This policy explains what Shelley does with personal information — yours, and your clients'. It is written to be read, not to be skimmed past. If anything in it is unclear, write to info@lazarustech.ca and we will explain it.
Shelley is salon management software operated by Lazarus Tech, a business based in Ontario, Canada.
20582 Old Montreal Road South Lancaster, ON K0C 2C0
Person responsible for the protection of personal information: Jason Fishwick, at info@lazarustech.ca. Quebec law requires us to name a specific person for this. They are your first point of contact for any question, request or complaint about personal information, and they are the one who answers it.
This distinction runs through the whole policy, so it comes first.
Information about you as a Shelley account holder. If you are a salon owner or an employee with a Shelley login, we decide how that information is used, and we are answerable for it.
Information about a salon's clients. When a salon records its clients in Shelley, that information belongs to the salon. The salon decides what to collect and what to use it for. We only hold and process it on the salon's instructions, as its service provider.
If you are a client of a salon and you want your information corrected or removed, ask the salon — they control it, not us. If you cannot reach them, write to us and we will help them act on your request.
| What | Why we need it |
|---|---|
| Name, email address, phone number | To identify you, sign you in, and contact you about your account |
| Your password | Stored scrambled (hashed). Nobody at Shelley can read it, including us |
| Salon name, address, phone, tax numbers, logo | They appear on your invoices, and they identify you as the sender of messages you send |
| Subscription and payment records — plan, dates, amounts, Stripe reference | To bill you, send receipts, and keep the records the tax authorities require |
| Preferred language, theme, time format | So the app displays the way you set it |
| Sign-in activity, failed attempts, lockouts | To protect your account from someone trying to break into it |
| Whether you agreed to receive our news and offers, and when | Canadian anti-spam law requires us to be able to show we had your permission |
The salon chooses what to record. Shelley gives it room for:
It is used to book and confirm your appointments, remind you of them, invoice you, and keep the salon's own records.
A note for salon owners. The notes field is free text, so anything can be typed into it — including things the law treats as sensitive, such as a scalp or skin condition. Record what you genuinely need for the service, and be aware your client can ask to see it.
We do not sell personal information, and we never will. It reaches these companies only because the app cannot work without them:
| Who | What reaches them | Where |
|---|---|---|
| Stripe Payment processing |
Your name, email and the amount. Card numbers go straight from your browser to Stripe and never touch our servers. | United States and Ireland |
| Anthropic The AI assistant |
Only what is described in section 5 below | United States |
| Your own email and text-message provider | Booking confirmations and reminders go out through the account the salon configures in Settings. Shelley passes the message to it | Wherever that provider operates |
| OpenStreetMap Map lookup |
The salon's street address only, and only if the salon chooses to appear in the public directory. No client information | Europe |
| OVH Hosting |
Runs the servers the app and database sit on | Canada |
We may also disclose information if the law requires it — a court order, for example. If that happens we will tell you, unless we are legally forbidden from doing so.
Shelley includes an optional assistant that answers questions and carries out tasks you ask for. Because it is worth being exact about, here is precisely what happens when you use it.
When you send the assistant a message, three things are sent to Anthropic's servers in the United States:
What is not sent:
If you name a client in your message — "book Marie for Thursday" — then that name is part of the message and goes with it. Under Anthropic's commercial terms, information sent through their API is not used to train their models.
You never have to use it. Every part of Shelley works without the assistant, and nothing is sent to Anthropic unless you type a message to it.
Shelley's database and files are hosted in Canada. Two of the services in section 4 are outside it: Stripe and Anthropic, both in the United States. Information held in another country can be reached by that country's courts and authorities under its own laws.
Quebec law requires us to assess a transfer like this before making it, weighing how sensitive the information is, what it will be used for, and what protections the receiving company offers. We have carried out that assessment for both, and it is available on request.
Deleting in Shelley hides a record; it does not erase it. When a salon deletes a client, or an account is closed, the record stops appearing anywhere in the app — but it stays in the database. We would rather tell you that plainly than let you assume otherwise.
The reason is that appointments, invoices and payments are tied together. Canadian tax law requires a business to keep its financial records for seven years, and an invoice is not much use without the appointment and the client it belongs to.
| What | What happens |
|---|---|
| Your account and salon data | Kept while your account is open. You have 90 days after closing it to ask for a copy. After that the account is switched off and retained, not erased |
| A salon's client records | Kept for as long as the salon keeps them. Deleting a client hides the record from the salon's own screens; it remains in the database behind them |
| Invoices and payment records | At least seven years, because tax law requires it — including after an account closes |
| Nightly backups | 30 days, then overwritten |
If you want your information genuinely removed, ask us and we will do it by hand. Write to info@lazarustech.ca. Where a record has to stay for tax reasons, we remove the parts that identify you — your name, phone number and email — and keep only the amounts and dates the law requires us to hold. You have this right and it is not conditional on anything.
Whether you are an account holder or a client of a salon, you can:
Write to info@lazarustech.ca. We answer within 30 days. There is no charge. If we refuse a request, we will tell you why, in writing, and tell you how to challenge that decision.
Shelley does not use personal information to make automated decisions about anybody — no scoring, no profiling, no automatic approval or refusal. The AI assistant only carries out what a logged-in user asks it to do, and shows what it did.
Shelley sets two cookies, and only two:
There is no advertising, no analytics and no third-party tracking anywhere in the app. One thing worth naming: our public pages load their typefaces from Google Fonts, which means Google sees the IP address of a visitor to those pages. It does not happen once you are signed in.
No system is perfectly secure, and we will not pretend otherwise. What we can promise is that we do not collect more than the app needs, and we do not keep it longer than we said we would.
If personal information is lost or exposed and there is a real risk of serious harm, we will notify the people affected and the regulators — the Commission d'accès à l'information du Québec and the Privacy Commissioner of Canada — as the law requires. We keep a register of any such incident.
Shelley is not aimed at children and no one under 16 may hold an account. A salon may of course book an appointment for a child; if it records information about a client under 14, the salon is responsible for having a parent's consent.
If we change it in a way that matters, we will tell account holders by email at least 30 days beforehand. The date at the top always shows the version you are reading.
Start with us: info@lazarustech.ca. We would rather hear it and fix it. If you are not satisfied with how we handled it, you can complain to: