Privacy Policy
Last updated:
Effective from:
Privacy Policy
Dolls Coiffure | Peluquería y Spa respects your privacy and protects the personal data processed through this website, our booking system and our WhatsApp.
This policy describes what data we collect, why we collect it, how long we keep it and how you can exercise your rights under Paraguayan Law Nº 7,593/2025 on Personal Data Protection. This English version is provided as a courtesy — the Spanish text prevails.
Data controller
The data controller is Dolls Coiffure | Peluquería y Spa, located at Av. La Victoria c/ Adolfo Alsina, San Lorenzo, Paraguay.
For privacy questions or to exercise your ARCO+ rights, email [email protected] or message WhatsApp at +595 991 628-222. We respond in writing within 30 calendar days.
Data we collect
When you accept cookies we collect web analytics data via Google Analytics 4 (GA4): pseudonymous cookie ID, approximate city derived from IP (the IP itself is not stored), device type, browser, pages visited, referrer source and interaction events.
We also store a consent flag in browser localStorage under the key dc_consent_v1 — this contains no personal data, just the state of your choice (accepted or rejected) and the update timestamp.
When you book on the site, we keep the form data: your name, your WhatsApp number, any notes you leave us, the services, day, time and stylist you choose, and whether you agreed to receive promotions. From that we build your client record in our salon management system, where the salon also records your visit history and may add details such as your birthday or notes about your services.
When you message us on WhatsApp, your messages go through Meta's WhatsApp Business Platform and arrive in the message inbox of our salon management system, where we keep the text of each message, your number and the date. When the salon connects its number to that platform, it can also import that number's earlier conversations (history sharing). Meta may also send the contacts saved in the salon's WhatsApp Business app, but our system does not keep them. Inside the system, only team members with the Administrator (the owner) or Manager role can read that inbox; the Staff role has no access. In addition, whoever runs our server for the salon has access to the database where those messages are kept.
If you accept cookies we also use Microsoft Clarity for heatmaps and session recordings with pseudonymous identifiers (never before you accept). If you later withdraw consent we send Microsoft the denial signal, which ends the Clarity session, clears its cookies and leaves it in a limited cookieless mode.
Purposes of processing
We use the aggregated data to understand which services resonate, improve the site experience and prioritise content.
We use your booking, contact and message data to manage your appointments, confirm them, remind you of them and reply to you.
We do not profile individuals and we do not make automated decisions that produce legal effects. We do not sell or share data with third parties for marketing purposes.
Legal basis
The legal basis for processing analytics cookies is prior, freely given, informed and unambiguous consent from the visitor (Art. 3 Law Nº 7,593/2025).
We process your booking data with the consent you give by ticking the box on the booking form, to manage the appointment you ask for.
We process the messages you send us on WhatsApp, including earlier ones we import when we connect our number, to reply to you and manage your appointments.
The WhatsApp link relies on the legitimate interest of facilitating the communication that the visitor voluntarily initiates when tapping the button.
Retention periods
GA4 is configured with a 2-month data retention — the minimum allowed by Google.
The consent flag in localStorage persists until you manually clear it, revoke it via the footer "Cookie settings" link or change device or browser.
The WhatsApp messages we handle — both those you send us and the chat history we import from our own number — are kept on our servers for as long as they remain necessary for appointment management and accountability. They are not deleted automatically after a fixed period: deletion is always manual and is recorded (who did it and when). You can request deletion of your messages at any time by exercising your ARCO+ rights (see below). Contact information (phone number) and conversation metadata (status, dates) are retained on the same basis for appointment management.
Your booking data and client record (name, phone, notes and visit history) are kept for as long as we need them to manage your appointments; they are not deleted automatically after a fixed period either. You can ask us to delete them by emailing [email protected] or messaging WhatsApp at +595 991 628-222.
Recipients and data processors
We rely on the following processors:
- Google LLC (Google Analytics 4) — aggregated traffic analytics; country: USA; safeguards: standard contractual clauses and Google Data Processing Terms. - Microsoft Corporation (Microsoft Clarity) — heatmaps and session recordings with pseudonymous identifiers to improve usability; active only if you accept cookies; if you withdraw consent the denial signal is sent, which ends the session, clears its cookies and leaves Clarity in a limited cookieless mode; country: USA; safeguards: Microsoft Products and Services Data Protection Addendum and sensitive-content masking. - Hostinger (hostinger.com) — a private server we run for the salon, hosting this website, the salon management system and its database (bookings, client records and WhatsApp messages); country: United Kingdom; safeguards: HTTPS encryption, system access only through authorised staff sign-in, and direct server access only for whoever runs it technically for the salon. - Cloudflare, Inc. — DNS and protection for the website and the salon management system: traffic passes through its network, encrypted with HTTPS, before it reaches our server; country: USA (global network). - Supabase Inc. (supabase.com) — sign-in for salon staff; server in São Paulo, Brazil. It also holds a copy, not updated since 11 September 2026, of the database the salon management system used before it moved to our server (client names, phone numbers, birthdays, notes and visit history). Safeguards: TLS encryption in transit and encryption at rest. - Resend (resend.com) — sending the system's emails to salon staff, such as invitations and account access; country: USA. - Behold Inc. (once the Instagram feed ships) — proxy for public Instagram content; country: USA; safeguards: public data, no visitor PII. - OpenAI (openai.com) processes the recent text and the summary of your WhatsApp conversation, together with the service and booking data needed, to generate our virtual assistant's replies; country: United States. - Meta Platforms (WhatsApp, Instagram, Facebook) — WhatsApp messages with the salon go through Meta's WhatsApp Business Platform and arrive in our salon management system; what you share on Instagram or Facebook after tapping those links stays on those platforms; country: USA.
International transfers
Your data is stored outside Paraguay: our server is in the United Kingdom, staff sign-in is in Brazil and the other processors operate primarily in the United States. We rely on each vendor's contractual clauses plus equivalent technical safeguards (encryption in transit, access controls) to ensure an adequate level of protection.
We do not carry out additional transfers beyond this framework.
ARCO+ rights
You can exercise the following rights at any time: Access to your data, Rectification of inaccurate data, Cancellation or deletion, Objection to processing, Portability of the data, Revocation of previously granted consent and the right not to be subject to automated decisions.
To exercise them, email [email protected] or message WhatsApp at +595 991 628-222. We respond in writing within 30 calendar days. Exercising these rights is free of charge.
Minors
Our in-salon services are intended for adults; minors must be accompanied by a responsible adult. This website does not collect personal data directly from minors.
If a parent or guardian notices a minor interacted with the site and wishes to delete any trace, please email [email protected] so we can process the deletion.
Security
The website and the salon management system are served entirely over HTTPS; the website also has HSTS enabled. Analytics data lives inside Google's infrastructure and the consent flag lives on the visitor's browser.
Our internal salon management system keeps client data (name, phone, birthday, notes, visit history and WhatsApp messages) in a database on our private server (Hostinger, United Kingdom). Using the system requires signing in, and what each team member can see depends on their role: Administrator (the owner) and Manager see client records and the WhatsApp inbox; the Staff role sees only her own schedule and the clients she serves. Outside the system, only whoever runs our server for the salon can access the database directly.
Any future addition will trigger a prior update to this policy.
Changes to this policy
We may update this policy to reflect legal, technical or operational changes. The "Last updated" date at the bottom indicates when the most recent change was made.
For substantive changes, we will post a visible notice on the home page for at least 30 days before the change takes effect.
Update of 26 September 2026: this version was not announced on the home page 30 days in advance, because it describes changes that were already under way. What changed: since 11 September 2026 the salon management system's data has been kept on our private server (Hostinger, United Kingdom), and Supabase is used only for staff sign-in and the copy described above that is no longer updated; the website now runs on that server too; and WhatsApp messages arrive in our salon management system's inbox from the day the salon connects its number to Meta's WhatsApp Business Platform. We also corrected the previous version, which said we did not collect data through forms: the booking form already kept the data described in this policy. The "Effective from" date is the date of the first version of this policy.
Update of 28 September 2026: before enabling the virtual assistant for a controlled test, we added OpenAI as a recipient of recent WhatsApp conversation text and summaries and the service and booking data needed to reply. We publish this notice before testing with the founder's phone; automated replies to other clients are not enabled at this stage.
Supervisory authority
You may file complaints with the competent supervisory authority once the National Personal Data Protection Agency envisioned by Law Nº 7,593/2025 becomes operational.
In the meantime, contact us directly — we want to resolve any concern promptly.
Contact
For any question, complaint or rights request, email [email protected] or message WhatsApp at +595 991 628-222.
You can also visit us at Av. La Victoria c/ Adolfo Alsina, San Lorenzo, Paraguay, Monday to Saturday from 13:00 to 20:00.