Apex Salon & Spa: Terms and Privacy

Privacy and data safety

Apex Salon & Spa ("Apex", "we") is a booking, client, inventory and payroll service for salons and spas. This page explains what we collect, how we keep it safe, and what we do not do. We follow Canada's privacy law (PIPEDA) and Canada's anti-spam law (CASL).

What we collect. Your account (name of the salon, owner email, a hashed password) and everything your salon enters: clients, appointments, services, staff, payroll, inventory, receipts, expenses, vendors and settings.

Where it is kept. On professionally managed, encrypted cloud servers. Stored data is encrypted and backed up automatically.

How it is protected.

• Everything travels over encrypted HTTPS. The database accepts encrypted connections only.
• Passwords are never stored as text. They are protected with a salted, slow hash (scrypt).
• Signing in needs your password and a 6-digit code emailed to you (two-step sign-in). Codes last 10 minutes and allow five tries.
• Each salon's data is separated by salon, and the server checks the signed-in salon on every request.
• Repeated sign-in attempts are rate limited. Sessions expire after 8 hours.
• Access to our hosting account is limited to the Apex owner. We do not routinely look at your clients' details. We may open data only to fix a problem you ask us to help with, or where the law requires it.

What we do not do. We do not sell, rent or share your data or your clients' data. We do not use it for advertising. We do not use it to train AI systems.

Who processes it for us. Our hosting and messaging providers (hosting, the database, and, only when you send them, email and text messages). They handle data only to provide those services to us, and under contract to protect it.

How long we keep it. While your account is open. If a free trial ends, your data stays safe and view-only so you can download it. You can ask us to delete your salon's data at any time and we will do so, except for records we must keep by law. Backups roll off automatically after a short retention period.

If something goes wrong. If a breach could put people at real risk of significant harm, we will tell the affected salon and the Privacy Commissioner of Canada as the law requires, and keep a record.

Your clients' data

Your salon decides what to record about its clients, and your salon is responsible for that information. Apex acts as your service provider and only stores and processes it for you.

• Tell clients what you collect (name, phone, email, visit history, notes) and why: booking, reminders, receipts. A short notice at the front desk or on your booking form is enough.
• Collect only what you need. Do not record sensitive details you do not need, such as health information beyond what a treatment requires.
• Clients can ask to see, correct or remove their information. Please handle these requests, and ask us if you need help exporting or deleting a record.
• Keep your own sign-in private and use a strong password. Remove staff access when someone leaves.

Texts and email to your clients (CASL)

• Send promotions only to clients who agreed to receive them. The app asks you to confirm this before every campaign.
• Every email includes your salon's name and address and an unsubscribe link. Every promotional text says "Reply STOP to opt out". People who opt out are skipped automatically from then on.
• Appointment reminders to clients with a booking are service messages, and they use the same opt-out rules.

Terms of service

• Free trial. New salons get 15 days free, no card needed. We email you before it ends. When it ends, your data stays safe but becomes view-only and downloadable until you subscribe.
• Subscription. To continue, contact us. Payment is arranged directly with us (for example by Interac e-Transfer), and we switch your account to paid when it is received.
• Your data is yours. You can download a complete backup at any time. We claim no ownership of your salon's or your clients' information.
• Acceptable use. Use the service lawfully, keep your sign-in private, and do not send spam or abusive messages. We may suspend an account that breaks these rules, and your data stays available for download.
• Availability. We work to keep the service running and your data safe, but it is provided as is, and we cannot promise it will never be interrupted. Please keep your own backup file as well.
• Liability. To the extent the law allows, Apex is not liable for indirect losses such as lost bookings or profits, and our total liability is limited to the fees you paid in the last 3 months.
• Changes. If we change these terms in a way that matters, we will email the owner before it takes effect.
• Law. These terms are governed by the laws of Ontario and the federal laws of Canada that apply there.

Contact

Questions, a request to export or delete your data, or a privacy concern: admin@apexledger.ca.

Back to sign in