Privacy Policy

Appricot ("appricot", "we", "us") is a talent business platform that connects customers with independent beauty professionals ("Talents") and the shops and salons they work with ("Shops"). The platform includes our mobile application, our web administration portal, and our website at appricot.ca (together, the "Services").

The Services are owned and operated by Capital Link Technologies Limited, a company based in Mississauga, Ontario, Canada. We are committed to protecting your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy laws, including Canada's Anti-Spam Legislation (CASL).

This policy explains what information we collect, why we collect it, how we use and share it, where it is stored, and the rights and choices you have. It applies to everyone who uses the Services — Customers, Talents, and Shop owners or managers.

1. Information We Collect

1.1 Information you provide to us

Account and profile information. When you register we collect the details needed to create your account:

• Customers — name, username and password, phone number, email address, and optionally a gender and profile photo. You may also save a home location to personalize nearby-shop discovery.
• Talents (professionals) — name, gender, phone number, portrait photo, a short introduction, languages spoken (ranked by proficiency), and work schedule.
• Shops — shop name, street address, business telephone number, map location, opening hours, photos and logo, services offered with prices, and staff membership.

Passwords are stored only in protected (hashed) form; we never store or see your plain-text password. Each account also receives a short public ID code that you can choose to share so others can find or add you.

Bookings. When a booking is made we collect the date and time, selected services, assigned or requested Talent, price, promotion codes applied, and any notes. Shops and Talents may attach before/after photos or videos to a booking to document the work performed.

Messages, reviews, and posts. We collect the messages you exchange with Shops and Talents through the in-app messaging feature, reviews you leave, posts Talents publish, and the shops or professionals you mark as favourites.

Consent decisions. Talents control whether a Shop can see their personal details. When a Shop invites a Talent, the Talent's portrait, phone number, and gender remain hidden from that Shop until the Talent expressly grants consent in the app. We record these consent decisions (granted, declined, or pending).

1.2 Information collected when you use the Services

Location. With your permission, the mobile app uses your device's location to show nearby Shops and calculate distances. Location use is optional — if you decline, discovery falls back to a saved or default city-centre location. We do not track your location in the background.

Technical and usage information. We collect the information needed to operate the Services securely: authentication tokens, app version, and request and security logs (such as IP address and timestamps).

Device features that stay on your device. If you enable biometric unlock (fingerprint or face), the biometric data is processed entirely by your device's operating system — it is never transmitted to or stored by us. QR codes used to link Talents to Shops are time-limited and contain only a platform identifier.

Payment information. We do not collect or process payment card information. Prices shown on the platform are informational; payment is settled directly between you and the Shop or Talent.

1.3 Information from other sources

Publicly available business listings. To help customers discover salons and barbershops, we may create business listings using publicly available business information (business name, address, business telephone number, and location). These listings contain business contact information only — no personal accounts are activated for them, and their logins remain disabled unless the business owner claims the listing. If you own a listed business and would like it corrected or removed, contact us at the address in Section 11.

2. How We Use Your Information

We use personal information for the following purposes, identified at or before the time of collection:

• Provide the Services — create and manage accounts; display Shop and Talent profiles to Customers; process bookings, schedules, and calendars; deliver in-app messages; show promotions and posts.
• Discovery — show nearby Shops sorted by distance from your chosen location, with filters for services, price, and distance.
• Trust and verification — display a "Verified" badge on claimed businesses; operate the Talent consent and verification flow; distinguish pre-listed businesses from active ones.
• Communications — send service messages related to your account and bookings (for example booking confirmations and in-app notifications). Any marketing messages will only be sent in compliance with CASL, with your consent and with a working unsubscribe mechanism.
• Safety and security — authenticate users, prevent fraud and abuse, restrict API access to authorized clients, and keep audit records.
• Support and improvement — respond to enquiries, diagnose problems, and improve features. Our interface translations are machine-generated from our own interface text; we do not send your personal content for translation.
• Legal compliance — meet our legal and regulatory obligations.

We do not sell personal information, and we do not use your personal information for third-party advertising.

3. Consent

We collect, use, and disclose personal information with your consent, or as permitted or required by law. Consent may be express (for example, a Talent tapping "grant consent" to share their profile with a Shop; granting the app location permission) or implied where the purpose is obvious and reasonable (for example, using the phone number you provide to identify your booking).

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice — for example, a Talent may decline or revoke a Shop's access to their details, and you may disable location permission in your device settings. Withdrawing consent may limit the features we can provide.

4. How We Share Information

With other users, as the Services are designed to work:

• Shop profiles (name, address, phone, photos, services, prices, opening hours, languages) are visible to Customers browsing the platform.
• Talent profiles are visible to Customers, and to a Shop only after the Talent grants consent.
• Booking details are shared between the parties to the booking — the Customer, the Shop, and the assigned Talent.
• Messages are shared with the account you send them to. Reviews and posts are visible to platform users.

With service providers who process data on our behalf under contractual safeguards, including:

• cloud hosting and database providers (located in the United States);
• media storage providers for uploaded photos and videos (United States / global network); and
• mapping and address services, which are provided by Google Maps Platform — your use of in-app maps is also subject to the Google Terms of Service and Google Privacy Policy.

For legal reasons. We may disclose information where required or permitted by law — for example in response to a court order, subpoena, or other lawful demand by Canadian authorities, or where necessary to protect the safety of any person or the integrity of the Services.

Business transfers. If Capital Link Technologies Limited is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy's protections.

5. Where Your Information Is Stored

Our Services are hosted with cloud providers located in the United States, and uploaded media is stored with a global cloud storage provider. This means your personal information may be stored and processed outside Canada, and while it is outside Canada it may be subject to lawful access by the courts, law enforcement, and national-security authorities of the foreign jurisdiction.

We use contractual and technical safeguards with our providers to ensure a comparable level of protection. By using the Services, you acknowledge this cross-border transfer. Questions about our cross-border practices may be directed to our Privacy Officer (Section 11).

6. How Long We Keep Information

• Account information is kept while your account is active. If you ask us to close your account, we delete or de-identify your information within a reasonable period, except where retention is required (for example, records of completed transactions).
• Bookings and business records are retained while the related accounts are active, to preserve booking history for the parties involved.
• Media you remove (for example a booking photo you delete) is removed from display immediately and purged from storage on our routine schedule.
• Pre-listed business data (Section 1.3) is retained while it remains publicly available or until the business asks us to remove it.

7. How We Protect Information

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:

• encryption of data in transit (TLS/HTTPS);
• password hashing (we never store plain-text passwords);
• role-based access — Customers, Talents, Shop staff, and administrators each see only what their role permits;
• consent-gating of Talent personal details from Shops; and
• technical access controls, security monitoring, and activity logging appropriate to the sensitivity of the records.

No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required by PIPEDA.

8. Your Rights and Choices

Subject to limited exceptions under PIPEDA, you have the right to:

• Access the personal information we hold about you and ask how it has been used and disclosed;
• Correct inaccurate or incomplete information — most profile details can be edited directly in the app;
• Withdraw consent as described in Section 3;
• Close your account and request deletion of your information;
• Control location access at any time in your device settings; and
• Opt out of marketing messages (service messages about your bookings and account will still be sent).

To exercise any of these rights, use the in-app profile settings or contact our Privacy Officer (Section 11). We will respond within the time required by law (normally 30 days) and will not charge you for reasonable access requests.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (1-800-282-1376, www.priv.gc.ca).

9. Children

The Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from them. If you believe a minor has provided us personal information, please contact us and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will post the updated policy here with a new "Last updated" date and, where the change significantly affects how we handle personal information already collected, we will notify you through the Services and seek any consent required.

11. Contact Us

We are accountable for personal information under our control and have designated a Privacy Officer responsible for compliance with this policy and with PIPEDA.