GDPR Compliance

MoraBookAI is built to help UK beauty professionals meet their GDPR obligations.

Data Controller and Processor

The salon is the data controller for its client data. MoraBookAI acts as a data processor, handling data only on the salon's instructions.

Consent

The app captures explicit consent for marketing, SMS and photo storage. Consent records are tied to client profiles and can be exported or deleted.

Rights we support

Access: salons can view and export all client data held in their account.
Correction: client details and notes can be updated at any time.
Erasure: clients can be deleted permanently from the system.
Portability: data can be exported in a structured format on request.
Objection/restriction: marketing and SMS consent can be withdrawn and recorded.

Security measures

TLS encryption for all data in transit
Secure, access-controlled hosting
Role-based access within each salon account
Regular backups with capped retention
Password hashing using industry-standard algorithms

Sub-processors

We use Stripe for payment processing and a UK/EU-based hosting provider. A full list is available on request.

Data retention

Active account data is retained while the subscription is live. Canceled accounts are securely deleted within 90 days unless longer retention is required by law.

Contact

For GDPR questions or data subject requests, email [email protected].