Privacy policy

Who we are

Meet Marley is a trade name of Spine HQ.

Read this part first: which one are you?

Meet Marley is used by two different groups, and your rights depend on which you are.

You booked an appointment at a salon

For your booking and your client record, the salon is responsible — not us. They decide what to record about you and why. We run the software and act on their instructions: in legal terms they are the controller and we are the processor.

So to see, correct or delete what a salon holds about you, ask the salon. If you cannot reach them, email [email protected] and we will carry it out — see §6.

But for some things we are responsible ourselves, because we decide them and no salon instructs us to:

• Our salon directory and search. We list salons that have opted in, so people can find them.
• Reviews we publish. We decide they appear as "Jane D." rather than your full name, how they are moderated, and how long they stay up.
• Our security logs, and statistics about how the product is used.
• How long things are kept. The periods in §5 are set by us. A salon cannot lengthen or shorten them, so how long your record survives is our decision rather than theirs — even though it is the salon that decided to record it in the first place.

For those, come to us — [email protected] — and we will handle it directly. You never have to work out which of us to ask: write to either, and it gets dealt with.

You work at a salon and use Meet Marley

For your own account — your name, email address, sign-in history — we are responsible. That is what most of this statement covers.

1. What we collect

1.1 If you book an appointment

Recorded by the salon through our software:

• Name; email address and telephone number, if you give them
• Your appointment history: date, time, service, staff member, status, price and any tip
• Preferred language
• Notes the salon writes about you — free text, entirely their choice of content
• Any review you leave: rating, comment, and your name as shown at the time

1.2 If you have a Meet Marley account

• Email address and password (stored only as an irreversible BCrypt hash — we cannot see it)
• Your name, and a profile picture if you upload one
• Preferred language and notification settings
• Sign-in security data: failed attempt count and temporary lockouts
• Your salon's business and billing details

1.3 Everyone

• Security log: each significant action, with who performed it, when, from which IP address and browser, and whether it succeeded. Entries cannot be altered after the fact — the database itself refuses it — and they are removed only by the scheduled retention sweep, on the timetable in §5.
• Technical error reports if something breaks, via Sentry (EU).

2. Why, and on what legal basis

3. Who receives your data

All personal data is stored in the European Union. Cloudflare handles traffic at its global edge, covered by their data protection terms and the EU Standard Contractual Clauses. Browser push works the same way: the notification is delivered through whichever service your browser maker runs, which is not an EU service, but nothing is stored there — it passes through.

Our own staff, when a salon needs help. People at Meet Marley can work inside a salon's account to set it up or to look into a problem — as themselves, never signed in as the salon. Most of that work reaches only the salon's own settings, not client records; reaching client records takes a separate, deliberate step. Every action is written to a log the salon can read in its own account and which we cannot edit or delete.

We do not sell your data, do not use it for advertising, and do not use it to train AI models.

We removed Google Fonts on 3 August 2026. Until then our stylesheet loaded a typeface from Google's servers, which meant your IP address reached Google on every page load. It no longer does. We mention it because you have a right to know who has received your data, not only who receives it now.

4. Analytics — what we deliberately do not do

On our public website and booking pages we use Cloudflare Web Analytics. It sets no cookie, no identifier, and no fingerprint. We can see that a page was viewed; we cannot see that you viewed it, and we cannot recognise you on a return visit.

This is why you are not asked to accept cookies. There is nothing to accept.

Inside Meet Marley Studio — the password-protected app used by salon staff — we use PostHog, hosted in the EU, restricted so that:

• Session recording is off. We never record or replay what is on your screen.
• Autocapture is off. We do not automatically log clicks or typing.
• No individual is identified. We never link usage to a named account. Statistics are grouped by salon, not by person.
• IP addresses are discarded before events are stored.
• Record identifiers are stripped from page addresses before they are sent.

We chose this arrangement over conventional analytics on purpose. It tells us less. It also means we do not have to ask a client booking a haircut to agree to being tracked.

5. How long we keep things

About those backups. When something is deleted or anonymised, it goes from our live systems straight away. Backups are a separate thing, and they keep a copy until they expire on the schedule above. Most people picture a backup as covering about a week, and for two of the four rows that is right. But we also keep weekly and monthly snapshots, so the real answer to "when is it actually gone" is months, not days.

During that time the copy is never searched, never looked at, and never used to bring one record back; it exists only in case we have to recover from a disaster, and if we ever do, we re-apply the deletion afterwards. We tell you the longer number because it is the true one.

6. Your rights

You have the right to access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time.

If you booked at a salon: address these to the salon — legally they decide, not us. If you cannot reach them, email [email protected]. We will pass it on, and where the salon cannot act themselves we will carry out the request on their behalf within 5 working days.

How this works today. Salons do not yet have a self-service screen for client records, so we carry these requests out ourselves on the salon's instruction — within 5 working days, at no charge, and with no limit on what can be removed. A record can be erased completely, including any notes written about you. A self-service screen is in development; the outcome and the deadline are the same either way.

What erasure means in practice. Your data is removed from our live systems immediately. Backups keep a copy until they expire on a fixed schedule, during which they are never searched or used to look anything up, and if we ever restore one we re-apply the erasure afterwards. Every system that keeps disaster-recovery backups works this way.

If you have a Meet Marley account: change your details in the app, or email us. Account deletion is currently handled by us on request.

You may complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would rather you told us first.

7. Salon profiles and reviews

Salons can choose to appear in our public directory. It is off by default.

When a salon is listed, its public profile shows staff first and last names, job titles and profile photos. If you work at a listed salon and would rather not appear, tell your salon owner — and tell us, because we will help.

Published reviews show an abbreviated name ("Jane D."), never a full name, email address or telephone number.

8. Security

Passwords are hashed with BCrypt. Sessions are short-lived and rotate. Accounts lock after repeated failed sign-ins. Every significant action is written to a tamper-evident log — entries cannot be rewritten after the fact — and each salon's data is isolated from every other salon's at the database level.

If a data breach occurs that is likely to affect you, we will notify the Autoriteit Persoonsgegevens within 72 hours and tell you directly where the law requires it.

9. Children

Meet Marley is not directed at children under 16. If a salon books an appointment for a minor, the salon is responsible for having the appropriate consent.

10. Changes

We will post any change here and update the date at the top. If a change is significant, we will tell account holders by email.