Veladuno Beauty Data Processing Summary
Effective date: 10 August 2026 Version: 1.0
Operator and scope
Veladuno Beauty is operated by Costaru Marius Constantin, an individual / sole trader in Romania.
Address: Strada Mihai Popescu nr. 5, Bloc 29, Scara D, Apartament 8, Etaj 2, Târgoviște, Dâmbovița, Romania. Privacy contact: privacy@veladuno.com
This is a technical data-processing summary, not a bespoke data-processing agreement. Veladuno Beauty is multi-tenant salon-management software with one Veladuno Pro subscription at £19 per month and a 14-day free trial.
Processing roles
Each salon is normally the controller for customer, appointment, service and team data it enters. The operator processes that information on the salon's instructions to provide the service. The operator is controller for account administration, service security, support and its own commercial/legal records. Paddle acts under its own terms as merchant of record and controller for payment and transaction processing.
Data categories and purposes
| Category | Examples | Purpose |
|---|---|---|
| Account and access | email, Firebase Auth UID, membership role/status | sign-in, role enforcement and tenant isolation |
| Salon configuration | salon name, settings, services and team | operate the salon workspace |
| Customer records | name, phone, email and notes entered by the salon | manage salon customers |
| Appointment records | service, date/time, duration, price, deposit, status and notes | manage appointments and availability |
| Import data | uploaded client/appointment rows and import result metadata | validate and import salon records |
| Billing state | plan, trial dates, subscription status and Paddle identifiers | server-side entitlement and billing lifecycle |
| Browser storage | interface choices, selected salon, caches and snapshots | service continuity and interface behaviour |
| Operational security | technical errors, request and security records | diagnose failures and protect the service |
Technical safeguards
Firebase Authentication provides email/password sign-in. Firestore stores salon roots, memberships and operational documents. Firestore Rules enforce authenticated active membership, role boundaries, server-controlled billing fields and tenant isolation. Operational records are stamped to their salon. Browser storage cannot grant a role, activate a plan or bypass an expired trial.
Paddle webhooks are signature-verified and processed idempotently. Trusted transaction/subscription mappings bind billing events to the correct salon. The application does not store payment-card details.
Providers and locations
- Google Firebase / Google Cloud: Authentication and Firestore. Production
- Vercel: application hosting, serverless billing endpoints and operational
- Paddle: merchant-of-record checkout, payments, subscriptions, receipts,
Firestore is configured in europe-west2.
logs.
cancellations, refunds and fraud/compliance processing.
Provider subprocessors and international-transfer safeguards are governed by the applicable provider terms, DPAs and standard contractual clauses where relevant. No advertising or behavioural analytics provider is configured.
Retention and deletion
Information is retained while needed to provide the service, comply with the salon's instructions, secure the platform, resolve support or billing matters, meet accounting/legal obligations, or handle legal claims. Data is deleted or anonymised when no longer reasonably required. Provider backups and logs follow their applicable retention cycles.
Verified account, export or deletion requests may be sent to privacy@veladuno.com. Local browser information can also be cleared by the user. Requests involving salon-controlled customer data are normally directed to the relevant salon, with operator assistance where required.
Incidents and rights requests
The service uses structured operational logging without intentionally logging customer records, authentication tokens or payment secrets. Suspected privacy or security incidents and data-subject requests may be reported to privacy@veladuno.com. Identity and authority may be verified before information is disclosed or changed.