Contract first
Before a service provider processes any data, a data processing agreement under Article 28 GDPR is in place.
Trust centre
Who works on behalf of Saloncare.
Saloncare processes the data of your salon and your guests itself, but uses carefully selected service providers for clearly defined tasks. This page lists those subprocessors, with the purpose and place of processing, so you always know who sees which part.
The term
What a subprocessor is.
A subprocessor is a service provider that Saloncare, as a processor, engages in order to operate the platform. It processes personal data solely on our instructions, within the scope of the relevant purpose and on the basis of a data processing agreement under Article 28 GDPR.
We select subprocessors against three standards: technical suitability, a demonstrable level of data protection, and a place of processing within the European Union wherever the task allows. Where processing outside the EU remains necessary, we secure it through the European Commission's standard contractual clauses and supplementary measures.
Overview
The service providers in use.
The table below shows who takes on which task and where the processing takes place. The list is maintained; it is an example listing and will be confirmed finally before the production launch.
| Provider | Purpose | Place of processing |
|---|---|---|
| Cloudflare | Hosting, delivery of the website and the platform, database (D1), protection against attacks | Data centres in Germany and the EU; contractual binding of processing to EU locations is being sought |
| Google (Generative Language API) | Language understanding for the assistant Sam; processing of the requests put to Sam | EU where available; otherwise secured through standard contractual clauses |
| Email delivery | Transactional messages such as demo confirmations and onboarding notes | To be named before the production launch |
| Error and operations monitoring | Detection of incidents, stability and security of operations | Cloudflare, Inc., EU and USA; secured through standard contractual clauses |
| Payment processing | Billing of the plans; card details remain with the payment provider | To be named before paid plans launch |
Service providers that are still open are marked as such and will be named once they are contractually bound.
Context
Sam and your data.
The assistant Sam answers questions about your salon and prepares decisions. For language understanding Sam draws on a service from Google. Only what is required for the particular request reaches that service; permanent business data, client records and formulas stay in the database in Germany.
Sam makes no decisions about people and does not rate guests. Sam orders, calculates and suggests; the decision stays with you and your team.
- Only the content required for a request leaves the platform.
- Master data, client records and formulas stay in the database in Germany.
- No automated decision with legal effect concerning individuals.
- You can activate or suspend the use of Sam per salon.
Selection
How we vet a service provider.
Location before convenience
We prefer places of processing inside the EU. Processing outside is secured through standard contractual clauses.
Data minimisation
A service provider receives only the data its task requires, not the whole set of records.
A documented list
Every subprocessor is listed here, with purpose and location. Anything not on the list processes no data on our behalf.
Changes
Current state and notice.
This list has a date and is maintained. If we add or replace a subprocessor, we update this page and inform affected customers in good time before the change, as a rule through the contact address on file.
If you wish to object to a planned change, contact us before the effective date; we will look for a solution together within the frame of the contract.
This page is current as of 11 June 2026. Questions about subprocessors go to datenschutz@salon.care.
Questions
Frequently asked questions.
Is my salon data transferred abroad?
Master data, client records and formulas sit in the database in Germany. Individual tasks, such as Sam's language understanding, can run through service providers; where processing outside the EU is necessary, we secure it through the European Commission's standard contractual clauses.
Does Cloudflare see the content of my data?
Cloudflare operates the servers and the database Saloncare runs on. Processing takes place on our instructions and on the basis of a data processing agreement. Transmission and storage are encrypted.
What goes to Google when Sam is used?
Only what a specific request requires reaches the language service. Permanent business data stays in the database in Germany. Sam makes no decision about individuals.
Can I object to the use of a subprocessor?
We inform you in advance of a planned change. If you wish to object, get in touch before the effective date; we will look for a solution together that complies with the contract.
How will I learn about changes to this list?
We update this page and notify affected customers in good time through the contact address on file, before a change takes effect.
Why are there still placeholders in the table?
Saloncare is in formation. Service providers for email delivery, operations monitoring and payment will be contractually bound before the production launch and named here then.
Who do I address data protection questions to?
Write to datenschutz@salon.care. We reply within the statutory deadlines and provide the data processing agreement on request.
The world's best salons run on Saloncare®.
GDPR compliantEncryptedServers in GermanyAudit ready