Cookie statement
This is a translation of the Dutch "Cookieverklaring". If the two differ, the Dutch text prevails.
In short
- We only use cookies and similar techniques that are needed to make the platform work, such as staying signed in, remembering your booking and keeping your preferences.
- We ourselves use no cookies for statistics, advertising or following your browsing.
- If a salon has connected its own Google Analytics or Meta Pixel, we first ask for your consent on that salon's pages; only once you say yes do Google or Meta place their cookies, for that salon.
- On the contact page and when you sign up for the newsletter we use Google's reCAPTCHA against spam, and Google places its own cookies there.
- Some pages fetch fonts, maps, photos or scripts from other parties' servers; these place no cookies, but do see your IP address.
- Our e-mails, including those a salon sends through Saloon, do not record whether you open them or click a link.
- You can always delete or block cookies and stored data yourself in your browser, but then signing in and booking, for example, no longer work.
This is a summary; the articles below are binding.
1. What this statement covers
1.1 This cookie statement is Saloon's, a trading name of [not known yet] ("Saloon", "we"). Our details are in the Company details.
1.2 The statement covers the whole platform:
- the website: Saloon.nl, with the pages about Saloon, the salons' pages, booking an appointment, your account with Saloon, reviews, the newsletter and the contact form;
- the back office: mijn.saloon.nl, which salons and their staff work in;
- the app: the app for salons' customers.
1.3 Here we explain which cookies and similar techniques we use, why, and how long they stay. What else we do with personal data is in our privacy statement.
2. What cookies and similar techniques are
2.1 A cookie is a small text file a website puts in your browser. On a later visit your browser sends it back, so the website recognises you, for example as someone who is already signed in.
2.2 A website can also keep something on your device in other ways. This statement covers those techniques too, because the law treats them the same way:
- localStorage: a storage place in your browser that stays until it is cleared, also when you close the browser;
- sessionStorage: a storage place that disappears as soon as you close the tab or window;
- IndexedDB: a small database in your browser, for somewhat more data;
- service worker and its cache: a piece of software a website installs in your browser, so the website loads faster, can show a page offline or can receive push notifications. The files it keeps are in a cache.
2.3 A cookie from the website you visit is a first-party cookie. A cookie another company places through that website is a third-party cookie.
3. Which kinds we use, and why we do not ask for consent
3.1 We only use functional cookies and storage: what is needed to provide the service you ask for yourself, such as signing in, booking an appointment or remembering your language. Such cookies need no consent (article 11.7a of the Dutch Telecommunications Act). We do have to tell you which ones they are; this statement does that.
3.2 We do not use cookies or similar techniques to:
- measure how visitors use the website (analytics cookies);
- show or measure advertising (marketing cookies);
- follow you across other websites or build a profile of you (tracking).
That is why we show no cookie notice and do not ask for consent on the rest of the platform.
3.3 On two of the website's forms we use Google's reCAPTCHA. Google places its own cookies there. We consider this necessary to protect those forms against spam. Article 7 covers it.
3.4 One exception: the pages of a salon that has connected its own Google Analytics or Meta Pixel. There your browser loads that software, and Google or Meta place cookies, only after you have given your consent in the cookie notice. Article 8 covers it.
3.5 We do count how often a salon's page is viewed and which steps of booking visitors reach. For that we place no cookie and keep nothing in your browser: your browser only reports that a page or step was reached. It therefore falls outside the rules for cookies; article 3.7 of the privacy statement covers it.
4. The website (Saloon.nl)
| Name | What it does | Kind | How long | Placed by |
|---|---|---|---|---|
saloon-session |
Keeps track of your session: whether you are signed in with your account with Saloon, and other data needed during your visit. It holds no sign-in details itself, only a random code | Cookie, first-party, not readable by scripts (HttpOnly), sent over a secure connection only (Secure), not sent along with forms on other websites (SameSite=Lax) | 2 hours after your last click; after that you are signed out | Saloon |
XSRF-TOKEN |
Protects forms against misuse by other websites (CSRF protection) | Cookie, first-party, readable by the website's own scripts; Secure, SameSite=Lax | As long as saloon-session |
Saloon |
saloon.booking.state |
Remembers the appointment you are booking: the chosen treatments, team member and time, your details and your note. So you lose nothing if you reload the page | sessionStorage | Until you close the tab | Saloon |
saloon.booking.handoff |
Takes the appointment you are booking to the tab in which you sign in or confirm your account with the link in the e-mail: the chosen treatments, team member and time. Not your details and not your note. Only when you click to sign in or create an account while booking | localStorage | 1 hour at most; gone as soon as the booking carries on, is made or starts again | Saloon |
saloon-geocode:<address> |
Remembers a salon's position on the map, so it does not have to be looked up every time. Holds the salon's address, nothing about you | localStorage | Until you clear your browser data | Saloon |
| reCAPTCHA cookies | Spam protection on the contact page and the newsletter sign-up (article 7) | Cookie, third-party | Set by Google | |
saloon.consent |
Remembers your choice in the cookie notice on the pages of a salon that measures: analytics yes or no, marketing yes or no, and when you chose. Only in your own browser; our server does not keep your choice | localStorage | 6 months; then we ask again | Saloon |
_ga, _ga_<id> |
The salon's Google Analytics (article 8), only after your consent to analytics cookies | Cookie, set by Google's software | Up to 2 years (Google's default); gone as soon as you withdraw your consent | Google, for the salon |
_fbp, _fbc |
The salon's Meta Pixel (article 8), only after your consent to marketing cookies; _fbc only if you came through an advert |
Cookie, set by Meta's software | 90 days (Meta's default); gone as soon as you withdraw your consent | Meta, for the salon |
5. The back office (mijn.saloon.nl)
| Name | What it does | Kind | How long | Placed by |
|---|---|---|---|---|
saloon_refresh_token |
Keeps you signed in. The browser only sends it to the address where a new sign-in key is fetched, and scripts on the page cannot read it | Cookie, first-party (HttpOnly, Secure, SameSite=Strict) | 7 days; replaced by a new one when used; removed when you sign out | Saloon (api.saloon.nl) |
saloon_oauth_state |
Checks that a sign-in with Google really started in your browser | Cookie, first-party (HttpOnly, Secure, SameSite=Lax), sent only to the Google sign-in | 10 minutes | Saloon (api.saloon.nl) |
saloon_oauth_connect |
Checks that connecting your Google account to your account with Saloon really started in your browser. Holds only a random code | Cookie, first-party (HttpOnly, Secure, SameSite=Lax), sent only to the Google sign-in | 5 minutes | Saloon (api.saloon.nl) |
locale, theme |
Your language and whether you use the light or dark view | localStorage | Until you clear your browser data | Saloon |
enums:v1:<language> |
Keeps the fixed lists and their names (such as statuses), so the back office loads faster | localStorage | Until a new version replaces it | Saloon |
planner:prefs:…, planner:filtersets:…, reports:favourites:…, reports:columns:…, saloon.recent-settings, saloon:last-location |
Your preferences: how you view the calendar, your saved filters, your favourite reports and columns, the settings you opened last and the location you last worked at | localStorage | Until you clear your browser data | Saloon |
saloon.banner.verify_email.dismissed_at.… |
Remembers that you dismissed the notice about confirming your e-mail address, so it stays away for a day | localStorage | Until you clear your browser data | Saloon |
push-device-token |
The code your device receives push notifications with | localStorage | Until you turn push notifications off or sign out | Saloon |
googleOauthPayload |
Passes the result of signing in with Google from the Google window to the back office | localStorage | At most 60 seconds; then cleared | Saloon |
pin_lock_active, pin_lock_return_route |
Keeps the screen locked with a PIN on a device the salon shares, and remembers where you were | sessionStorage | Until you close the tab | Saloon |
saloon.sign_in.prefill_email |
Fills in your e-mail address on the sign-in screen when you arrive through a link in an e-mail | sessionStorage | Until you close the tab | Saloon |
saloon.banner.closed_workspace.dismissed.… |
Remembers that you dismissed the notice about a workspace you closed, so it stays away while the tab is open | sessionStorage | Until you close the tab | Saloon |
saloon.chunk-reload-at |
Remembers when the back office reloaded itself because a new version was ready after an update, so it does not keep doing so. Holds only a time | sessionStorage | Until you close the tab | Saloon |
| Firebase storage | Handles push notifications to your device | IndexedDB, with Firebase's (Google's) software | Until you turn push notifications off or clear your browser data | Saloon, with Google's Firebase |
| Service workers | Receive push notifications and show an offline page when you have no connection | Service worker and cache | Until you clear your browser data | Saloon |
6. The app
| Name | What it does | Kind | How long | Placed by |
|---|---|---|---|---|
locale |
Your language | localStorage | Until you clear your browser data or remove the app | Saloon |
install-skipped |
Remembers that you skipped the question to add the app to your home screen | localStorage | Until you clear your browser data or remove the app | Saloon |
favoriteSalons |
Your favourite salons | localStorage | Until you clear your browser data or remove the app | Saloon |
| Service worker and cache | Keeps the app itself, fonts (google-fonts-cache, up to a year) and images (unsplash-images-cache, up to 7 days), so the app loads quickly and also opens without a connection |
Service worker and cache | As stated; the app itself until there is a new version | Saloon |
7. Google's reCAPTCHA
7.1 On the contact page and when you sign up for the newsletter we use Google's reCAPTCHA v3. In the background it checks whether the form is sent by a person and not by a computer program that sends spam. You do not have to do anything for it.
7.2 For this your browser loads software from Google. Google then receives your IP address and data about your browser and your use of the page, and places or reads its own cookies. Google can also read cookies it had placed in your browser before, for example because you are signed in to Google. Which cookies these are and how long they stay is decided by Google. Google is an American company, so your data may go to the United States.
7.3 What Google does with this data is in Google's Privacy Policy and Google's Terms of Service.
7.4 reCAPTCHA is only loaded on the pages with those two forms, not on the rest of the website, the back office or the app. If you do not want to use it, e-mail us at [email protected] instead of using the contact form.
8. A salon's Google Analytics and Meta Pixel
8.1 In the back office a salon can connect its own Google Analytics or Meta Pixel, to see how visitors use its pages on Saloon.nl and what its advertising on Facebook and Instagram brings in. This applies only to that salon's pages: its salon page and booking with that salon. Nothing is measured on any other page, in the back office or in the app.
8.2 On such a salon's pages you see a cookie notice on your first visit. Until you choose, nothing that needs consent is loaded or placed. You can choose Necessary only, Accept all or per kind:
- Analytics: Google Analytics' software, with the salon's measurement account. Google sets
the cookies
_gaand_ga_<id>. We switch Google Analytics' advertising features off. - Marketing: the Meta Pixel's software, with the salon's pixel. Meta sets the cookies
_fbpand, if you came through an advert,_fbc.
8.3 If you consent, that software sends your IP address, details of your browser and device, the address of the page and what you do there to Google or Meta: that you start a booking, that you join the waitlist, and a booked appointment with its treatments and their price. Your name, e-mail address, phone number, note and booking reference never go with it. Nothing is ever measured on your account with Saloon, when you manage an appointment, when you write a review or on a preview of a salon page.
8.4 The salon decides whether to measure, holds the account with Google or Meta and decides what happens to the data there and how long it is kept. Google and Meta are American companies; your data may therefore go to the United States. Saloon itself receives and keeps nothing of what is measured. Who is responsible for what is set out in our privacy statement.
8.5 Your browser keeps your choice for 6 months in saloon.consent (article 4); then we ask
again. You can change your choice at any time through Cookie settings at the bottom of the
salon's page. If you withdraw your consent, the scripts no longer load and we remove Google's or
Meta's cookies on Saloon.nl.
8.6 What Google and Meta do with the data is set out in Google's privacy policy and Meta's privacy policy.
9. Content from other parties' servers
9.1 Some parts of the platform fetch fonts, maps, images or software from other parties' servers. Those parties place no cookies we use, but your browser does connect to their server. As a result they see your IP address and the usual data a browser sends along, such as which type of browser you have.
| Party | What | Where |
|---|---|---|
| Google Fonts (Google) | Fonts | Salon pages, the newsletter pages and some of the website's other pages; the app |
| OpenStreetMap | Map tiles | Every map: choosing an address in the back office, a salon's page and searching in the app |
| Nominatim (OpenStreetMap) | Looking up a salon's position on the map; the salon's address is sent along | The map on a salon's page, when that position is not yet known |
| Unsplash | Sample photos | Some screens of the app and of booking |
| Firebase (Google) | The software for push notifications | The back office, if you use push notifications |
9.2 If something goes wrong on the website, in the back office or in the app, we send an error report to Sentry, which helps us track down errors. Sentry places no cookies.
9.3 More about these parties, where they are based and what they receive from you is in our privacy statement.
10. E-mails
10.1 The platform's e-mails, including those a salon sends its customers through Saloon, such as an appointment confirmation or reminder, contain no invisible image and no links that first pass through another server. So nobody sees whether you open an e-mail or click a link. Our e-mail service Mailjet does report whether an e-mail was delivered, bounced or was reported as spam; nothing on your device is read for that.
10.2 Nor do the e-mails fetch fonts or images from other parties' servers: they use your own device's font, and the images travel inside the e-mail itself.
11. Deleting or blocking cookies
11.1 You can always delete cookies and other stored data yourself, and set your browser to no longer accept them. How this works differs per browser; you usually find it under Settings > Privacy (or Privacy and security) > Cookies and site data. There you can also delete the data of a single website, such as Saloon.nl or mijn.saloon.nl. This also clears localStorage, sessionStorage, IndexedDB and the service worker's cache.
11.2 If you added the app to your home screen, you delete its stored data by removing the app or by clearing the app's site data in your browser.
11.3 Please note: if you block or delete our functional cookies, part of the platform no longer works. You are signed out, a booking you are making is lost and your preferences are forgotten.
11.4 You can also block Google's reCAPTCHA cookies by blocking third-party cookies in your browser.
11.5 The easiest way to remove the cookies of a salon's Google Analytics and Meta Pixel is to withdraw your consent through Cookie settings at the bottom of the salon's page (article 8.5).
12. Changes
12.1 If we start using other cookies or similar techniques, or their purpose or lifetime changes, we update this statement. The date of the version that applies now is at the top; you can view earlier versions from this page.
12.2 If cookies that need consent are added, we first ask for your consent and only place them once you have given it, as we already do on the pages of a salon that measures (article 8). Refusing is just as easy as accepting.
13. Questions
Do you have a question about cookies or about your data? E-mail us at [not known yet].