Privacy policy

1. Who we are

CONRAD & THOMAS LTD, trading as EnqLayer, is a company registered in Scotland, company number SC889156. Its registered office is 27 Hyndlee Drive, Glasgow, Scotland, G52 2DQ, United Kingdom.

Email: hello@enqlayer.com. Use it for any question about this policy or about your data.

This policy covers EnqLayer Salon: the owner app, the booking websites and client apps that we run for salons, and this website. Our main website, enqlayer.com, has its own privacy policy.

We handle personal data in line with the UK GDPR and the Data Protection Act 2018. Where the EU GDPR applies to people in Poland, we follow that too.

2. Our roles

• A salon owner or a member of a salon’s team

  What we do

  We run your account, give you support, bill the salon and keep the service secure.

  Our role

  Controller. We decide how your details are used.

• A client of a salon

  What we do

  We run the salon’s booking website, client app and owner app. We store your request, the salon’s replies and your visit records for the salon.

  Our role

  Processor. The salon decides how your details are used and we act on its instructions.

  Who to ask

  Ask the salon first. If you write to us instead, we tell you who is responsible and pass your request to the salon.

• A visitor to this website, or someone who writes to us

  What we do

  We show you the website, keep it secure and answer your message.

  Our role

  Controller. We decide how your details are used.

Where we are the processor, we act only on the salon’s instructions. Before we process a salon’s clients’ data, we agree a data processing agreement with the salon that sets out what we may do with it. We do not use that data for our own purposes, we do not sell it and we do not use it to train AI models.

3. What we collect and why

Where we are the processor, the salon decides why its clients’ data is used and on what legal basis.

• Salon owners and team members

  What we hold

  • Your name, email address and role in the salon’s workspace (the salon’s own space in EnqLayer Salon).
  • Your sign-in. Our sign-in provider holds it for us, and the app does not store your password.
  • A record of what you approve in the app, such as a confirmed visit or a message, with who did it and when.
  • Your choices about AI features, if you use them.
  • Your language and appearance settings, saved on your device.

  Why

  To set up and run your account, show who confirmed what, keep the service secure and, where a salon pays us, keep billing and tax records.

  Legal basis

  Contract. For people who work for a salon, our legitimate interests in running the service for the salon. Legal obligation for billing and tax records.

• Clients of a salon (we are the processor)

  What we hold

  • Your name and your phone number or email address.
  • The treatment, day and time you asked for, your note and a reference number.
  • Messages between you and the salon.
  • Visit records: confirmed visits and the history of past visits in the salon’s client list.

  Why

  So the salon can answer your request, run its diary and keep its client list. The salon decides.

  Good to know

  • The booking form needs your name and a phone number or email address. Without them the salon cannot answer you.
  • EnqLayer Salon does not ask for health information. Please do not put health details in notes or messages.

• Visitors and people who write to us

  What we hold

  • When you open this website, our hosting provider receives your IP address and the details of your request, as any web host does.
  • If you email us, we receive your email address, your name if you give it, and your message.

  Why

  To show you the website securely and to answer you.

  Legal basis

  Our legitimate interests in keeping the website secure. Steps you ask for before a contract, and our legitimate interests, when we answer you.

• Technical data, for everyone

  What we hold

  • A scrambled (hashed) form of your network address. It limits abuse of the booking function and of the website assistant.
  • Server and security logs at our hosting providers.

  Why

  To stop abuse and keep the service reliable.

  Legal basis

  Our legitimate interests.

4. On your device and on this website

• The owner app keeps on your device your sign-in session, the workspace you chose, your language and appearance choices, and the salon’s colours and logo.
• The owner app does not ask for access to your location, camera, microphone, photos or contacts. It has no advertising, analytics or crash-reporting tools.
• The web version of the owner app loads fonts from Google Fonts and its sign-in library from jsDelivr each time it starts. The client app and the salons’ booking websites load fonts from Google Fonts. Your IP address and browser details reach those companies. Google says its font service sets no cookies and does not use the data to profile people or target adverts. jsDelivr says its service uses no cookies.
• The client app keeps on your phone the reference number, status and date of up to 25 of your requests, each for up to 120 days, and your language choice. It does not keep your name, phone number, email address or note.
• To remove them, choose “Remove from this phone” under My visits in the client app.
• This website sets no cookies, uses no analytics and loads nothing from other companies. Its fonts are hosted by us.

5. Optional AI features

Some features of the web version of EnqLayer Salon use an AI provider. They are off unless they are switched on for the salon.

• Reply drafts in the web version of the owner app

  How it works

  • Before the first use, the owner agrees on a permission screen that names the provider and the data. We then send the enquiry, the conversation so far, the salon’s business information and, where used, attachment information, the previous draft and the owner’s edit instruction to Anthropic. Anthropic writes the draft.
  • If the owner switches on drafts for the whole workspace, drafts can start by themselves, even while the app is closed.

  Withdrawing

  You can withdraw this permission at any time by writing to hello@enqlayer.com. Withdrawing stops future use. It cannot take back data that was already sent.

  Human check

  A person at the salon reads and approves the exact text before an AI-drafted reply is sent to a client. AI can make mistakes, which is why a person checks every draft.

• Assistant on a salon’s website

  How it works

  • If the assistant is switched on for a salon’s website, what a visitor types is sent to Anthropic. Anthropic writes the answer from the salon’s published information.
  • Questions about health, complaints and discounts get a fixed reply and are not sent. We do not store the chat, and our logs hold only counts, codes and timings.

  Please note

  The permission screen of the app is not used for the assistant. Please do not type health details or other personal details, such as a name or phone number, into it.

• What the AI provider says

  Anthropic

  • Anthropic says in its published terms for API customers that it deletes inputs and outputs within 30 days. It keeps them longer in some cases, for example where the customer has agreed otherwise, where it needs them to enforce its usage policy (up to 2 years, and safety scores up to 7 years) or where the law requires it.
  • It says it does not use API customers’ chats to train its models unless the customer joins a programme for that. We read these terms on 18 October 2026.

Nothing is decided by AI alone. A person at the salon confirms every visit request.

6. Who receives data

These companies process personal data for us.

• Supabase

  What it does

  Runs our database, sign-in, file storage and server functions.

  Data

  Everything stored in the service.

  Where

  Our database is in London, United Kingdom.

• Cloudflare

  What it does

  Hosts our websites and apps and filters out abuse.

  Data

  Visitors’ IP addresses and request data.

  Where

  The company is based in the United States.

• Resend

  What it does

  Sends the emails that the service sends, for example the replies a salon approves.

  Data

  Recipient address, subject and message text.

  Where

  The company, Plus Five Five, Inc., is based in the United States.

• Anthropic

  What it does

  Provides the AI features described in section 5, only when they are switched on for a salon.

  Data

  What is described in section 5.

• Google (Workspace)

  What it does

  Hosts our support mailbox.

  Data

  The emails you send us.

• Google Fonts and jsDelivr

  What they do

  Deliver fonts (Google Fonts) and a sign-in library (jsDelivr) to the web version of the owner app, and fonts to the client app and the booking websites.

  Data

  Your IP address and browser details, when your device loads a file.

We use AI-based operations tools built on Anthropic and OpenAI models to help run the service. They are instructed to work only with test data and configuration and not to open personal data. We do not yet log each administrative action.

7. Where data is held

Our database is in London. Our server functions run in the region closest to the person calling them. For people in the UK and Poland that is usually London, Ireland or Frankfurt, but it can be a region elsewhere in the world, for example in the United States, if the person is there.

Some of the companies listed in section 6 are based in the United States, and Supabase Pte. Ltd. is based in Singapore. The data processing terms of Supabase, Cloudflare, Resend and Anthropic include standard contractual clauses with the UK Addendum. We read these terms on 18 October 2026. To get a copy of these safeguards, write to hello@enqlayer.com.

Data about people in Poland reaches us in the UK under the European Commission’s adequacy decisions for the UK. They were renewed on 19 December 2025 and last until 27 December 2031.

8. How long we keep data

We keep personal data for as long as we need it for the purpose it was collected for, to meet legal duties or to deal with disputes. Some records have their own rules:

• Booking requests, messages, visit records and calendar records stay in the salon’s workspace while the salon uses EnqLayer Salon. When a salon stops, the owner can ask us to delete them (section 10).
• Approval records and records of messages already sent are kept by design: our database does not allow them to be changed or deleted.
• Records of the AI permissions a user gave are kept as an audit trail while the user’s account exists.
• Account details stay while the account is open.
• The client app keeps request references on the phone for up to 120 days, or until the client removes them.
• A calendar link works until the owner turns it off.
• Billing and tax records are kept for as long as the law requires.
• Emails you send us stay in our support mailbox for as long as we need them to deal with your message.
• Server and security logs and backups at our providers are deleted or overwritten on the providers’ own schedules.
• What our AI provider keeps is described in section 5.

9. Your rights

You can ask to see your data, to correct it, to have it deleted, to limit or object to its use, and to receive a portable copy. Where we rely on your consent, you can withdraw it.

For the data of a salon’s clients, ask the salon: it is responsible. If you write to us instead, we tell you who is responsible and pass your request to the salon.

For data we are responsible for, such as your account, write to hello@enqlayer.com. We may ask you to prove who you are, so that we do not give your data to the wrong person.

We answer within one month. If your request is complex or you made several, we can take up to two more months, and we tell you why within the first month. The month starts when we have your request and any proof of identity we asked for.

It is normally free.

10. Deleting your data and account

There is no delete button in the owner app. To ask us to delete your account or a salon’s data, email hello@enqlayer.com. Our page Delete your account says what we delete, what we keep and what happens next.

Records of approvals and of messages already sent cannot be deleted (see section 8). Other actions in the app, such as cancelling a visit, creating a calendar link or inviting a colleague, are also tied to the sign-in that did them. For this reason we cannot currently promise to remove the account of a person who has confirmed or cancelled a visit, approved a message, created a calendar link or invited a colleague.

Clients of a salon: ask the salon to delete your booking details.

11. Security

• All calls from the apps and websites use HTTPS.
• You sign in with your email address and password through our sign-in provider. The app does not store your password.
• Calls from the owner app to our servers are refused unless a member of the salon’s workspace is signed in.
• The booking function and the website assistant limit how many requests they accept and how big each one can be.
• A calendar link works like a password: whoever has it can read the visits it shows. It is shown once, and the owner can turn it off at any time.
• No system is perfectly secure. If a breach affects the data of a salon’s clients, we tell the salon without undue delay.

12. Children

EnqLayer Salon is for businesses and adults. We do not knowingly collect children’s data for our own purposes. A salon may take bookings from clients under 18. The salon decides whether to do so and what consent it needs.

13. Changes to this policy

We may update this policy as the service changes. When we do, we change the date at the top. For material changes we email salon owners.

14. Complaints and contact

Tell us first at hello@enqlayer.com. We acknowledge a complaint within 30 days, deal with it without undue delay and tell you the outcome.

You can also complain to the UK data protection regulator, the Information Commission (the ICO), at ico.org.uk. In Poland you can complain to the President of the Personal Data Protection Office (UODO) at uodo.gov.pl. A client of a salon should usually start with the salon.

CONRAD & THOMAS LTD (EnqLayer) · 27 Hyndlee Drive, Glasgow, Scotland, G52 2DQ · hello@enqlayer.com · company number SC889156