Effective: 20 April 2026 | Version 1.2.0
OpenChair Pty Ltd ("OpenChair", "we", "us", or "our") operates the OpenChair platform ("Platform"), a software-as-a-service solution for service-based venues including hair salons, barber shops, medispas, beauty studios, wellness centres, nail salons, and tattoo studios.
This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with the Platform. It applies across all jurisdictions in which we operate, including Australia, New Zealand, and the United Kingdom. Where jurisdiction-specific requirements differ, we address those differences explicitly below.
This Privacy Policy covers the personal information that OpenChair collects directly from venue owners, operators, and staff members who use the Platform ("you" or "Venue Owners") — our business-to-business (B2B) customers.
Venue customer data. When Venue Owners use OpenChair to manage appointments, waitlists, or customer records, they may collect personal information from their own end-customers ("Venue Customers"). In that context, OpenChair acts as a data processor (or "service provider") and the Venue Owner is the data controller (or "data holder"). The collection, use, and protection of Venue Customer data is governed by the Venue Owner's own privacy policy. Venue Owners are responsible for ensuring that their privacy practices comply with applicable laws and for obtaining any necessary consents from their customers.
If you are a Venue Customer and have questions about how a venue handles your personal information, please contact that venue directly. If you believe OpenChair has processed your data inappropriately, you may also contact us at privacy@openchairpro.com.
We collect the following categories of information in connection with the Platform:
When a Venue Owner uses the Platform to manage their customer relationships, we process the following data on their behalf:
Payment processing is handled by our sub-processor, Stripe. When you enter payment details, those details are transmitted directly to Stripe's PCI DSS-compliant infrastructure. OpenChair does not store credit card numbers, CVVs, or full card details on our servers. We receive and store only:
We collect usage data to understand how the Platform is used and to improve our service. This includes:
Usage analytics are collected via PostHog. See Section 10 (Cookies & Tracking) for details on how to manage analytics preferences.
When you use AI-powered features on the Platform (available to PRO-tier subscribers), the following data may be processed by third-party AI model providers via our routing partner, OpenRouter:
AI requests are routed through OpenRouter to language model providers including OpenAI, Anthropic, and Google. These providers process data solely to generate responses and do not use your data to train their models (subject to their respective data processing terms with zero-retention API agreements). All AI interactions are logged via Langfuse for quality monitoring and safety.
If you use the before-and-after portfolio feature (available for medical aesthetics, tattoo, and similar venues), the Platform may process:
This data is treated as sensitive personal information. Client consent is obtained before any images are captured or uploaded. Images are stored securely and are only visible to authorised venue staff. Deleted portfolio images are soft-deleted and permanently purged after 30 days.
Venue Owners on the PRO plan may connect their Instagram Business account to OpenChair via Instagram Login (Meta's Instagram API with Instagram Login flow). When connected, we receive the following data via the Instagram Graph API to power the Engage inbox and AI reply drafting:
We store this data encrypted and scoped to the venue that connected the account. We use it solely to operate the Instagram DM Concierge feature: to display conversations in the Venue Owner's inbox, to generate AI-drafted replies grounded in the venue's own services, prices, portfolio, and availability, and to maintain an audit trail of AI auto-sends.
We never share Instagram DM content with third parties. AI reply generation is performed by our AI sub-processors (see Section 5) under strict data-handling terms that prohibit use for model training. Customer Instagram handles are not logged in AI trace records; only hashed identifiers and first-80-character previews are retained for observability.
Disconnection and retention. Venue Owners can disconnect their Instagram account at any time from Settings → Integrations → Instagram. Disconnection revokes the access token with Meta, unsubscribes the associated Facebook Page from webhook notifications, and stops any further data ingestion. Existing message history remains in the venue's inbox for reference and is purged when the venue account is closed.
Customer requests. If an Instagram user who has messaged a connected venue wishes their message history to be deleted, the venue owner or our support team can remove it on request. See Section 8.5 for the full data deletion flow.
We use the information we collect for the following purposes:
The legal basis for our processing of personal information varies by jurisdiction:
Under the UK General Data Protection Regulation, we process personal data on the following bases:
Under the Australian Privacy Principles (APPs), we collect, use, and disclose personal information in accordance with:
Under the Information Privacy Principles (IPPs) of the Privacy Act 2020, we process personal information in accordance with all applicable principles, including:
We do not sell your personal information. We share personal information only with third-party sub-processors that are necessary to operate and deliver the Platform. Each sub-processor is bound by a data processing agreement that requires them to protect personal information to a standard consistent with this policy and applicable law.
Our sub-processors fall into the following categories:
For a complete and current list of sub-processors, including their purposes and data processing locations, please see our Sub-processors page.
We may also disclose personal information where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
OpenChair is based in Australia. To operate the Platform, your personal information may be transferred to and processed in countries outside of your country of residence, including:
For transfers of personal data from the UK to countries that have not received an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Addendum (IDTA) issued by the Information Commissioner's Office, as applicable. We ensure that appropriate safeguards are in place to protect your personal data in accordance with the UK GDPR.
Cross-border disclosures of personal information comply with Australian Privacy Principle 8 (APP 8). Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the APPs in relation to that information, or we ensure that an exception under APP 8.2 applies.
Cross-border disclosures of personal information comply with Information Privacy Principle 12 (IPP 12) of the Privacy Act 2020. We will only disclose personal information to a foreign person or entity if we are satisfied that the recipient is subject to privacy laws that provide comparable safeguards to the Privacy Act 2020, or if the individual authorises the disclosure after being informed that the recipient may not be required to protect the information in a way that provides comparable safeguards.
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention periods are as follows:
Depending on your jurisdiction, you have certain rights in relation to your personal information. We are committed to honouring those rights.
If you are located in the United Kingdom, you have the right to:
If you are located in Australia, you have the right to:
If you are located in New Zealand, you have the right to:
To exercise any of the rights described above, you can submit a request using our Privacy Request Form, or email us at privacy@openchairpro.com. Please include sufficient information to identify yourself and specify the right you wish to exercise. We will respond to your request within 30 days, or within the timeframe required by applicable law.
We may need to verify your identity before processing your request. If we are unable to fulfil your request (for example, due to a legal obligation to retain certain data), we will inform you of the reasons.
You can delete your account directly from within the Platform:
Account deletion requires password verification and explicit confirmation. Once confirmed, your personal account data will be permanently deleted within 30 days. Financial and transaction records are retained for 7 years as required by tax and financial reporting obligations. If you are a Venue Owner, deletion of your account will also remove your access to any venue data managed through the Platform.
When Venue Owners use the Platform to collect and manage personal information about their customers, OpenChair acts as a data processor (under the UK GDPR) or equivalent role under Australian and New Zealand privacy law. In this capacity:
A Data Processing Addendum (DPA) forms part of the customer contract where OpenChair acts as a processor and is incorporated by reference. To request a signed version for procurement, please email privacy@openchairpro.com.
We use cookies and similar technologies to operate the Platform, remember your preferences, and understand how you use our service.
These cookies are strictly necessary for the Platform to function. They include cookies for authentication (keeping you signed in), security (CSRF protection), and preferences (such as your selected theme). Essential cookies cannot be disabled.
We use PostHog for product analytics. Analytics cookies help us understand which features are used, how users navigate the Platform, and where we can improve. Analytics cookies are optional and are controlled via our cookie consent manager. You can opt out at any time through your browser settings or our consent banner.
We do not use third-party advertising cookies. We do not serve ads on the Platform and we do not share your data with advertising networks.
For full details on the cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.
We implement a range of technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:
While we take reasonable steps to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any vulnerabilities or incidents.
In the event of a personal data breach, we will act promptly and in accordance with the notification requirements of each applicable jurisdiction:
Under Part IIIC of the Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme, where an eligible data breach occurs, we will provide required notifications to the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable after completing the required assessment and forming the required belief.
Under the Privacy Act 2020, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable after becoming aware of a notifiable privacy breach — that is, a privacy breach that it is reasonable to believe has caused, or is likely to cause, serious harm to an affected individual.
Under the UK GDPR, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Where the breach is likely to result in a high risk to the rights and freedoms of individuals, we will also notify affected individuals without undue delay.
Where OpenChair is acting as a data processor on behalf of a Venue Owner, we will notify the Venue Owner of any data breach without undue delay, enabling them to meet their own notification obligations.
If you have a concern or complaint about how we handle your personal information, we encourage you to contact us first so we can try to resolve it:
OpenChair Privacy Team
We will acknowledge your complaint and aim to respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority:
Office of the Australian Information Commissioner (OAIC)
www.oaic.gov.au
Office of the Privacy Commissioner
www.privacy.org.nz
Information Commissioner's Office (ICO)
www.ico.org.uk
The Platform is a business-to-business service designed for use by venue owners, operators, and their staff. It is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16.
If we become aware that we have inadvertently collected personal information from a child under 16, we will take steps to delete that information as promptly as possible. If you believe that a child under 16 has provided personal information to us, please contact us at privacy@openchairpro.com so that we can take appropriate action.
Where a Venue Owner collects personal information from minors (for example, a parent booking a service for their child), the Venue Owner is responsible for obtaining appropriate parental or guardian consent in accordance with applicable law.
We do not use your data for cross-app tracking, cross-site tracking, or targeted advertising. We do not share your data with advertising networks, data brokers, or any third party for advertising purposes. We do not serve advertisements on the Platform.
Our analytics (PostHog) are used solely for product improvement and are opt-in by default. We do not use the Apple Identifier for Advertisers (IDFA), Google Advertising ID (GAID), or any similar advertising identifier. We do not participate in any advertising attribution or measurement networks.
We do not currently respond to "Do Not Track" browser signals, as there is no industry-standard technology for honouring them. However, because we do not engage in cross-site tracking or targeted advertising, the practical impact is the same regardless of your Do Not Track setting.
Although OpenChair primarily operates in Australia, New Zealand, and the United Kingdom, we provide the following disclosures for California residents in accordance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
For the categories of personal information we collect and our purposes for processing, please refer to Sections 2 and 3 of this Privacy Policy.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Effective" date at the top of this page and, where appropriate, by providing additional notice (such as email notification or a prominent notice within the Platform).
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: