Home→ Blog→ Tools→ About→

Compare

Tavix vs Fresha→ Tavix vs Booksy→
Start your free trial

Zero booking commission · 30 days free, no card

Privacy Policy

Last updated: 9 October 2026

Home→ Blog→ Tools→ About→

Compare

Tavix vs Fresha→ Tavix vs Booksy→
Start your free trial

Zero booking commission · 30 days free, no card

Introduction

This Privacy Policy explains how Tavix (“we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use our salon booking platform at tavix.app.

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to two groups of users:

  • Salon owners (business users) who register for a Tavix account to manage their bookings and clients.
  • Clients (end users) who book appointments through a salon’s Tavix booking page.

Who We Are

Tavix (“Tavix, your AI salon assistant”) is run by Dspear Ltd, a company registered in England and Wales, company number 11924239, registered office The Long Lodge, 265–269 Kingston Road, Wimbledon, London SW19 3NW. The service is at tavix.app. We act as the data controller for data collected through tavix.app and the Tavix app.

For salon owners using Tavix to manage client bookings, the salon owner is a joint data controller for their client data. Tavix processes this data on their behalf as a data processor.

Data We Collect

Account Data

When salon owners register, we collect your name and email address. If you sign up via Google OAuth, we receive your name and email from your Google account.

Business Data

Salon owners provide business information including business name, address, services offered, pricing, staff member details, and working hours.

Booking Data

When clients book appointments, we collect appointment details, service history, and any notes added by the salon owner or client.

Contact Data

We collect phone numbers from clients for WhatsApp OTP verification and appointment notifications. Salon owners may also provide contact phone numbers.

OTP Codes

We generate and temporarily store one-time password (OTP) codes used to verify client phone numbers before booking. These codes are short-lived and automatically deleted after use or expiry.

How We Use Your Data

We use your personal data for the following purposes:

  • Providing our service: Processing bookings, managing appointments, and maintaining client records.
  • Phone verification: Sending OTP codes via WhatsApp (or SMS as fallback) to verify client identity before booking.
  • Appointment notifications: Sending booking confirmations, 24-hour and 2-hour appointment reminders, and cancellation or rescheduling alerts via WhatsApp.
  • Account management: Authentication, password resets, and account security.
  • Payment processing: Processing subscription payments from salon owners and deposit payments from clients via Stripe.
  • Service improvement: Understanding how our platform is used to improve features and user experience.

Lawful Bases

Under UK GDPR, we rely on the following lawful bases for processing your personal data:

  • Contract performance (Article 6(1)(b)): Processing bookings, managing appointments, sending booking confirmations and reminders, and providing the platform service to salon owners under our Terms of Service.
  • Legitimate interests (Article 6(1)(f)): Sending appointment notifications (reminders, cancellation alerts), fraud prevention, and platform security. We have assessed that these interests do not override your rights and freedoms.
  • Consent (Article 6(1)(a)): Non-essential cookies and any future marketing communications. You can withdraw consent at any time.

Data Processors

We share your personal data with the following third-party processors who help us deliver our service:

  • Self-hosted PostgreSQL — Our primary database is self-hosted on infrastructure we manage directly. Data is stored on servers located in the UK. We maintain full control over database security, access, and encryption.
  • Meta Cloud API (WhatsApp Business Platform) — Delivery of WhatsApp messages including OTP verification codes, booking confirmations, appointment reminders, and marketing messages such as birthday offers and re-engagement campaigns. Messages are sent via Meta’s official WhatsApp Business Platform API.
  • Twilio — Text messages (UK only) to clients who don’t use WhatsApp or prefer texts, when the salon switches them on: booking confirmations, reminders and cancellation notices. Also used for verification codes.
  • Stripe — Payment processing for salon owner subscriptions and client deposit payments. Stripe is PCI DSS Level 1 compliant. We never store card details on our servers.
  • Google (Gemini API) — Helps write the wording of follow-up, birthday and thank-you messages that salon owners send from their own phone. We only send details that don’t identify the client: the salon name, the service, how many weeks since the last visit, and any offer. The client’s name and phone number are never sent. The name is added on our own servers after the draft comes back. The salon owner reads every message before it is sent.
  • PostHog (EU hosting) — Website analytics on tavix.app: pages visited, buttons clicked and how far people scroll. Only loads if you tap “OK” on our cookie banner.
  • Google Analytics 4 (Google) — Website analytics on tavix.app. Only loads if you tap “OK” on our cookie banner.
  • Meta Pixel (Meta Platforms) — Measures whether our Facebook and Instagram ads lead to people messaging us or signing up. Only loads if you tap “OK” on our cookie banner.
  • Resend — Transactional email delivery for account-related communications including signup confirmations, password reset links, staff invitations, and billing notifications.

All processors are bound by data processing agreements and are required to handle your data in accordance with UK GDPR.

WhatsApp Communications

We use WhatsApp for notifications and marketing. WhatsApp messages are sent for the following purposes:

  • OTP verification: A one-time code to verify your phone number when making a booking.
  • Booking confirmations: Confirmation of your appointment details after booking.
  • Appointment reminders: Reminders sent 24 hours and 2 hours before your appointment.
  • Cancellation and rescheduling alerts: Notifications when an appointment is cancelled or rescheduled.
  • Marketing messages: Birthday offers, re-engagement campaigns, and review requests sent by salon owners through the Tavix platform. These are sent under the salon owner’s brand with their consent and within Meta’s WhatsApp Business Policy.

Marketing messages can be opted out of at any time by replying STOP or through the salon’s booking page. Transactional messages (booking confirmations, reminders) are essential to the service and sent under the contract performance lawful basis.

All WhatsApp messages are sent using pre-approved templates in compliance with Meta’s WhatsApp Business Policy and GDPR requirements.

Data Retention

We retain your personal data for the following periods:

  • Booking history: 6 years from the date of the appointment, in line with HMRC record-keeping requirements for business financial records.
  • OTP codes: 5 minutes from generation. Codes are automatically deleted after verification or expiry.
  • Account data: Retained for as long as your account is active. Upon account deletion, personal data is removed within 30 days, except where we are legally required to retain it (e.g., financial records).
  • Client data: Retained for as long as the salon owner’s account is active. When a salon owner deletes their account, associated client data is removed within 30 days.

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right of access: You can request a copy of the personal data we hold about you.
  • Right to rectification: You can request correction of inaccurate or incomplete personal data.
  • Right to erasure: You can request deletion of your personal data where there is no compelling reason for continued processing.
  • Right to restrict processing: You can request that we limit how we use your data in certain circumstances.
  • Right to data portability: You can request your data in a structured, commonly used, machine-readable format (CSV or JSON).
  • Right to object: You can object to processing based on legitimate interests.
  • Rights related to automated decision-making: We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects.
  • Right to withdraw consent: Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at privacy@tavix.app. We will respond within one month.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Cookies

When you first visit tavix.app, a banner asks if we can use cookies to see how people use the site. It has two buttons, “OK” and “No thanks”.

  • OK — we load PostHog, Google Analytics 4 and the Meta Pixel. They set their own cookies to measure visits, clicks and ad results.
  • No thanks — none of them load. The site works just the same.

Nothing from PostHog, Google Analytics or Meta loads before you choose. We remember your choice in your browser (tavix_consent in local storage). If you tapped OK, we also keep any campaign tags from the link you arrived on (utm_source, utm_medium, utm_campaign, utm_content) for your visit, and pass them to the app if you sign up, so we know which post or ad brought you. You can change your mind any time: open cookie settings.

Analytics and advertising cookies (only after “OK”)

  • PostHog — ph_*_posthog cookie and local storage. Website analytics. Up to 1 year.
  • Google Analytics 4 — _ga, _ga_*. Website analytics. Up to 2 years.
  • Meta Pixel — _fbp, and _fbc if you arrived from a Facebook ad. Ad measurement. Up to 90 days.

Essential cookies in the Tavix app

  • authjs.session-token — Keeps salon owners signed in and secures their account. Expires when your session ends or after the set session length.
  • authjs.csrf-token — Stops forged form submissions. Expires when your browser session ends.
  • client_session — Keeps a client signed in while booking, so they don’t have to verify their phone number again for each booking.
  • has_business — Sends signed-in owners to the right dashboard view.
  • cookie_consent — Remembers your cookie choice inside the app (“all” or “essential”). Expires after 1 year.

The essential app cookies are needed for the app to work. They don’t track you across other websites and aren’t used for advertising.

Children’s Privacy

Tavix is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child under 16, please contact us at privacy@tavix.app and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make material changes, we will notify registered salon owners by email and update the “Last updated” date at the top of this page.

We encourage you to review this policy periodically to stay informed about how we protect your data.

Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

  • Email: privacy@tavix.app
  • Post: Dspear Ltd, The Long Lodge, 265–269 Kingston Road, Wimbledon, London SW19 3NW