Privacy policy

Avana is provided by Sweeber Technologies, Torenlaan 5B, 1402 AT Bussum, the Netherlands, registered with the Netherlands Chamber of Commerce under number 91489377, VAT number NL004895752B70 ("Avana", "we", "us"). For anything about privacy, email support-nl@getavana.com.

Avana is a booking system for salons and studios. Depending on who you are, we have a different role:

• Salon and studio owners and their team with an Avana account: we are the controller of your account data.
• Clients and members who book with a salon or studio through Avana: the salon or studio is the controller of your booking data and we process it on their behalf, as their processor. For your own Avana login (for example a member account) and for keeping the platform secure, we are the controller.
• Visitors to our website: we are the controller.

Salon and studio owners and their team

• Name, email address, phone number and, if you add one, a photo.
• Business details: business name, address, company and VAT number.
• Account data: your sign-in details (we store passwords only in hashed form), when you sign in and from which IP address.
• How you use Avana: which features and settings you use, and error logs.
• Messages to our support team.
• Billing: subscription history, invoices and payment status. Your card details are held by our payment provider, not by us.
• How you found us when you signed up: campaign tags, the page you came from and ad click IDs.

Clients and members who book through Avana

• Name, email address and phone number.
• What you booked or bought, when, and the price; class passes and memberships for studios.
• Payment status (amount, method, transaction reference). Card details stay with the payment provider.
• Answers to intake or health questions the salon or studio asks, and notes they add.
• Which confirmations, reminders and other messages you received.

Website visitors

• Technical data: IP address, browser, device, pages visited and time.
• Cookies: see our cookie policy.
• What you send us through a contact or call-back form: name, email, phone number and message.

• Running your account and subscription, processing bookings and payments, sending confirmations and reminders: performance of our contract.
• Invoicing and bookkeeping: legal obligation.
• Keeping the platform secure and preventing fraud and misuse: legitimate interests.
• Improving Avana with usage statistics: legitimate interests, and for cookies your consent.
• Answering contact and call-back requests: legitimate interests.
• Measuring which of our ads lead to sign-ups: your consent for advertising cookies. When you create an account, we may also send a hashed (scrambled) version of your email address to Meta and Google, so they can tell us whether a sign-up came from one of our ads. They do not receive the address itself. We do this on the basis of our legitimate interests; you can object at any time by emailing us.
• Marketing emails to businesses: your consent, or for existing customers the "soft opt-in" under PECR. Every marketing email has an unsubscribe link.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We only share personal data where we need to in order to provide Avana, or where the law requires it, for example a court order. We do not sell personal data, and we never share a salon's or studio's client data with other businesses, marketplaces or advertisers.

These providers process personal data for us. Each is under a contract with data protection terms.

• Google Cloud and Firebase (Google Ireland Ltd / Google LLC): database, file storage and sign-in. Where: EEA (main database); United States possible for support.
• Vercel (Vercel Inc.): hosting of the website and app. Where: United States and EEA.
• Stripe (Stripe Payments Europe Ltd / Stripe Payments UK Ltd / Stripe, Inc.): online payments and payouts. Where: EEA, UK and United States.
• Resend (Plus Five Five, Inc.): sending booking and account emails. Where: United States.
• Loops (Loops.so): sending account and product emails to businesses. Where: United States.
• Spryng (Spryng B.V.): sending text messages. Where: EEA (Netherlands).
• Bunny.net (BunnyWay d.o.o.): storing and streaming video (courses and classes). Where: EEA.
• Anthropic (Anthropic, PBC): AI-assisted replies (Avana Connect, help assistant). Where: United States.
• Sentry (Functional Software, Inc.): error monitoring. Where: United States.
• PostHog (PostHog Inc.): product analytics. Where: EEA.

If a salon or studio connects Instagram (Avana Connect) or Google Calendar, Meta or Google receive or provide data as described in the sections below. Advertising and analytics services on our website are described in our cookie policy.

We tell salons and studios by email before we add or replace a provider that handles their clients' data.

We are based in the Netherlands, and our main database is in the European Economic Area. UK law recognises the EEA as giving adequate protection. Some providers are in the United States. For those, we use the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Ask us at support-nl@getavana.com if you would like more detail.

A salon can connect its Instagram professional account to Avana. Avana Connect then answers messages that clients send to that account and helps them book. The connection only exists if the salon grants it in Instagram itself, and only for the account it connects.

What we store. For the connected account: the Instagram user ID, username, name and profile picture, and an access token from Meta that lets us read and reply for the salon. We store the token encrypted. For conversations: the messages a client sends and the replies Avana sends, the client's Instagram-scoped ID, the time, and whether someone tapped the booking button. We only receive messages sent to the connected account. The rest of the Instagram account stays out of reach: no followers, photos or advertising data. We never see Instagram passwords.

Why. To answer the client's question, to avoid answering the same message twice, to show the salon what is being asked and how many appointments Instagram brings in, and to prevent misuse. The basis is our contract with the salon. For the messages of its clients, the salon is the controller and we are its processor. We use AI to draft replies; we do not use these messages for our own marketing, we do not sell them and we do not share them with other salons or advertisers.

How long. The access token is removed as soon as the salon disconnects or withdraws access in Instagram. Conversations are kept while the salon uses Avana Connect, because the salon reads them back in its dashboard. Recognised questions in our lookup cache expire after 30 days. Monthly totals are counts without names. The security log of connecting and disconnecting is kept, without the Instagram name and ID once data has been deleted.

How to have it deleted. A salon can have its Instagram conversations deleted by emailing support-nl@getavana.com. If you messaged a salon and want your data removed, you can also do this through Instagram: remove Avana in your Instagram settings and request deletion of your data there. Meta passes the request to us, we delete the conversations, messages and links for that Instagram ID, and you see a page with the confirmation code for your request. This happens straight away, and in any case within 30 days.

A salon can connect its Google account to Avana to see its appointments in Google Calendar. The connection only exists if the salon grants it at Google, and only for the account it connects.

What Avana can access. Calendars that Avana creates itself (the "Avana" calendar), free/busy information from the salon's own calendar (only whether a time is busy), and the email address of the connected account, so the salon can see which account is linked. Avana cannot read the titles, names, places or contents of the salon's own events, and cannot change its own calendars. We never see Google passwords.

What we store and send to Google. We store the email address of the connected Google account, the ID of the Avana calendar and an access token, which we store encrypted. For each appointment, Avana adds the client's name, the service, the team member, the client's phone number, the salon's address and a link to the appointment in Avana to the Avana calendar. Client email addresses and notes are not sent to Google. If the setting "Busy in Google blocks Avana" is on, Avana checks when the salon is busy at the moment a client looks at available times. We do not store those times; they are held in our server's memory for a few minutes at most.

Why. Only to put the salon's appointments in its own Google Calendar and keep them up to date, and to block times when the salon is privately busy. We use what we receive from Google for nothing else: not for advertising, not to train models, and we do not sell it or share it. Avana's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. For its clients' data, the salon is the controller and we are its processor.

How long, and how to stop it. If the salon disconnects Google Calendar in Avana, we remove the Avana calendar from its Google Calendar, revoke the permission at Google and delete the token. The same happens when the salon deletes its Avana account. Access can also be withdrawn at Google, in the Google account settings.

A salon can create a calendar link in Avana to see its appointments in the calendar on its iPhone, Mac, Outlook or another calendar app. The salon adds the link to its calendar app itself; we do not share it with anyone.

Each appointment shows the client's name, the service, the team member, the salon's address and a link back to the appointment in Avana. Phone numbers, email addresses and notes are not included.

The link contains a long random key that cannot be guessed. Anyone with the link can see the appointments, so the salon keeps it to itself. A new link stops the old one working straight away. The salon's calendar app (for example from Apple or Microsoft) fetches and stores the appointments under that provider's terms. If the salon switches the link off or deletes its account, the link stops working immediately.

If a client asks a salon to delete their data, the salon does that in Avana with Delete client on the client card. If the client still has an upcoming appointment, an unfinished package or an order that has not been sent, the salon finishes that first.

What is deleted. The client card with notes, labels, address, date of birth and marketing consent, the client photo, documents the salon uploaded, treatment reports, a waitlist place, the loyalty card and entries in marketing lists.

What stays without a name. Appointments stay, without name, email address, phone number, booking note, intake answers, declaration consent or notes, so the salon's takings add up. A review keeps its rating without a name. A gift card keeps its code and balance, a package or order its payments, and a text message only the fact that it was sent. A connected Google Calendar and the calendar link update too.

What is kept. Invoices, with the details on them, because the salon must keep them by law. And an opt-out from offers, so the client never gets an offer from that salon again.

• Account and business data: while the account is active, plus 90 days after it ends, so you can ask for an export or come back.
• Client booking data: as long as the salon or studio keeps its Avana account, or shorter if it deletes the client.
• Invoices and accounting records: as long as tax law requires (seven years under Dutch law for our own records; the salon's own records follow the rules that apply to the salon).
• Security and error logs: up to 12 months.
• Contact and call-back requests: up to 24 months.
• Marketing consent: until you unsubscribe; we then remove you from the marketing list and keep a record of the opt-out.

We take appropriate technical and organisational measures to protect personal data against loss and unlawful use, including encryption in transit, encrypted storage of passwords and access tokens, role-based access, logging of admin actions and backups. No system is free of risk. If a breach happens, we follow our legal obligations, including reporting to the ICO within 72 hours where required.

We only use cookies for statistics (Google Analytics, Microsoft Clarity, PostHog) and advertising (Meta Pixel, Google Ads) if you consent. Your choice lasts 6 months, and you can change or withdraw it at any time through Cookie settings at the bottom of every page. Our cookie policy has the details.

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where we no longer need it and no legal retention applies;
• restrict how we use it, for example while a dispute is resolved;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• receive your data in a structured, machine-readable format (portability);
• withdraw consent at any time, without affecting what we did before.

To use a right, email support-nl@getavana.com. We reply within one month. To protect you, we may ask you to confirm your identity first.

Booked with a salon or studio? They are the controller of your booking data, so please contact them first; their details are in your confirmation email. If that does not work, write to us and we will help or pass your request on.

If you are unhappy with how we handle your data, please complain to us first at support-nl@getavana.com. We acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, through the ICO website or by calling 0303 123 1113.

Avana is a business tool for adults. We do not knowingly collect data from children for our own purposes. Some salons and studios have younger clients; the salon or studio is then responsible for getting a parent's or guardian's permission where needed.

We may update this policy. For material changes, such as new kinds of processing or new providers, we email account holders in advance. The latest version is always on this page.