Privacy Policy

Last Updated: August 22, 2026

This Privacy Policy describes how CNL Systems, Inc. ("CNL," "we," "us," or "our") collects, uses, and shares information when you use our services. CNL operates a booking, payments, and reporting platform for solo owner-operators, including the website at cnlsystems.com (the "Site") and the booking tools we provide to our customers (collectively, the "Service").

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1Who This Policy Applies To

CNL's Service has two distinct types of users. This Privacy Policy applies to both:

• Operators are CNL's direct customers, the owner-operators (such as solo salon owners) who subscribe to the Service to run their booking, payments, and reporting.
• End Customers are individuals who interact with an Operator's website to book appointments, make payments, or receive reminders. When you book an appointment through an Operator's site, the Operator is the controller of your personal information, and CNL acts as a data processor on the Operator's behalf. The Operator's own privacy practices may also apply; please review those separately.

Where this Privacy Policy distinguishes between Operators and End Customers, we say so explicitly. Where it does not, the section applies to both groups.

How your data is isolated. Each Operator's data, and the data of their End Customers, is stored in a database that is isolated from every other Operator's data at the infrastructure level. End Customer data from one salon is never accessible to a different salon through the Service.

2Information We Collect

We collect information in three ways: information you provide to us directly, information generated automatically when you use the Service, and information we receive from third parties.

2.1Information you provide

From Operators, we collect:

• Account information: full name, email address, phone number, username, and password (passwords are stored as cryptographic hashes; we do not store passwords in readable form)
• Business information: business name, business description, branding (colors, logos, photos), service catalog, calendar settings, custom domain
• Stripe Connect onboarding information: when an Operator connects their Stripe account, Stripe collects business identity, tax, and banking information directly for "know-your-customer" purposes. CNL receives only an identifier for the connected account and high-level status (e.g., whether charges are enabled). We do not see or store Operator banking or tax details.
• Communications with CNL: messages you send to customer support and the contents of those messages

From End Customers, the Service collects (on behalf of the Operator):

• Identity and contact: name, email address, phone number
• Booking information: requested service, date, time, requested staff member, any booking notes you provide
• Optional profile information: preferred language and consent preferences for marketing, SMS, and email
• Payment information: when you pay for a service, your card details are sent directly to Stripe, Inc. for processing on behalf of the Operator. CNL does not see, store, or have access to your full card number, CVV, or other sensitive payment credentials. We retain a transaction record (amount, currency, status, the last four digits of the card, and a Stripe-issued transaction identifier).
• Information the Operator records about you: the Operator may add notes about you (for example, service preferences, allergy information, or scheduling history) and may apply tags to your profile (for example, "regular" or "first-time"). These notes are written by the Operator's staff, not by you. CNL stores this information on the Operator's behalf and does not access or use it for any other purpose. Your right to request access to, correction of, or deletion of this information is described in Section 6.

2.2Information collected automatically

When you use the Site or the Service, we automatically collect:

• Device and browser information: IP address, browser type and version, operating system, device identifiers
• Usage information: pages or screens you view, links clicked, features used, session duration, referring URLs
• Cookies and similar technologies. Some are strictly necessary for the Service to function. On the cnlsystems.com website we also use optional analytics and advertising cookies that you can switch off. Our Cookie Policy explains what each category does.
• On the cnlsystems.com website only, and only while the advertising category is switched on: a recording of how a visit unfolded, including clicks, scrolling, mouse movement and the pages viewed. What you type into a form is masked in your browser before anything is sent, so form contents are not captured. No recording of any kind runs on an Operator's booking site.
• Approximate location, derived from IP address

2.3Information from third parties

We receive limited information from our service providers as part of operating the Service:

• Stripe: transaction confirmations, payment intent status, dispute and refund events, and onboarding/account-status events for connected accounts
• Twilio: SMS delivery and failure reports for messages sent through the Service
• Resend: email delivery, bounce, and complaint reports for transactional email sent through the Service
• Microsoft: aggregated usage reports, heatmaps, and session recordings for the cnlsystems.com website, produced by Microsoft Clarity (see our Cookie Policy). We receive nothing from Microsoft about Operators' booking sites, because Clarity does not run on them.
• Google: aggregated usage reports for the cnlsystems.com website, produced by Google Analytics (see our Cookie Policy). We receive nothing from Google about Operators' booking sites, because Google Analytics does not run on them.

We do not purchase personal information from data brokers.

3How We Use Information

We use the information we collect to:

Provide and operate the Service

• Create and maintain Operator accounts and End Customer profiles
• Display booking calendars, services, and availability
• Process bookings, including confirmations and reschedules
• Process payments through Stripe on behalf of the Operator
• Send transactional messages, including booking confirmations, reminders, receipts, and password resets
• Provide reporting tools to Operators about their own business activity
• Provide customer support to Operators and respond to inquiries from End Customers

Communicate with you

• For Operators: account-related communications, billing notices, security alerts, Service updates, and occasional product news, feature announcements, and tips for getting more out of the Service. You can opt out of product news at any time without affecting your account.
• For End Customers: booking confirmations, reminders, receipts, and other messages directly related to a booking you made or service you received from an Operator. CNL sends marketing communications to End Customers only at the direction of and on behalf of an Operator, and only when you have opted in to receive them. You can opt out at any time through the unsubscribe link in any marketing email, by replying STOP to any marketing SMS, or by contacting the Operator directly.

SMS and text messaging Message frequency varies based on your activity: for example, booking confirmations, reminders, reschedule and cancellation notices, payment receipts, and one-time security codes such as password resets, tied to the appointments and account activity you initiate. Message and data rates may apply. Reply STOP to opt out or HELP for help.

Protect the Service and our users

• Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms of Service or Acceptable Use Policy
• Comply with legal obligations and respond to legal requests
• Enforce our agreements and protect our rights, property, and safety, and those of our users and the public

Improve the Service

• Understand how the Service is used in order to maintain, improve, and develop new features
• Aggregate or de-identify information so that it can no longer reasonably be associated with you, and use that aggregated information for any lawful business purpose

4How We Share Information

CNL does not sell personal information. CNL has not sold personal information about any consumer in the preceding twelve months.

We do use two third-party providers on the cnlsystems.com website, one for analytics and one for session replay. Our Cookie Policy says what each does, and Your Privacy Choices is where you switch them off.

We share information only as described below.

4.1With Operators (End Customer data)

If you are an End Customer, the information you provide through an Operator's website (including your name, contact information, booking details, payment status, and any notes you provide) is shared with and accessible to the Operator running that site, as well as to that Operator's authorized staff. The Operator controls the use of this information consistent with its own privacy practices and applicable law.

4.2With service providers (subprocessors)

We share information with third-party service providers that help us operate the Service. These providers are bound by contract to use your information only on our behalf and only as necessary to provide their services. Our current subprocessors are:

You can review each provider's privacy practices on their websites.

4.3For legal reasons

We may share information when we believe in good faith that disclosure is necessary to:

• Comply with a law, regulation, subpoena, court order, or other legal process
• Respond to lawful requests from public authorities, including for law enforcement purposes
• Investigate or address potential violations of our Terms of Service, Acceptable Use Policy, or this Privacy Policy
• Detect, prevent, or address fraud, security, or technical issues
• Protect the rights, property, or safety of CNL, our users, or the public

4.4In connection with a business transaction

If CNL is involved in a merger, acquisition, financing, sale of company assets, or similar transaction, your information may be transferred as part of that transaction. We will notify you of any change in ownership or control of your personal information.

4.5With your consent or at your direction

We may share information with third parties when you have given us your consent to do so or at your direction.

4.6What we do not do

• We do not share or sell mobile opt-in information or SMS consent data with third parties for marketing. No mobile information (including phone numbers and text-messaging opt-in or consent data) will be shared with or sold to third parties or affiliates for marketing or promotional purposes. This data is used solely to deliver the transactional messages (such as booking confirmations, reminders, and receipts) that you have requested, including sharing with our messaging provider (Twilio) strictly to carry out that delivery.
• We do not sell personal information as that term is defined by California law.
• We do not use personal information for cross-context behavioral advertising. We do not build or buy audiences, profiles, or retargeting lists, and we run no ad-measurement tag of our own. One qualification: the session-replay provider described in our Cookie Policy sets an identifier that Microsoft also uses for advertising on its own services. That is why we classify it as advertising and put it behind a switch you control. There is no second qualification: our web analytics provider is not linked to any advertising account, and Google's advertising features are switched off for the property. We will never place an advertising tag on an Operator's booking site.
• We do not provide Operator or End Customer personal information to third-party AI providers for model training. We may use de-identified data to improve the Service, including its automated features.
• We do not purchase personal information from data brokers.

5Data Retention

We retain your information for as long as needed to provide the Service to you and for the additional periods described below.

Operator account data. We retain Operator account information for the duration of your subscription to the Service. After cancellation or termination, we delete or anonymize Operator account information within 30 days, except as described below.

End Customer data. End Customer information stored in an Operator's database is retained for as long as the Operator chooses, subject to the Operator's own retention practices. If the Operator cancels their subscription, the entire database (including End Customer information) is deleted within 30 days of cancellation, except as described below.

Longer retention for specific purposes. Certain information may be retained beyond these periods when we have a legitimate business or legal need to do so. Examples include:

• Transaction and tax records retained as required by financial recordkeeping and tax law (up to seven years)
• Fraud, abuse, and security records retained as needed to detect and prevent recurrence
• Backup copies retained on a rolling basis as part of our routine backup cycle, typically deleted within 30 days
• Aggregated or de-identified information that can no longer reasonably be associated with you, which may be retained indefinitely
• Information subject to a legal hold retained for the duration of the legal matter

Website analytics. Microsoft retains Clarity session recordings for 30 days, and heatmap data plus a randomly selected sample of recordings for up to 9 months. Google Analytics user- and event-level data is retained for the period configured in the property, currently Google's default of 2 months, and Google retains aggregated reporting beyond that. Our own first-party pageview records are pruned after 365 days.

When we no longer need information, we delete it or de-identify it so that it can no longer reasonably be associated with you.

6Your Privacy Rights

Depending on where you live, you may have specific rights with respect to your personal information. We honor these rights regardless of where you live, subject to verification of your identity and any applicable legal exceptions.

6.1Rights available to all users

• Right to know. You may request a copy of the personal information we hold about you.
• Right to correct. You may request that we correct inaccurate personal information.
• Right to delete. You may request that we delete personal information we hold about you.
• Right to opt out of marketing communications. You may opt out of marketing emails using the unsubscribe link, opt out of marketing SMS by replying STOP, or contact us using the details below.
• Right to opt out of analytics and advertising. You can switch off either optional category at Your Privacy Choices. A category you switch off is never placed in the page at all. We also honor Global Privacy Control automatically (Section 10).
• Right to non-discrimination. We will not deny you the Service, charge you a different price, or provide a lesser quality of service because you exercised a privacy right.

6.2How to exercise your rights

If you are an Operator, contact us at robertlemmon@cnlsystems.com with the subject line "Privacy Request." We will verify your identity using the email address associated with your account and respond within 45 days.

If you are an End Customer of an Operator's salon, the Operator is the controller of most of your personal information. In most cases you should contact the Operator directly to exercise your rights (for example, to request a copy of your booking history or to delete your customer record). If you cannot reach the Operator, or if your request concerns information that CNL controls (such as automatically collected technical information), email us at robertlemmon@cnlsystems.com with the subject line "Privacy Request" and the name of the Operator's business, and we will help facilitate your request.

We will not respond to privacy requests received by other means. We may need to verify your identity before fulfilling a request; verification typically requires confirming control of the email address or phone number associated with your account or booking.

Authorized agents. You may use an authorized agent to submit a privacy request on your behalf. The agent must provide written permission from you, and we may still ask you to verify your identity directly.

Response timing. We will respond to verifiable requests within 45 days. If we need additional time, we will let you know and explain why.

6.3California residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following additional rights:

• Right to limit the use of sensitive personal information. We do not use or disclose sensitive personal information for purposes other than providing the Service.
• Right to opt out of "sale" or "sharing." CNL does not sell personal information. Where our use of third-party analytics and session-replay providers on cnlsystems.com would count as "sharing," you can switch them off at Your Privacy Choices, and a Global Privacy Control signal switches them off automatically (Section 10).
• Right to "Shine the Light" disclosures. Under California Civil Code §1798.83, California residents may request information about the categories of personal information shared with third parties for those third parties' direct marketing purposes. CNL does not share personal information with third parties for their direct marketing purposes.

Categories of personal information. Under the CCPA, the following categories of personal information have been collected from Operators and End Customers in the preceding twelve months:

We collect this information directly from you, automatically when you use the Service, and from our service providers (Stripe, Twilio, Resend, and Microsoft) as described in Section 2.3. We use this information for the purposes described in Section 3, share it as described in Section 4, and retain it as described in Section 5.

"Your Privacy Choices" link. A link titled "Your Privacy Choices" appears in the footer of cnlsystems.com and any Operator-facing dashboard. It is a single place to do two things: switch the analytics and advertising categories on or off, and submit a privacy request.

7Security

We take steps to protect your information against unauthorized access, disclosure, alteration, or destruction. Our security practices include:

• Encryption in transit. All connections to the Service use HTTPS with TLS.
• Password protection. Operator passwords are stored as cryptographic hashes using a one-way function. We never store passwords in readable form.
• Payment data isolation. Card information is collected directly by Stripe, Inc. and is never seen or stored by CNL. Stripe is certified as a PCI Service Provider Level 1.
• Tenant isolation. Each Operator's data is stored in a database that is physically isolated at the infrastructure level from every other Operator's data.
• Access controls. Internal access to production systems is limited to personnel who need it to operate the Service, and is logged.
• Infrastructure security. The Service is hosted on Vultr, which maintains security certifications including SOC 2 Type II and ISO 27001.

No security program is perfect. While we work to protect your information, we cannot guarantee that unauthorized access, disclosure, or destruction will not occur. In the event of a security incident affecting your personal information, we will notify you and applicable authorities as required by law, without unreasonable delay and in accordance with applicable breach notification statutes.

8Children's Privacy

The Service is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13.

If a parent or guardian uses an Operator's website to book an appointment for a child (for example, scheduling a haircut for a minor), the parent or guardian is providing the booking information on the child's behalf. The Operator is responsible for compliance with applicable law in connection with services provided to minors.

If you believe we have collected personal information from a child under 13 without parental consent, please contact us at robertlemmon@cnlsystems.com and we will delete the information promptly.

9Where Your Information Is Stored

The Service is operated from and hosted in the United States. If you access or use the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

Our service providers may process information on infrastructure they operate in the United States and elsewhere. Website analytics for cnlsystems.com are processed by Microsoft under Microsoft's own terms and by Google under Google's own terms. Switching the advertising category off at Your Privacy Choices stops the Microsoft processing for you, and switching the analytics category off stops the Google processing for you.

10Do Not Track and Global Privacy Control

CNL does not track you across other companies' websites for advertising. We do use a third-party analytics provider and a third-party session-replay provider on the cnlsystems.com website, both described in our Cookie Policy.

Global Privacy Control. We honor GPC in code, not only in policy. When your browser sends the Sec-GPC: 1 header, our server treats both optional categories as switched off for that request: the third-party script is never placed in the page at all, rather than placed there and then suppressed after the fact. We also do not show you the privacy notice bar in that case, because you have already told us your preference and asking again would be ignoring it. A GPC signal overrides any choice previously stored in your browser, for as long as your browser keeps sending it.

Do Not Track. We do not respond to the legacy Do Not Track ("DNT") browser signal. DNT was never completed as a standard and browsers send it inconsistently. GPC is the signal with a defined meaning and legal effect, and it is the one we act on.

If your browser sends no signal. Both optional categories are on by default, and you can switch either off at any time at Your Privacy Choices. None of this applies to an Operator's booking site: no analytics or advertising technology from CNL runs there at all.

11Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to the address associated with your account (for Operators) and by posting a prominent notice on cnlsystems.com at least 30 days before the changes take effect. Material changes will not apply retroactively to information collected under a previous version of this Privacy Policy without your consent.

Non-material changes (such as typo corrections, clarifications, or updates to subprocessor names) take effect when posted. The "Last Updated" date at the top of this Privacy Policy reflects the most recent revision.

12Contact Us

If you have questions or concerns about this Privacy Policy, or if you would like to exercise your privacy rights, please contact us:

CNL Systems, Inc. Attn: Privacy 3979 Alhambra Avenue, Apt 307 Martinez, CA 94553 Email: robertlemmon@cnlsystems.com