United States
The short version
This is a tool for adults booking haircuts and treatments. We are hosted in the US, and sending us a list from elsewhere is a decision you need a lawful basis for.
The service is sold to businesses and is not directed at children. We do not knowingly collect information about anyone under 16. If a list contains a minor’s number, tell us and we will remove and suppress it.
Easecase, Inc. is based in the United States and our suppliers process data there. If you or the people on your list are outside the United States, uploading that list means transferring personal data to the US, and having a lawful basis for that transfer is your responsibility as the controller of it. If you need a data processing addendum or standard contractual clauses to make that work, ask us — we will sign a reasonable one.
09
Changes, and how to reach a human
The short version
The date at the top is always the truth. Material changes come with an email, not a silent edit.
We may update this policy as the product changes or a supplier changes. The Last updated date at the top of the page always reflects the current version, and for material changes we will email the address on your account before it takes effect.
Questions, requests, deletions, or a complaint about a call:
- Email: dial@startup25.com — this is the fastest route and a person reads it.
- Post: Easecase, Inc., 1111b South Governors Avenue, Dover, DE 19904, United States
- The number our calls come from: +1 (863) 496-6101.
The companion document is the Terms of Service, which covers who is responsible for the list in the first place. The two are meant to be read together.