Privacy Policy
Last updated 15 August 2026
The short version
A salon's books belong to that salon, not to us. We store them so the software works, we keep them walled off from every other salon on mirrorBill, and we do not sell them, rent them, or use one salon's customer list to advertise anything to anybody.
Nobody is ever messaged on WhatsApp except by the salon they gave their number to, and a customer who replies STOP is never messaged again.
Who we are
mirrorBill is salon management and billing software operated by VASTAR READYMADE GARMENTS (PROP-LOVLEEN), a proprietorship registered in Punjab, India. In this policy "we" and "mirrorBill" mean that business, "you" means a salon that uses the software, and "customer" means a person who visits that salon.
Reach us at support@mirrorbill.com.
Two kinds of data, and who owns each
This distinction runs through everything below, so it is worth stating first.
Your salon's own records
Bills, customers, appointments, staff, stock, packages. The salon owns these. We hold them on the salon's behalf and act on the salon's instructions — in the language of data protection law, the salon is the controller and we are the processor. We do not decide what goes in them and we do not use them for our own purposes.
Your account with us
The email address you sign in with, which salon it belongs to, your role, and what you have paid for. This one is ours to hold, because it is how we know who you are and whether the subscription is live.
What is actually stored
| What | Why it exists |
|---|---|
| Your email address and sign-in | To let you in, and to tell your salon apart from every other one. Passwords are held by Google Firebase Authentication and never reach us. |
| Salon name, address, GSTIN, branches | To print on bills and to work out the right tax. |
| Customer name, phone number, visit and billing history, memberships, wallet balance, loyalty points | Entered by the salon, for the salon. This is the salon's book of customers, kept the way a paper register was. |
| Staff names, roles, pay, incentives and attendance | To work out payslips from the bills rather than by hand. |
| Booking requests from the salon's public page | Name, phone, date and what was asked for — so the reception desk can ring back and confirm. Nothing else is asked for and nothing else is kept. |
| Photos the salon uploads for its public page | To show on that page. They are public by definition — that is the point of them — so do not upload anything that should not be. |
| WhatsApp connection details and message delivery status | See the WhatsApp section below, which is the part most worth reading. |
| Subscription and payment status | To know whether the software is paid up. Card and UPI details are handled entirely by Razorpay and never touch our servers. |
We do not run advertising trackers, we do not embed third-party analytics that follow you around other websites, and there is no advertising network anywhere in this software.
mirrorBill can send messages from a salon's own WhatsApp Business number using Meta's WhatsApp Business Platform. This section describes exactly what that involves, because it is the part where somebody else's phone is on the line.
What connecting does
When a salon connects its number, Meta hands us an access token for that salon's WhatsApp Business Account. That token is written to a location the database rules deny to every signed-in person, including the salon owner who created it — only our server can read it, and it is never sent back to a browser. We use it for nothing except sending that salon's own messages and reading their delivery status.
A WhatsApp Business Account can be linked to exactly one salon on mirrorBill. An account another salon has already connected is refused, so two businesses can never end up sharing one number's replies.
Who gets messaged
Only customers already in that salon's own records — people who gave the salon their number at the counter. mirrorBill does not supply phone numbers, does not buy lists, and gives no salon any access to another salon's customers.
Stopping
A customer who replies STOP to a salon's WhatsApp message is marked opted out immediately and automatically, and mirrorBill will not send them another marketing message — the block is enforced by our server, not left to the salon to remember. To opt out of one salon's messages, reply STOP to that salon. To be removed from a salon's records entirely, ask the salon, or write to us at the address above and we will pass it on and follow up.
What Meta gets
To deliver a message, the recipient's phone number and the message content go to Meta, who deliver it and tell us whether it arrived. That is governed by WhatsApp's own terms for businesses. We keep delivery results — sent, delivered, read, failed — so a salon can see what happened to a campaign. We do not read, store or analyse the ordinary one-to-one conversations a salon has with its customers in the WhatsApp app.
Who else touches the data
Only these, and each only for the job named:
- Google Firebase — stores the database and handles sign-in.
- Vercel — runs the server code that sends messages and verifies payments.
- Meta Platforms — delivers WhatsApp messages, as above.
- Razorpay — takes subscription payments. They see the payment; we see only that it succeeded.
Nobody else. We do not sell data, we do not share it with advertisers or data brokers, and we do not hand it to anyone else except where the law genuinely requires it.
Where it lives, and for how long
Data is held on Google Cloud infrastructure. Some of these providers operate outside India, so the data may be processed abroad under their standard protections.
A salon's records stay for as long as the salon uses mirrorBill — a billing history that vanishes is not a billing history. If a salon stops paying, the books go read-only rather than being deleted, so old bills can still be looked up and printed. Ask us to delete a salon and we will remove it and its records within 30 days, except where we are required to keep invoices for tax.
Keeping it apart, and keeping it safe
Every salon's data sits behind database rules that check, on every single read and write, that the person asking belongs to that salon. It is not a filter applied by the app — the app cannot be talked out of it, because the check runs at the database. That separation is covered by an automated test suite that must pass before any change ships.
Traffic is encrypted in transit. Access tokens and payment secrets live in server configuration, never in the browser and never in our source code. No system is perfect, and we will not pretend otherwise: if data is ever exposed, we will say so to the salons affected rather than quietly hope.
Your rights
You can ask us to show you what we hold about your account, correct it, or delete it. Salon staff and customers should ask the salon first, since the salon holds those records and can edit them directly in the app — but if that goes nowhere, write to us and we will help.
Deletion has a page of its own, because what to do differs depending on whether you run a salon or are a customer of one: how to delete your data.
Children
mirrorBill is business software and is not intended for anyone under 18. We do not knowingly collect data from children. A salon may bill a haircut for a child, and that record belongs to the salon like any other.
Changes
If this policy changes in a way that matters, we will change the date at the top and tell salons inside the app rather than hoping they re-read the page.
Contact
Questions, requests or complaints:
support@mirrorbill.com
VASTAR READYMADE GARMENTS (PROP-LOVLEEN), Punjab, India.