Encryption in transit
Deployed pages and APIs use HTTPS. Browser security policies restrict script sources, network connections and page embedding.
Protecting salon and Studio records
In plain language: another salon is not allowed to see your customer list; technicians are not allowed to see another technician's private records; and a personal Studio stays separate from the salon. These boundaries are checked in the database and on the server, not only by hiding buttons. No system is perfectly secure; this page describes the verified scope and is not a compliance certification.
Authentication
Supabase Auth manages accounts, sign-in sessions, email sign-in and recovery. Redirects are restricted to exact reviewed origins; account owners can enable TOTP two-step verification and sign out every device.
Each salon sees only its data
Every record belongs to a specific salon or account. Row Level Security denies cross-salon reads, updates and deletes, with negative tests proving one salon cannot reuse another salon's IDs.
Server authorization
Important booking, payout, import, export, turn and entitlement actions are checked by the database or an Edge Function instead of trusting the interface alone.
History and integrity
Important ticket, payout, turn, import and booking actions retain actors, times, states or events. A locked week must be reopened with a reason before affected financial records change.
Card handling
Upgrades open Stripe-hosted Checkout. Glownomics stores the customer, subscription and entitlement identifiers it needs and does not receive full card numbers.
Call data
The AI receptionist does not record routine calls and refuses card details. Summaries/messages delete after 30 days; QA transcripts require caller consent and remain for no more than 7 days.
Take data away and request deletion
Every account, including Free, can download one portable JSON file containing its permitted account, salon and Studio data. Users can also request export, correction, restriction or deletion in the app.
Backup and recovery
Backup/PITR and an Auth recovery drill are not yet active commitments. They are mandatory gates before the first paying customer; no RTO, RPO, or backup-retention promise has been published.
Glownomics has no workflow that sells a salon's customer list or uses it for advertising. Data is processed only to operate, secure and support the service as described in the draft Privacy Policy.
Report a security concern
Send a description, reproduction steps, a non-sensitive URL or reference and potential impact to [email protected]. Never send passwords, card numbers, SIN/SSNs or real customer data.
What we will do
Acknowledge when practical, assess severity, contain impact, prepare a safe fix and update the reporter where appropriate.
Responsible testing
Use only your accounts and data; do not disrupt service, extract data, access another tenant or publish an issue before a safe fix is available.
If your account may be at immediate risk, secure your email first, use “Sign out every device” in Account & security, then contact us.