Privacy policy

Flowesce is a salon and wellness business platform operated by Songer Technologies Pte. Ltd., a company incorporated in Singapore. Throughout this policy, "Flowesce," "we," "us," and "our" refer to Songer Technologies Pte. Ltd. trading as Flowesce. "You" refers to the person using our service, whether you are a salon owner, a member of their team, or a client of a salon that uses Flowesce.

This policy explains what information we collect, how we use it, who we share it with, and the choices you have. If anything is unclear, reach out to hello@flowesce.com.

We collect information in a few different ways.

We use the information we collect to:

• Provide, maintain, and improve the Flowesce service.
• Process bookings, send confirmations and reminders, and run the features a salon owner has set up.
• Process payments, prevent fraud, and meet our financial and tax obligations.
• Respond to questions, troubleshoot issues, and provide customer support.
• Send service-related emails (account confirmations, billing notices, security alerts) that are necessary to operate the service. These are not marketing.
• Send optional product updates to salon owners who have opted in. They can opt out at any time.
• Detect, investigate, and prevent abuse, security incidents, and violations of our Terms of Service.
• Comply with applicable law.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR:

• Performance of a contract. To create and operate your account, provide the features you use, and process payments. Without this data we cannot provide the Service.
• Legitimate interests. To secure the Service, prevent fraud and abuse, understand product usage in aggregate, and improve Flowesce. We balance these interests against your rights and rely on this basis only where your interests do not override ours.
• Consent. For optional product-update emails and, where required, for non-essential cookies and analytics. You can withdraw consent at any time without affecting processing carried out before withdrawal.
• Legal obligation. To meet our tax, accounting, and other legal duties.

Where we act as a processor on behalf of a salon (for that salon's client data), the salon is the controller and determines the legal basis for its own processing.

We do not sell personal information. We share information only with the service providers we need to run Flowesce and only to the extent they need it. Those providers are:

• Supabase (Postgres database, authentication, file storage). Hosted in the region we configure for the project.
• Vercel (application hosting, edge network).
• Stripe (subscription billing and payment processing).
• Resend (transactional and product emails).
• Twilio (text-message / SMS delivery, only for salons that turn on text messaging; see Section 13).
• Google (Google Calendar API, only for salons that connect the integration; see Section 6).
• PostHog (product analytics).
• Meta Platforms (the Meta / Facebook Pixel on our public marketing pages, for advertising measurement; see Section 7).

We may disclose information if we are required to by law, court order, or a comparable lawful request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others. If Flowesce is involved in a merger, acquisition, or sale of assets, we will notify affected users before personal information is transferred.

When a salon connects Google Calendar, Flowesce requests access to the following scopes:

• https://www.googleapis.com/auth/calendar.events. Used to create, update, and remove the connected staff's appointments on their Google Calendar so the salon owner can see appointments alongside the rest of their day. This is one-way: Flowesce writes to Google, it does not read Google events into Flowesce.
• userinfo.email. Used to confirm which Google account is connected so the salon owner can see it on the integration settings page.

Limited Use disclosure.Flowesce's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide or improve user-facing features that are prominent in the Flowesce app (writing appointments to the connected calendar).
• We do not use Google user data for advertising, and we do not transfer Google user data to third parties for advertising or any unrelated purpose.
• We do not allow humans to read Google user data unless we have obtained the salon's affirmative consent to do so for specific messages, doing so is necessary for security purposes (such as investigating abuse), or we are required to do so by law.
• The salon can revoke our access at any time by disconnecting the integration in Flowesce or via their Google account permissions page.

We use cookies and similar storage for:

• Authentication. Session cookies that keep you signed in. These are essential to the service.
• Preferences. Local storage values that remember theme, sidebar state, and similar UI preferences.
• Analytics. We use PostHog to understand how the product is used in aggregate. We route PostHog analytics through our own domain for reliability, and we do not use PostHog to track you across other websites.
• Advertising and measurement.On our public marketing pages we use the Meta (Facebook) Pixel to measure how our advertising performs and to reach people who have shown interest in Flowesce. It sets cookies and shares limited event data (such as page views and whether you joined the waitlist or signed up) with Meta, who may combine it with data they already hold. It runs on our own marketing site and app. It does not run on any salon's public booking page, online store, or website, so a salon's own customers are not tracked by it. You can opt out through your Meta ad preferences or your browser settings.

You can clear cookies or block them in your browser, but doing so may break parts of the service (in particular, signing in).

We keep account and business information for as long as the salon's workspace is active. When a salon owner cancels and asks us to delete their workspace, we delete the workspace's data within 30 days, subject to limited exceptions for backups (purged on the regular backup rotation, within 90 days) and information we are legally required to retain (such as invoices for tax purposes).

Marketing email contacts who unsubscribe are removed from the active list right away.

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, to object to certain processing, and to withdraw consent. To exercise any of these rights, email hello@flowesce.com. We will respond within a reasonable time, and at the latest within the timeframes required by applicable law.

If you are a client of a salon that uses Flowesce and want to exercise rights over the information that salon holds about you, the salon is the controller of that information. Contact the salon directly. We will support them with the request.

If you are based in Singapore, you can also contact the Personal Data Protection Commission. If you are based in the EU or UK, you can contact your local data protection authority.

We follow industry-standard practices to protect the information we hold. Passwords are hashed. OAuth refresh tokens are encrypted at rest. Network traffic is TLS-encrypted. Access to production systems is restricted and logged. No system is perfectly secure. If we become aware of a breach that affects your information, we will notify you and the relevant authorities as required by law.

Flowesce is operated from Singapore. Our service providers may be located in other regions, including the United States and the European Union. When we transfer personal information across borders, we rely on safeguards permitted by applicable law, such as standard contractual clauses where required.

Flowesce is not intended for use by children under 16. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us and we will delete it. Account holders must be at least 18 (see our Terms of Service). Regardless, we do not knowingly collect personal information from anyone under 16.

Where a salon turns it on, Flowesce can send transactional text messages (SMS) on the salon's behalf, such as appointment confirmations, reminders, cancellations, reschedules, deposit requests, and waitlist offers. We use Twilio as our messaging provider to deliver these texts.

A salon's client provides their mobile number on the salon's public booking page, and by doing so consents to receive transactional texts about that booking. Message frequency varies with the client's bookings. Message and data rates may apply. A recipient can reply STOP at any time to opt out, or HELP for help.

We do not sell or rent mobile phone numbers, and we do not share mobile information or SMS opt-in consent with third parties or affiliates for marketing or promotional purposes. Mobile information is shared only with our messaging provider (Twilio), and only to the extent needed to deliver the messages a salon has set up. Any marketing or promotional texts, where offered, require a separate opt-in and are never sent on the basis of transactional consent alone.

We may update this policy from time to time. When we make material changes, we will notify salon owners by email and update the effective date at the top of this page. Continued use of Flowesce after the change means you accept the updated policy.

We have appointed a Data Protection Officer (DPO) responsible for overseeing our compliance with the Singapore Personal Data Protection Act (PDPA) and this policy. You can contact our DPO with any question or request about your personal data:

If you are in Singapore and are not satisfied with our response, you may contact the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.