Privacy Policy

Last updated: 1 October 2026

This page explains which of your data we process, why, for how long and who else sees it. It covers our website minusplus.company, online booking and the customer area with Salma (salma.hairdressing.school), the AI assistant Salma, and your visit to our salons. The German version is the binding one.

1. Who is responsible

minusplus GmbH
Kirchengasse 22, 1070 Vienna, Austria
Company register: FN 662687 s, Commercial Court Vienna
Managing director: Hannes Trummer
Email: [email protected] · Phone: +43 1 9569549

For any privacy question or request (access, erasure, etc.), please write to [email protected] with the subject “Privacy”. We are not required to appoint a data protection officer and have not appointed one.

The salon in Taborstraße (MONO Hairstudio) is a franchise partner run by a separate company. It uses its own booking system (Phorest). That operator is responsible for the salon and for bookings there; its privacy policy applies.

2. The short version

• Google Analytics, Google Ads and the Meta Pixel only run on our website if you agree in the cookie banner. Without your consent none of them is loaded.
• To book, we need your name, email and phone number. Everything else is optional.
• Salma is an AI. She answers questions and prepares bookings. Nothing is booked, moved or cancelled until you confirm the specific offer. You can ask for a human from our team at any time.
• We only remember what matters for your haircut, colour and advice. We do not store health data such as allergies.
• We do not sell data.
• You can delete your customer account yourself at any time.

3. Visiting our website

What: When you open minusplus.company, our hosting provider Cloudflare processes technically necessary data: IP address, date and time, page requested, browser and device. Without this data the site cannot be delivered or protected against attacks.

Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Fonts and images are served from our own server, not loaded from Google or other providers.

Analytics and ad measurement, only with consent: If you agree in the cookie banner, we use the following services on minusplus.company:

• Google Analytics 4 (Google Ireland Ltd., Dublin): shows us how our website is used, for example which pages are viewed, for how long and on which type of device. We only receive aggregated reports, no names. The IP address is not stored.
• Google Ads conversion tracking (Google Ireland Ltd.): measures whether someone comes via one of our Google ads and then starts a booking.
• Meta Pixel (Meta Platforms Ireland Ltd., Dublin): measures whether our ads on Instagram and Facebook work, and lets us show ads there again to visitors of our website.

These services set cookies (section 15) and send data about your visit to Google or Meta: page views, time, device, browser, approximate location and an online identifier. Google and Meta may also process this data in the USA (section 13). For the Meta Pixel we are joint controllers with Meta (Art. 26 GDPR) as far as collection and transfer are concerned. What Meta does with the data afterwards is Meta's sole responsibility.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). You can withdraw or change it at any time via the “Cookie settings” link at the bottom of every page. Declining is as easy as accepting and has no disadvantages. Online booking (Salma) uses neither Google Analytics nor the Meta Pixel.

Links to other providers: The website links to Google Maps, Instagram, hairdressing.school and the Phorest booking system. These sites only open when you click the link. From then on, that provider's privacy policy applies.

4. Online booking and customer account (Salma)

We run our online booking and customer area ourselves with our software Salma at salma.hairdressing.school. On the website, booking is embedded via booking.minusplus.company.

Which data:

• Required: name, email address, phone number, chosen salon, service, stylist and appointment.
• Optional: notes on your appointment, hair type, preferred products, special requests and a profile picture.
• Automatic: appointment and status history (booked, moved, cancelled), price, the reason for any cancellation, browser identifier, language and time zone.
• If you come via one of our ads: the campaign identifier from the link (utm parameters; for Meta ads, the click ID “fbclid”). See section 8.

Purpose: to schedule, confirm and carry out your appointment, to reach you about changes, and to show your bookings in your account.

Legal basis: contract or pre-contractual steps (Art. 6(1)(b) GDPR). Without your name and contact details we cannot give you an appointment.

Customer account: With an account you can see and change your appointments and message the salon. You can delete the account yourself at any time under “My profile → Delete account”. We then delete:

• your profile data,
• the stored AI notes (section 5),
• your messages, which are redacted.

Future appointments are cancelled. Past appointments are anonymised unless we must keep them for invoices (section 14).

Appointment emails: We send confirmations, changes and reminders by email. This is part of performing the appointment (Art. 6(1)(b) GDPR).

5. Customer card and preferences

So that we can advise you well on your next visit, we keep a customer card, like every salon. It only contains what matters for cut, colour, care and advice. We do not store health data such as allergies. If you have, for example, an intolerance to hair dye, please tell the salon directly.

It contains:

• past appointments and services,
• your favourite stylist,
• notes from our team,
• roughly how often you come.

Salma can suggest short notes based on your bookings and messages, for example “likes short hair”. Each note is labelled with its source: stated by you, entered by the team, or derived by the AI.

Legal basis: our legitimate interest in good, personal advice (Art. 6(1)(f) GDPR).

You can object at any time. We then delete the notes and stop keeping them. The customer card is never used for decisions that have legal or similarly significant effects on you, for example on prices or on whether you may book.

6. The AI assistant Salma

Salma is an artificial intelligence, not a human. She answers questions on our website (chat.minusplus.company), in online booking, in the customer account and by email. AI answers can contain mistakes. Prices and appointments are only binding once they appear in the booking confirmation.

What Salma may do:

• answer questions,
• look for free slots,
• prepare a booking, change or cancellation.

Nothing is carried out until you confirm the specific offer. If Salma cannot help, or if you ask, she hands over to our team, which receives a short summary of the conversation. Salma does not take decisions within the meaning of Art. 22 GDPR.

Which data: your messages, the conversation history and, if you are logged in, your appointments. In the website chat we store a random visitor ID in your browser so the conversation is not lost. Before using the chat you confirm that you have read this information. We store that confirmation with time and IP address as proof.

AI providers: To generate answers, we send your messages and the conversation history to our AI gateway EUrouter (EUrouter B.V., Amsterdam, Netherlands). EUrouter forwards them to AI models that run exclusively on servers in the EU. Your input is not stored there and not used for training. For the AI, your data does not leave the EU.

To search our public information (prices, services, opening hours), texts are converted into numeric vectors (“embeddings”), also via EUrouter in the EU.

Legal basis: contract or pre-contractual steps where your appointment is concerned (Art. 6(1)(b) GDPR). Otherwise, our legitimate interest in answering enquiries quickly around the clock (Art. 6(1)(f) GDPR).

Please do not enter health data, payment details or passwords in the chat. Salma does not remember health data.

We delete website chat histories after 90 days, and chat histories in the customer account 12 months after the last message.

7. Messages, reminders and reviews

• Reminder for your next appointment: Only if you switch it on in your profile (Art. 6(1)(a) GDPR). When we remind you depends on how often you have come so far. You can unsubscribe via the link in every email or in your profile.
• News and offers from minusplus: Only with your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). You can withdraw it at any time.
• Feedback after your appointment: After your visit we send you a short email asking for a rating. The basis is our legitimate interest in quality assurance (Art. 6(1)(f) GDPR); you can object at any time. Your rating is seen by the salon management and the stylist concerned. For very good ratings we show you a link to Google Reviews. Whether you write anything there is up to you. Google's privacy policy applies on Google.
• Loyalty code: If you come regularly, you receive a loyalty code. For this we count your appointments.

8. Advertising on Instagram and Facebook

We run ads on Instagram and Facebook (Meta Platforms Ireland Ltd., Dublin). On the website we use the Meta Pixel for this, only with your consent (section 3). There is no Meta Pixel in online booking.

If you reach online booking via one of our ads and confirm an appointment, we report this booking to Meta via the Meta Conversions API. This lets us measure whether an ad leads to bookings. We report:

• your email address, made unreadable (hashed) before transfer,
• the ad click ID,
• the browser identifier,
• the time.

Legal basis: our legitimate interest in measuring the effect of our advertising and spending our ad budget sensibly (Art. 6(1)(f) GDPR). Only bookings that come via an ad link are reported. You can object at any time, informally by email to [email protected]; we then stop reporting your bookings. Meta may also process the data in the USA (see section 13).

Our Instagram profile: For the statistics on our Instagram profile, we are joint controllers with Meta (Art. 26 GDPR). You can also exercise your rights directly with Meta.

9. In the salon: till and card payment

When you pay in the salon, our cash register records:

• the service,
• the amount,
• the payment method,
• the staff member who took the payment.

This is required by law (Art. 6(1)(c) GDPR in conjunction with §§ 131, 131b and 132 of the Austrian Federal Fiscal Code, BAO). We keep receipts for seven years.

Card payment: Card payments are processed by SumUp, which handles your card data as an independent controller. We do not see or store your card number.

Accounting: For accounting and tax purposes we pass receipts to our accounting software and our tax advisers.

10. Contact by email, phone or message

When you write to or call us, we process your details to handle your request. The legal basis is Art. 6(1)(b) GDPR where it concerns an appointment or order, otherwise Art. 6(1)(f) GDPR.

Salma may answer emails sent to her (section 6). We delete correspondence six months after your matter is closed, unless it belongs to a contract or we are required to keep it.

11. Job applications

If you apply to us, for example at [email protected], we process your documents for the selection process (Art. 6(1)(b) GDPR).

If it does not work out, we delete your documents after seven months. We need them that long in case of claims under the Austrian Equal Treatment Act (Art. 6(1)(f) GDPR). We keep them longer only with your consent, for example for future vacancies.

12. Who else sees your data

Within minusplus, only the people who need your data for their task can see it: your salon, your stylist and the management.

We also use the following service providers. They act on our behalf and on our instructions (Art. 28 GDPR):

Independent controllers: These parties process your data under their own responsibility:

• SumUp, for card payments,
• Meta, for the Meta Pixel (only with your consent, jointly with us, see section 3) and for reporting bookings made via ads (section 8),
• Google, if you leave a review or open Google Maps,
• your browser's push services (Apple, Google, Mozilla), if you turn on notifications,
• our tax advisers and public authorities, where we are legally required.

We do not sell data.

13. Transfers outside the EU

Some providers are based in the USA. We base transfers there on two grounds:

• the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), where the provider is certified under it,
• otherwise the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We will send you a copy of these safeguards on request. We do not transfer data to countries without such safeguards.

14. How long we keep data

We only keep data longer if we need it for ongoing proceedings or the law requires it.

15. Cookies and browser storage

Strictly necessary cookies are set without consent because the function would not work otherwise (§ 165(3) TKG 2021). Analytics and advertising cookies are only set on minusplus.company and only with your consent in the cookie banner. You can change your choice at any time via “Cookie settings” at the bottom of the page.

16. Your rights

You have the right to:

• access your data (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on our legitimate interest (Art. 21), and to marketing at any time,
• withdraw any consent with effect for the future (Art. 7(3)).

Write to [email protected]. We reply within one month. So that we never send data to the wrong person, we may ask you to verify your identity, for example via the email address of your customer account.

Complaints: If you think we are not processing your data correctly, you can complain to the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, [email protected], www.dsb.gv.at. Feel free to write to us first; most things can be sorted out quickly.

17. Security

This is how we protect your data:

• All connections are encrypted (HTTPS).
• Our team members have their own personal logins.
• Everyone sees only what they need for their work.
• Access to customer data is logged.

If something happens nevertheless, we report it to the Data Protection Authority within 72 hours and inform you if there is a high risk to you.

18. Changes

We update this policy when our processes or the law change. The version on this page always applies. We will show you material changes before your next use of Salma.