Privacy Policy

Who we are

Hayven is provided by Nguyener Marketing LLC (“Hayven,” “we,” “us”). We make software for nail salons: online booking, a calendar and turn tracker for the front desk, client profiles, appointment texts and emails, and marketing tools such as bio pages, promotion pages, and campaign texts. Our team also sets up Hayven for salons and can run parts of their marketing for them.

This policy explains what information we handle, why, and the choices you have. It covers:

• our website, hayven.ai, including the demo request form;
• the Hayven app that salon owners and staff sign in to, on the web (app.hayven.ai) and as the Hayven mobile app for iPhone and Android;
• the booking, check-in, bio, and promotion pages we host for salons (for example, booking.hayven.ai/your-salon, clients.hayven.ai, and your-salon.hayven.salon); and
• the texts and emails we send for salons and for ourselves.

Two different roles

• For salon clients’ information, the salon is in charge. When you book with a salon that uses Hayven, the salon decides how your information is used, and we process it as the salon’s service provider. The salon’s own privacy policy also applies to you. For requests about your information, the salon is the best place to start, and we’ll help it respond.
• For everyone else, Hayven is responsible. That includes salon owners and staff who use the app and anyone who asks us for a demo.

Information we collect

From salon owners and their teams

• Account details: name, email address, mobile number, role, and sign-in information. Sign-in is handled by our authentication provider, Clerk.
• Salon details: business name, address, hours, services, prices, staff schedules, photos, logo, brand color, and the settings you choose.
• Connected accounts: if you connect Google Business Profile, Facebook, or Instagram, we store the access those services grant us (kept encrypted) and the information we need from them, such as your reviews or comments on your posts. See Facebook and Instagram data for details.
• Business registration details that US carriers require before a salon can send texts (A2P 10DLC registration), such as legal business name, tax ID, and a business contact.
• Support conversations with our team.

From salon clients, on behalf of salons

• Contact details: name, mobile number, and email address.
• Appointments: services, add-ons, technician, date and time, and group bookings. When someone books for a group, they may give us the names of the people they’re booking for.
• Client history the salon keeps: past visits, purchases, gift cards, and notes the salon writes, such as a favorite color or technician.
• Messages exchanged with the salon by text.
• Consent records: what you agreed to (for example, appointment texts or promotional texts), when, and how, plus any opt-outs.

From demo requests on hayven.ai

When you ask for a demo, we collect your name, salon name, mobile number, email (optional), city and state, current POS (optional), team size, and preferred language. We also record your consent to be contacted, the exact wording you agreed to, and the time, along with your IP address, browser type, the page you were on, the referring page, and any campaign tags in the link. We also record where your visit to hayven.ai started (the page or link that brought you and any campaign tags) and the hayven.ai pages you viewed before sending, with the time on each. Ad click codes are never kept, only which kind of ad was clicked. If your browser sends a Do Not Track or Global Privacy Control signal, we keep where the visit started but not the pages you viewed.

From salon marketing pages

Salons can publish bio and promotion pages with Hayven. When you fill in a form on one of those pages, the salon receives your name, mobile number, email (if asked), the offer you chose, and your consent choices. If the salon has connected a Meta (Facebook) Pixel, see Cookies and similar technologies.

From the Hayven mobile app

The mobile app is for salon owners and staff. It shows the same salon information as the web app and collects a few things of its own:

• Notification tokens. If you allow notifications, your phone gives the app a token that lets us send alerts (new bookings, arrivals, client texts, and similar) to that phone through Expo, Apple, and Google. When you sign out or delete your account, the phone stops getting alerts right away and we delete the token (if the phone is offline at that moment, as soon as Apple or Google report that the token no longer works).
• Crash and error reports. When the app crashes or hits an error, it sends a report to Sentry with the app version, phone model, and system version. Reports never include names, phone numbers, email addresses, or messages, and they identify you only by a scrambled (hashed) account ID. Reports are kept for a limited time and then deleted.
• Usage data. The app records which screens and features are used, with the same scrambled account ID, your role (owner or staff), and how many salons you belong to, and sends it to PostHog so we can improve the app. It never includes names, phone numbers, or messages. You can turn this off at any time in the app under More › Share usage data. Usage data is kept for a limited time and then deleted.
• Photos and camera. The app opens your camera or photo library only when you choose a photo to send to a client, and only that photo is uploaded.
• Face ID and fingerprint. If you turn on App lock, your phone checks your face or fingerprint itself. Hayven never receives biometric data.
• Saved data on your phone. The app keeps a copy of recent salon information on your phone, encrypted, so it opens quickly. It’s removed when you sign out.

The mobile app has no ads, and it doesn’t track you across other companies’ apps or websites.

Collected automatically

Our servers record basic technical information when you use our pages: IP address, browser and device type, pages visited, the referring page, and the time. We use it to run, secure, and fix the service. hayven.ai does not use advertising or analytics cookies.

On hayven.ai we also count visits with PostHog, to learn which pages help salon owners decide: the pages viewed and for how long, the page or link that brought you (including campaign tags in the link), which links to our pages you click, and whether a demo request was sent. PostHog receives your IP address and your browser and device type with these counts; the IP address can show an approximate location. Ad click codes in a link (such as Facebook’s or Google’s) are hidden before anything is sent. The counts never include your name, phone number, email, or anything you type in a form. Each count also notes where the visit started (the kind of source, such as a search engine or an AI assistant, the referring site, and campaign tags). To keep one visit together, PostHog stores a random visit ID and where the visit started in your browser’s session storage, which your browser clears when you close the tab; it uses no cookies. If your browser sends a Do Not Track or Global Privacy Control signal, hayven.ai doesn’t count your visit.

How we use information

• To run Hayven: take bookings, keep salon calendars and turn lists, and send the confirmations, reminders, and other messages salons set up.
• To set up and support salons. With the salon’s permission, our team signs in to its account to configure services, pages, and messages, and to help when something isn’t working.
• To deliver marketing services a salon asks us for, such as building its pages or campaigns. We use that salon’s information only for that salon.
• To follow up on demo requests, by phone, text, or email, in the language you chose.
• To keep Hayven safe: prevent spam and abuse on public forms (including bot checks and rate limits), protect accounts, and investigate problems.
• To improve Hayven, using usage patterns and aggregated information that doesn’t identify any salon client.
• To tell salon owners about their account and about Hayven updates. You can opt out of non-essential updates at any time.
• To comply with the law and enforce our Terms of Service.

We never use a salon’s client information to market Hayven, or to help any other salon.

AI features. Some Hayven features use AI services from other companies. They process the information to provide the feature to us.

• Phone assistant (Retell AI). If a salon turns on the phone assistant, calls the salon doesn’t pick up are answered by an AI voice assistant run by Retell AI. It hears the call and receives the caller’s phone number and the salon details it needs to help (services, hours, open times). It can book an appointment for the caller, and the call’s transcript and summary are saved for the salon.
• Google Gemini. Hayven uses Gemini to transcribe and summarize voicemails left for a salon; to draft replies to the salon’s Google reviews (using the review and the reviewer’s public name); to write Google Business Profile posts and descriptions; to read a service menu or flyer the salon uploads; to check photos for the salon’s Google Business Profile; and to suggest wording when the salon uses “Rewrite with AI” on its marketing pages.

The Hayven mobile app shows the results of these features but doesn’t send anything to an AI service itself.

Text messages (SMS)

Texts we send for salons

When a salon uses Hayven, we send texts from the salon’s own number and in its name. Depending on the salon’s settings, these can include appointment confirmations, reminders, and changes; check-in and “your technician is ready” updates; a request for a review after a visit; replies in a conversation with the salon; and, only if you agreed to them, promotional texts from the salon. The salon is responsible for collecting any permission the law requires before texting you. Salon staff may also get texts about their own appointments if their salon turns this on.

Texts we send for Hayven

If you request a demo and agree to be contacted, we’ll call or text you about your demo. If you’re a salon owner, our team may also call or text you about your account and support.

Your choices and our commitments

• Message frequency varies. Msg & data rates may apply.
• Reply STOP to any text to stop getting texts from that number. Reply HELP for help, or contact us at (866) 970-6888.
• Consent to texts is never a condition of buying anything.
• Carriers are not liable for delayed or undelivered messages.
• We do not sell, rent, or share mobile numbers or SMS opt-in consent with third parties or affiliates for their marketing purposes. Mobile information is shared only with the service providers that deliver our messages (such as Twilio), and only to deliver them. Text messaging opt-in data and consent are excluded from every other kind of sharing described in this policy and will not be shared with any third parties.

Facebook and Instagram data

This section covers two features a salon can turn on after connecting its Facebook Page and Instagram account:

• Comment → DM, which lets a salon automatically reply to people who comment a keyword (for example “ME”) on the salon’s own Facebook or Instagram posts; and
• Facebook and Instagram messages, which shows messages people send to the salon’s Page or Instagram account in the salon’s Hayven inbox, so salon staff can read and answer them.

What we receive

When a salon connects its Facebook Page and linked Instagram business account to Hayven, we receive, through Meta’s APIs and only for that Page and account:

• the Page’s and Instagram account’s id, name, username, and profile picture;
• the salon’s posts (caption, image, and link); and
• comments on the posts the salon chooses for an automation; and
• messages people send to the Page or Instagram account (text, photos, and files), the replies the salon sends, and the name or Instagram username of each person who writes, as Meta provides it.

How we use it

When a comment contains the salon’s keyword, Hayven posts one of the salon’s public replies under it (and, if the salon turns this on, likes the comment on Facebook). Hayven then sends the commenter one private reply, using Meta’s Private Replies feature, with the salon’s message and link buttons (for example, “Book now”). We never message anyone who didn’t comment the keyword, and we send at most one private reply per person for each automation.

For each matching comment, we store the commenter’s Meta-scoped id, public name or username, and the comment text in the salon’s activity log, so the salon can see what was sent. We use this data only to post the salon’s public reply, send the one private reply the salon set up, and show the salon its results. We don’t sell it or use it for advertising. When the salon also uses Facebook and Instagram messages, the private reply is kept in the salon’s inbox as an automated message, so the salon sees the conversation if the person answers. A commenter becomes one of the salon’s clients only if they tap a button and fill in the salon’s form themselves, or if salon staff choose to save them as a client.

When messages are delivered to the salon’s Hayven inbox, we store each person’s Meta-scoped id, their name or Instagram username, and the messages, photos, and files they exchange with the salon, so salon staff can read and reply to them. Every reply is written by a salon staff member, and Hayven sends replies only to people who have written to the salon, within the time Meta allows. We never send promotional or bulk messages through Facebook or Instagram. We use this data only to run the salon’s inbox; we don’t sell it, use it for advertising, or share it with other salons. Profile pictures of people who write are not stored.

How long we keep it

Commenter names and comment text in the Comment → DM activity log are deleted automatically 180 days after the comment. Facebook and Instagram messages are kept as the salon’s customer records, like its text messages, until the person or the salon asks us to delete them, or as described in How long we keep information. Access tokens are stored encrypted, and are deleted when the salon disconnects.

Your choices and deletion

• Salons can pause or archive an automation, or disconnect Facebook and Instagram, at any time in Hayven.
• Anyone who connected Hayven with Facebook can remove Hayven in Facebook › Settings › Business integrations. We then stop all activity for the Pages they connected. They can also ask Facebook to delete their data from Hayven. We then delete the connection and its access tokens, and Facebook shows a confirmation code.
• Commenters can ask the salon, or email us at support@hayven.ai, to delete their comment data sooner.
• People who message a salon on Facebook or Instagram can ask the salon, or email us at support@hayven.ai, to delete their messages and contact details from the salon’s Hayven inbox.

How we share information

We don’t sell personal information, and Hayven doesn’t share it for its own advertising. We share information only in these cases:

• With the salon. Your booking, form, and message details go to the salon you’re dealing with.
• With service providers that run parts of Hayven for us, listed below. They may use the information only to provide their service to us.
• With services a salon connects, at the salon’s direction, such as Google Business Profile or Meta.
• For legal reasons, when required by law or to protect the rights, safety, and property of Hayven, salons, their clients, or others.
• In a business transfer, such as a merger or sale of the company, where this policy continues to protect the information.
• With your permission, in any other case.

Service providers

These companies process information for us. We list only services Hayven actually uses.

Cookies and similar technologies

• hayven.ai uses no advertising or analytics cookies. Your browser’s storage remembers small things, such as an announcement you closed, and helps prevent a demo request from being sent twice. Session storage, cleared when you close the tab, also holds a random visit ID for our visit counts and a short record of where your visit started and the pages you viewed, which is sent to us only if you request a demo (see From demo requests on hayven.ai and Collected automatically). Browsers used by the Hayven team keep a flag so our own visits are left out of the counts; visitors never get it. Cloudflare Turnstile checks that a demo request comes from a person, and it may use cookies or similar technology to do that.
• The Hayven app uses the cookies it needs to keep you signed in. The mobile app uses no cookies; see From the Hayven mobile app for what it stores and sends.
• Salon marketing pages may use a Meta Pixel if the salon turns one on. The Pixel lets Meta record visits and actions on that page so the salon can measure its ads, under the salon’s choice and Meta’s own policies. When a salon uses this feature, we also report bookings and sign-ups to Meta directly from our servers, with contact details scrambled (hashed) first, along with the visitor’s IP address, browser details, and Meta’s click identifiers. You can manage ad preferences in your Facebook or Instagram settings.

hayven.ai itself sets no advertising cookies and sends nothing to ad platforms, so there’s nothing to opt out of there.

How long we keep information

• Salon accounts and salon client information: while the salon’s account is active. After a salon cancels, we keep its information for a limited time so the salon can return or ask for a copy, then delete it or remove what identifies people, unless the law requires us to keep it longer.
• Demo requests: as long as we need them to follow up and keep business records.
• Consent and opt-out records: as long as we may need them to show that a message was allowed, including after an account closes.
• Server logs and backups are overwritten on a rolling schedule.
• hayven.ai visit counts are kept for a limited time and then deleted.

How we protect information

• All traffic to Hayven uses encrypted connections (HTTPS).
• Salon owners control what each staff member can see and do.
• Keys for connected services (such as Google, Meta, and Twilio) are stored encrypted.
• Public forms are protected by bot checks and rate limits.

No system is perfectly secure. If a breach affects your information, we’ll notify affected salons and people as the law requires.

Your privacy rights

Wherever you live, you can ask us to:

• tell you what information we have about you and give you a copy;
• correct information that’s wrong;
• delete your information (salon owners and staff can also delete their account in the app); and
• stop marketing texts or emails (reply STOP to a text, or use the unsubscribe link in an email).

If you’re a salon client, your information is controlled by the salon. We’ll forward your request to the salon, or help the salon respond. Some information may be kept where the law requires it, such as records of consent.

California residents

The California Consumer Privacy Act (as amended by the CPRA) gives California residents the rights above, plus the right to know how we collect, use, and disclose personal information, and the right not to be treated differently for using these rights.

• Categories we collect: identifiers (name, phone, email, IP address); customer records (appointments, purchases, notes); commercial information (services booked); internet activity (pages visited on our sites); approximate location from IP address; and professional information about salons and their teams. The sources and purposes are described above.
• Sensitive information: account sign-in details (handled by Clerk) are used only to provide the service, never to infer anything about you.
• Sale and sharing: Hayven has not sold personal information in the past 12 months, and doesn’t share it for its own advertising. When a salon turns on Meta ad measurement for its own marketing pages, visit and sign-up information from those pages goes to Meta at the salon’s direction, and the salon’s privacy choices apply. We don’t knowingly sell or share information about anyone under 16.

Residents of other states with privacy laws, such as Colorado, Connecticut, Oregon, Texas, and Virginia, have similar rights, and we honor them the same way.

How to make a request

Email support@hayven.ai or call or text (866) 970-6888. We’ll confirm your identity before acting, usually by checking details we already have. You can use an authorized agent, and we may ask for proof that you gave them permission. We respond within 45 days. If we turn down your request, you can ask us to reconsider by replying to our answer.

Children

Hayven is a service for businesses and isn’t directed to children under 13. We don’t knowingly collect information from children under 13. A salon may keep an appointment for a child when a parent or guardian books it, and that information is handled like any other salon client information. If you believe a child has given us information directly, contact us and we’ll delete it.

Users outside the United States

Hayven is built for salons in the United States, and we process information in the United States. If you use Hayven from another country, your information will be transferred to and processed in the United States.

Changes to this policy

When we change this policy, we’ll update the “Last updated” date at the top. If a change is significant, we’ll also tell salon owners by email or in the app before it takes effect.

Contact us

Nguyener Marketing LLC
408 Anthony Road
King of Prussia, PA 19406

Email: support@hayven.ai
Call or text: (866) 970-6888