Privacy Policy

Last updated August 3, 2026

English (United States)

Orya is a beauty salon management platform that helps salon owners and staff manage appointments, clients, services, payments, gift cards, and business operations. This Privacy Policy explains how Orya collects, uses, discloses, and processes personal data when you visit orya.com, create an account, book services, purchase or redeem gift cards, or otherwise use our products and services (collectively, the “Services”).

1. Scope and roles

This Privacy Policy applies to personal data processed by Orya in connection with the Services. It does not apply to third-party websites, payment processors’ standalone portals, or salon-owned practices outside the platform.

Orya serves two primary audiences: (1) business users, such as salon owners, organization administrators, and staff who manage salon operations; and (2) end clients who book services or purchase gift cards through a salon’s public booking experience.

When a salon uses Orya to manage customer appointments, gift cards, and communications, the salon is generally the controller of that customer data and Orya acts as a service provider/processor on the salon’s instructions. For account administration, platform security, billing, product improvement, and operations of orya.com, Orya may act as a controller.

This Privacy Policy describes your privacy rights in Section 4. California residents should also read Section 11.

2. Collection of personal data

We collect the categories of personal data described below. Detailed examples are listed in the tables on this page.

When you provide client, booking, or gift-card information through a salon account—or when a visitor purchases a gift card on a public salon page—you (or the salon) are responsible for ensuring you have the necessary rights, permissions, and notices to do so.

Gift-card bearer codes and delivery tokens are stored in hashed form. Recipients may receive a one-time plaintext code by email and a balance page link that uses a bearer delivery token; the public balance page does not display the full redemption code.

Category	Description
Account and identity	Information you provide when creating or managing an Orya account, such as your name, email address, phone number, password (stored by our authentication provider), profile photo, and role within a salon or organization.
Salon and business operations	Information about your salon, organization, services, staff schedules, inventory, and business configuration that you enter to operate the platform.
Client and booking records	Information about end clients who book or receive services through your salon, including contact details, appointment history, notes, preferences, and communication consent records.
Payments and billing	Payment amounts, transaction status, subscription details, gift-card purchase and refund identifiers, and limited payment-method display data (such as card brand and last four digits). Full payment credentials are processed by Stripe, not stored by Orya.
Gift cards	Stored-value gift card records created by salons or public purchasers, including purchaser and recipient contact details, optional personal messages, face value and balance metadata, masked code references, delivery-token balance links, redemption holds, and related Stripe Connect payment identifiers.
Communications	Email and SMS content, delivery metadata, and consent records for transactional messages (such as booking confirmations, gift-card delivery, and purchaser confirmations) and marketing messages where permitted.
Technical and usage	Device, browser, log, diagnostic, and security data collected automatically when you use the Services, including IP-derived signals used for rate limiting and fraud prevention.

Personal data you provide to us directly

This includes information you or your team submit when registering, configuring a salon, managing clients, or communicating through the platform.

Data category	Examples	Source	Purpose
Identity and contact	Name, email, phone number, profile photo	Account signup, profile settings, staff invitations	Authentication, account administration, support, and communications
Salon business profile	Salon name, address, phone, email, services, pricing, landing page content	Salon setup, page builder, service catalog	Operate booking, scheduling, public salon pages, and business workflows
Staff and team records	Staff role, specialties, schedules, invitation email, working hours	Salon owners and managers	Staff management, permissions, scheduling, and onboarding
Client and booking records	Client name, email, phone, appointment details, notes, SMS opt-in status	Salon staff, public booking flows, guest bookings	Appointment management, CRM, reminders, and service delivery
Gift card records	Purchaser and recipient name/email when provided, optional personal message, face value, balance and hold amounts, masked code last four digits, hashed code and delivery token, expiration snapshot, assigned client link, Stripe payment identifiers	Salon staff sell flows, public gift-card checkout, delivery and resend, redemption against bookings	Issue and activate cards, deliver codes and balance links, redeem, refund, revoke or restore stored value, and support salon reporting
Communication consent	Marketing or transactional SMS/email consent, legal text shown, audit timestamps	Salon staff actions and client opt-in choices	Compliance with messaging laws and consent audit trails
Waitlist and marketing inquiries	Full name, salon name, email, phone, referral source	Homepage waitlist or demo request forms	Product updates, onboarding outreach, and lead follow-up
Support communications	Name, contact details, message contents	Emails or support requests you send to us	Respond to inquiries and resolve issues

Personal data we receive automatically from your use of the Services

When you use Orya, we and our service providers may collect certain technical information automatically, consistent with your device or browser settings.

Data category	Examples	Source	Purpose
Device and connection	Browser type, operating system, IP address, referrer, time zone	HTTP requests, authentication sessions, security controls	Security, fraud prevention, rate limiting, and service delivery
Usage and logs	Pages viewed, actions taken, timestamps, error logs, performance traces	Application logs and diagnostic tooling	Operate, debug, secure, and improve the Services
Cookies and similar technologies	Authentication cookies, salon context, consent preferences, UI state	First-party cookies and local storage	Authentication, preferences, security, and platform functionality

3. Uses of personal data

We use personal data for the following purposes: to provide and operate the Services; create and administer accounts; process bookings, scheduling, and salon workflows; facilitate payments, subscriptions, and gift-card purchases or refunds; issue, deliver, redeem, revoke, restore, and report on gift cards; send transactional communications; provide optional AI features when enabled; prevent fraud and abuse; debug and improve reliability; comply with law; and enforce our terms.

We may use aggregated or de-identified data that does not reasonably identify an individual for analytics, product improvement, and service reliability.

Orya does not use personal data for cross-context behavioral advertising and does not sell personal information as defined by applicable U.S. state privacy laws.

4. Rights and choices

Depending on where you live and the laws that apply to you, you may have rights regarding your personal data, including the right to know, access, delete, correct, restrict, or port certain information, and to opt out of sale, sharing, or targeted advertising where applicable.

Orya does not sell personal information and does not share personal information for cross-context behavioral advertising.

To exercise privacy rights relating to booking or customer data managed by a salon, contact the salon first. For Orya account, billing, or platform-level requests, email info@orya.com with the subject line “Privacy Request”. We may verify your identity before fulfilling a request.

We will respond within the timeframe required by applicable law. If we deny a request, you may have the right to appeal by replying to our response with additional information. Orya will not discriminate against you for exercising privacy rights available to you.

You can manage cookie preferences through Cookie Settings on our website. See our Cookie Policy for details.

5. Recipients, subprocessors, and disclosures

We disclose personal data to service providers and subprocessors that help us operate the Services, such as hosting, authentication, database, optional Convex data hosting for selected domains, storage, payments, email and SMS delivery, security, rate limiting, error monitoring, and optional AI processing.

We may disclose information to salon account owners and authorized staff according to role permissions, to payment processors to complete transactions (including gift-card checkout and refunds), and in connection with corporate transactions involving Orya.

Anyone with a valid gift-card delivery-token link may view limited balance information for that card. Treat balance links as confidential; if a link is shared or leaked, the recipient of the link may see that balance information.

We may also disclose information when required by law, legal process, or governmental request, or when we believe in good faith that disclosure is reasonably necessary to protect rights, safety, and platform integrity, prevent fraud or abuse, or enforce our terms.

The table below lists key subprocessors as of the Last updated date above. We may update subprocessors from time to time.

Vendor	Purpose	Data shared	Location
Convex	Application backend, database hosting, realtime synchronization, and scheduled jobs	Account, salon, staff, client, booking, messaging, and operational records processed by platform features	Convex-managed infrastructure for the configured Orya deployment
Supabase	Authentication, database hosting, file storage, and realtime infrastructure	Account credentials and metadata, salon and client records, gift-card records when stored in the primary database, uploaded images	United States (primary hosting region per project configuration)
Convex	Optional application data platform for selected product domains when enabled for an environment	Gift-card issuance, ledger, holds, and related booking/payment metadata when the gift-cards Convex data provider is on	United States (Convex cloud regions per project configuration)
Vercel	Application hosting, serverless runtime, deployment, and AI Gateway routing	Request metadata, server logs, deployment configuration, AI feature payloads when enabled	United States and global edge locations
Stripe	Platform subscriptions, Stripe Connect payouts, client checkout payments, and gift-card purchase or refund flows	Billing contact details, payment amounts, transaction identifiers, Connect account status, gift-card checkout metadata	United States and jurisdictions where Stripe operates
Brevo	Transactional email (SMTP) and transactional or marketing SMS delivery	Recipient name, email, phone number, and message content (including gift-card delivery and purchaser confirmation emails)	European Union / United States (per Brevo processing terms)
Google	reCAPTCHA v3 (waitlist, when enabled) and Maps embeds on public booking pages	IP address, browser signals, risk score, encoded salon address in embed URLs	United States and global Google infrastructure
Upstash	Distributed rate limiting and abuse prevention	Hashed or derived identifiers from client IP or browser fingerprint (short TTL)	United States (Redis REST regions per configuration)
Sentry (self-hosted)	Error monitoring, performance tracing, and sampled session replay when enabled	Sanitized error context, stack traces, performance spans; PII redaction applied by default	United States (configured instance: sentry.aieasy.chat)
Vercel AI Gateway and model providers	AI Insights analytics summaries and package banner generation when features are enabled	Aggregated salon operational metrics for insights; package and salon marketing text for banners (no client names in default prompts)	United States and provider regions selected by gateway routing

6. Cookies and similar technologies

We and our service providers use cookies, local storage, and similar technologies to operate the Services, maintain sessions, remember preferences, and keep the platform secure. For category descriptions, cookie names, durations, and your choices, see our Cookie Policy.

Orya does not currently use third-party marketing or advertising cookies. If that changes, we will update our Cookie Policy and provide appropriate controls before activating those technologies.

7. AI and automated processing

When optional AI features are enabled, Orya may send aggregated salon operational metrics to model providers through the Vercel AI Gateway to generate insights, and may send package and salon marketing text to image models to generate promotional banners.

AI Insights is designed to use aggregate projections and instructs models not to invent client names or raw customer records. You should review AI outputs before relying on them.

Orya does not make solely automated decisions that produce legal or similarly significant effects about consumers in a manner that denies access to essential goods or services.

8. Data retention

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, complying with legal obligations, resolving disputes, and enforcing agreements.

Retention periods vary by data type, salon configuration, contractual requirements, and applicable law. Category-level retention guidance is summarized in the table on this page.

When personal data is no longer required, we and our service providers take steps to delete, anonymize, or aggregate it as permitted by law.

Data type	Retention period	Criteria
Account and profile data	For the life of the account plus a reasonable period thereafter	Needed to provide the Services, resolve disputes, and comply with legal obligations
Booking and client records	While the salon account is active, unless deleted or configured otherwise	Salon business needs, configurable retention settings where available, and legal or tax record requirements
Payment and subscription records	As required for billing, reconciliation, fraud prevention, and tax compliance	Contractual, accounting, and regulatory requirements
Gift card records and ledger	While the salon account is active and for a reasonable period thereafter for refunds, disputes, and operator reporting	Salon stored-value liability, audit trails, and applicable tax or unclaimed-property recordkeeping needs of the salon
Communication and consent logs	For the period needed to demonstrate consent and message delivery	Messaging compliance, dispute resolution, and audit obligations
Technical logs and diagnostics	Typically months, depending on system configuration	Security monitoring, troubleshooting, and service reliability
Waitlist signups	Until you unsubscribe, we remove the record, or it is no longer needed	Marketing outreach and product launch communications
Cookie consent preferences	12 months	Document and honor your cookie choices

9. Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. Measures include access controls, encryption in transit, monitoring, hashed storage of gift-card codes and delivery tokens, and vendor safeguards.

No method of transmission or storage is completely secure. We continuously work to improve our safeguards but cannot guarantee absolute security. Gift-card emails and balance links can expose personal data if forwarded or intercepted; salons should use delivery carefully.

10. International transfers

Orya is operated from the United States. When you use the Services, your personal data may be processed in the United States and other countries where we or our service providers maintain facilities.

Where required, we use contractual and legal safeguards for cross-border transfers, including service provider agreements with appropriate data protection terms.

11. Supplemental disclosures for California residents

This section supplements the Privacy Policy for California residents and should be read together with the rest of this policy. If there is a conflict, this section applies to California residents.

Categories collected, disclosed, and sold/shared: The table below summarizes categories of personal information we collect and disclose for business purposes in the preceding 12 months. We do not sell personal information and do not share it for cross-context behavioral advertising.

Sensitive personal information: We may process account credentials and payment-related information necessary to provide the Services. We use sensitive personal information only as permitted by the CPRA—for example, to provide the Services you request, ensure security, and comply with law—not for inferring characteristics for unrelated purposes.

Shine the Light: California residents may request information about certain disclosures to third parties for their direct marketing purposes. Orya does not disclose personal information to third parties for their own direct marketing purposes.

Authorized agents: You may designate an authorized agent to submit a request on your behalf. We may require proof of authorization and verify your identity directly.

Minors: The Services are not directed to children under 18, and we do not knowingly sell or share personal information of consumers under 16.

Category	Examples	Collected	Disclosed	Sold or shared
Identifiers	Name, email, phone, account ID, IP address, cookie identifiers	Yes	Yes	No
Customer records	Appointment history, client notes, salon configuration, billing contact details	Yes	Yes	No
Commercial information	Services purchased, subscription plan, transaction amounts, package or membership records, gift card purchase and balance records	Yes	Yes	No
Internet or network activity	Log data, pages viewed, diagnostic events, cookie preferences	Yes	Yes	No
Geolocation data	Approximate location derived from IP address; salon business address you provide	Yes	Yes	No
Audio, electronic, or visual information	Profile photos and uploaded salon or staff images	Yes	Yes	No
Professional or employment information	Staff role, specialties, schedules, organization membership	Yes	Yes	No
Inferences	AI-generated operational insights from aggregated salon metrics (when AI Insights is enabled)	Yes	Yes	No
Sensitive personal information	Account login credentials; payment-related data processed by Stripe; SMS opt-in records	Yes	Yes	No

12. Children

The Services are not directed to individuals under 18, and we do not knowingly collect personal data from children under 18. If you believe a child under 18 has provided personal data to us, contact info@orya.com and we will take appropriate steps to investigate and delete the information where required.

Salons are responsible for determining whether their booking practices involve minors and for providing any additional notices or consents required by law.

13. Legal bases for processing

Where applicable law requires a legal basis for processing, we rely on one or more of the following: performance of a contract with you; compliance with legal obligations; your consent where required; and our legitimate interests in operating, securing, and improving the Services, balanced against your rights.

The table below summarizes primary processing purposes, data categories, and legal bases.

Purpose	Data categories	Legal basis
Provide, maintain, and operate the Orya platform and your account	Identity, salon, booking, payment, and technical data	Performance of our contract with you; legitimate interests in operating a secure SaaS platform
Process bookings, scheduling, client management, and salon workflows	Client records, staff records, appointment data, communications	Performance of our contract; processing on behalf of salon customers where applicable
Facilitate payments, subscriptions, and Stripe Connect onboarding	Billing contact details, transaction data, Connect account identifiers	Performance of our contract; compliance with payment network and financial regulations
Issue, deliver, redeem, refund, revoke, restore, and report on salon gift cards	Purchaser and recipient contact details, personal messages, balance and hold metadata, delivery tokens, Stripe gift-card payment identifiers	Performance of our contract with the salon; processing on behalf of salon customers where applicable; legitimate interests in secure stored-value tooling
Send transactional email and SMS (confirmations, reminders, gift-card delivery, account notices)	Contact details, appointment details, gift-card delivery content, message content, consent records	Performance of our contract; consent where required for SMS; legitimate interests in service delivery
Provide optional AI features (AI Insights, package banners) when enabled	Aggregated operational metrics; package and salon marketing text	Performance of our contract; legitimate interests in product improvement with data minimization controls
Prevent fraud, abuse, and unauthorized access; enforce our terms	Identity, technical, usage, and security log data	Legitimate interests; legal obligations; vital interests where applicable
Improve reliability, debug errors, and monitor performance	Technical logs, diagnostics, sanitized error reports	Legitimate interests in maintaining a reliable and secure service
Comply with law, respond to lawful requests, and protect rights and safety	Any categories reasonably necessary to respond to the request or risk	Legal obligation; legitimate interests; vital interests where applicable

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the Last updated date at the top of this page. Where required by law, we will provide additional notice.

Your continued use of the Services after an update becomes effective means you acknowledge the revised Privacy Policy.

15. Contact information

If you have questions about this Privacy Policy or want to exercise privacy rights relating to your Orya account, contact us at info@orya.com with the subject line “Privacy Request”. Signed-in users can also open a request from Help & Support inside the Orya app, or email info@orya.com for product support.

For booking or customer records managed by a salon, contact the salon administrator first. For platform terms, see our Terms of Service.