Privacy Policy

Effective Date: July 7, 2026  ·  Last Updated: July 7, 2026

1. Who This Policy Covers

This Privacy Policy describes how Maravoa ("Maravoa," "we," "us," or "our") collects, uses, and discloses information in connection with our salon management software platform (the "Service"). This Policy applies to two distinct groups of people, described separately below because the data relationship is different for each:

• Customers — the salon and beauty-industry businesses (and their staff) who subscribe to and directly use Maravoa.
• End Clients — the clients of those salon businesses, whose personal information (name, phone number, appointment history, etc.) is entered into Maravoa by a Customer in the course of running their business. End Clients do not have a direct account relationship with Maravoa and typically have not interacted with Maravoa directly — their relationship is with the salon (the Customer).

2. Information We Collect

From Customers (salon businesses and their staff):

• Account information: name, email, phone number, password
• Business information: business name, address, hours, tax ID (where applicable for billing/tax features)
• Payment information: processed directly by Stripe; Maravoa does not store full payment card numbers
• Usage data: how you interact with the Service

From or About End Clients (on behalf of Customers):

• Contact information: name, phone number, email, address, birthday
• Appointment history: services booked, dates, times, assigned stylist
• Service-related notes: color formulas, style preferences, visit notes entered by salon staff
• Photos, where a Customer chooses to upload them (e.g., color card photos) or where an End Client sends them to the salon by text message (e.g., inspiration photos). Photos are stored as part of the salon's service records for the relevant client and appointment. Salon staff confirm they have permission to store client photos before uploading. Photos are hosted by our image-storage provider (Cloudinary) at unlisted, hard-to-guess web addresses; they are not published or listed publicly, but anyone in possession of a photo's exact address can load it.

3. How We Use Information

We use the information described above to:

• Provide, operate, and maintain the Service
• Process subscription payments
• Send transactional communications, including appointment-related SMS messages sent on a Customer's behalf to their End Clients (see Section 5)
• Provide customer support
• Improve and develop the Service
• Comply with legal obligations

We do not sell personal information to third parties, and we do not use End Client data for our own marketing purposes.

4. How We Share Information

We share information with:

• Service providers who help us operate the Service, including:
  • Stripe (payment processing)
  • Vonage (SMS messaging)
  • Cloudinary (image storage)
  • Cloudflare (DNS, email routing)
  • Railway (hosting infrastructure)
  • Zoho (email hosting)
• Other Customers: never. Maravoa's multi-tenant architecture logically separates each Customer's data; no Customer can access another Customer's data through the Service.
• Legal requirements: we may disclose information if required by law, subpoena, or to protect the rights, property, or safety of Maravoa, our Customers, or others.

5. SMS / Text Messaging Practices

• Maravoa sends transactional, appointment-related text messages (confirmations, reminders, cancellation/reschedule notices, waitlist openings) to End Clients on behalf of the Customer (salon) they have a service relationship with.
• These messages are limited to appointment-related purposes. Maravoa does not send marketing or promotional text messages to End Clients.
• Mobile phone numbers and SMS opt-in consent are not shared with third parties or affiliates for marketing or promotional purposes.
• Message and data rates may apply. End Clients may reply STOP at any time to opt out of future messages, or HELP for assistance.

6. Data Retention

We retain Customer Data and End Client data for as long as the Customer's account remains active, and for thirty (30) days after account closure to allow for data export, as described in our Terms of Service.

7. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children.

9. Your Rights and Choices

• Customers may access, update, or delete their account information through account settings, or by contacting us.
• End Clients who wish to access, correct, or delete their personal information should contact the salon (Customer) they have a direct relationship with, as Maravoa processes this data on the Customer's behalf. End Clients may also contact us directly at [email protected] and we will coordinate with the relevant Customer.

10. Cookies and Tracking (maravoa.com landing page and demo)

Our public landing page and interactive demo use first-party cookies for basic site functionality, first-touch attribution, and anonymous measurement. We assign a random, short-lived session identifier and store only its one-way SHA-256 digest. We use it to understand landing pages, page sequences, visible active time, scroll milestones, and interactions with signup and demo links.

When you use the interactive demo at demo.maravoa.com, we anonymously record that the demo loaded, which approved feature and workflow categories you opened (for example calendar, booking, or reports), and browser-reported active demo time. This helps us evaluate whether the demo is useful and whether it leads toward signup. We do not record names, emails, form values, appointment or client data, payment data, screen recordings, replay, raw IP addresses, raw browser user-agent strings, device fingerprints, precise location, or advertising profiles.

This landing-page and demo measurement does not store names, email addresses, IP addresses, raw browser user-agent strings, form contents, or device fingerprints. Raw anonymous session, event, and activity records are retained for no more than ninety (90) days. Aggregated daily counts may be retained longer. We do not use this information for advertising or remarketing.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice at least fourteen (14) days before taking effect.

12. Contact Us

Questions about this Privacy Policy may be directed to [email protected].