Privacy Policy

Alloura Privacy Policy

Effective date: 30 Septemeber 2026

This Privacy Policy explains how [Alloura Pty Ltd] (ABN [XX XXX XXX XXX]) ("Alloura", "we", "us") collects, uses, shares and protects personal information when you use the Alloura mobile app, the website at alloura.app and related services (the "Services"). We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and under other privacy laws where they apply to you.

1. Who this policy covers

• Stylists and salon staff who create an Alloura account ("Users").
• Salon clients whose details or photos a User adds to Alloura during a consultation ("Clients").
• Visitors to our website and people who contact us.

When a User adds Client information, the salon decides what is collected and why. We process that information on the salon's behalf to provide the Services. Salons must tell their Clients about this and get any consent the law requires, including before taking photos.

2. Information we collect

Information you give us

• Account details: name, email, phone number, salon name and address, role, and password (stored hashed).
• Client profiles: name, contact details, appointment history, hair history, colour formulas used, and notes.
• Photos: photos of a Client's current hair and inspiration images, uploaded for colour matching and AR previews.
• Health-related notes: allergies, patch test results, and scalp or skin sensitivities, if a User records them. This is sensitive information. We only collect it with consent and only to support safe colour services.
• Inventory and business data: product stock, usage, bookings and pricing.
• Messages: anything you send to our support team.

Information collected automatically

• Device and usage data: device model, operating system, app version, IP address, crash logs and feature usage.
• Camera access: the camera is used only when you start a photo capture or an AR preview.
• Cookies and similar technologies on our website. See section 9.

Information from third parties

• Meta (Facebook and Instagram): if you connect or log in with [Facebook Login / Instagram], we receive the information you allow, such as your name, profile picture, email and [Instagram account ID, username, and media you choose to import]. We use it only to log you in, connect your account, and [import inspiration images you select]. We never post on your behalf without your action. We don't sell this data or use it for advertising.
• App stores and payment providers: subscription status and transaction records. We never receive or store your full card number.

3. How we use AI

Alloura uses artificial intelligence to suggest colour formulas, generate application steps, render AR previews and make inventory suggestions.

• To do this, photos and consultation details are processed by our systems and by [AI provider(s), e.g. NAME], acting as our service provider.
• AI outputs are suggestions only. A qualified stylist decides what is applied to a Client, and should always run patch and strand tests.
• AR previews may analyse the position and shape of the face and hair in an image. This is done only to render the preview. We don't use it to identify anyone, and we don't store facial geometry after the preview. [Confirm.]
• We [do not] use Client photos or personal information to train AI models. [If you do: say so, name the lawful basis, and give an opt-out.]
• We don't make decisions about people using AI alone that have legal or similarly significant effects on them.

4. Why we use your information

• To provide, run and improve the Services.
• To create and manage accounts and subscriptions.
• To generate formulas, previews and recommendations.
• To give support and send service messages.
• To send marketing, only where you've opted in. You can unsubscribe at any time.
• For security, fraud prevention and meeting our legal obligations.

For people in the EU and UK, our lawful bases are: performing our contract with you, our legitimate interests (running and securing the Services), your consent (marketing, sensitive information), and legal obligation.

5. Who we share it with

We don't sell personal information. We share it only with:

• Service providers who help us run the Services, under contract: [cloud hosting, e.g. AWS/Google Cloud], [AI provider], [payments, e.g. Apple App Store, Google Play, Stripe], [analytics and crash reporting], and [email].
• Other members of your salon who have access to the same salon workspace.
• Meta, when you choose to use a Meta login or integration, under Meta's own terms and privacy policy.
• Authorities or advisers, where the law requires it or we need to protect rights and safety.
• A buyer or successor, if our business is sold or restructured. This policy would still apply.

6. Overseas storage and transfers

Some of our service providers store or process data outside Australia, in [United States, EU, other]. We take reasonable steps to make sure they protect it to a standard comparable to the Australian Privacy Principles, including through contracts. For EU and UK data, we use Standard Contractual Clauses or another approved mechanism.

7. How long we keep it

• Account data: while the account is active, then deleted within [30] days of closure.
• Client profiles and photos: until the User or salon deletes them, or the account closes.
• Records we must keep by law, such as tax records: for the required period, usually [7] years.
• Backups: overwritten within [30–90] days.

8. Security

We use encryption in transit (TLS) and at rest, access controls, and regular security reviews. No system is completely secure. If a data breach is likely to cause serious harm, we'll notify affected people and the OAIC under the Notifiable Data Breaches scheme.

9. Cookies and analytics

Our website uses essential cookies and [analytics tools, e.g. Google Analytics]. You can control cookies through your browser.

10. Your choices and rights

You can ask to access, correct or delete your personal information, and you can withdraw consent at any time. Depending on where you live, you may also have the right to data portability, and the right to object to or restrict processing (EU/UK), or to know, delete, correct and opt out of sale or sharing (California and other US states). We don't sell or share personal information for targeted advertising.

• In the app: Settings → Account → Delete account.
• By email: admin@alloura.app.

We'll respond within 30 days. We may need to verify your identity first. Clients should contact their salon first, and we'll help the salon respond.

Deleting your data: see our Data Deletion page at https://alloura.app/user-data-deletion. It covers removal through Facebook and Instagram settings.

11. Children

The Services are for professionals aged 18 and over. Salons must get consent from a parent or guardian before adding a Client under 18 [or under 16].

12. Complaints

Contact our Privacy Officer at [privacy@alloura.app] or [postal address]. We'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to your local data protection authority.

13. Changes

We'll post updates here and change the effective date. If we make significant changes, we'll notify you in the app or by email.

14. Contact us

[Alloura Pty Ltd] · [Address] · admin@alloura.app