Privacy Policy

Last Updated: August 28, 2026

This Privacy Policy describes how CNL Systems, Inc. ("CNL," "we," "us," or "our") collects, uses, and shares information when you use our services. CNL operates a booking, payments, and reporting platform for solo owner-operators, including the website at cnlsystems.com (the "Site") and the booking tools we provide to our customers (collectively, the "Service").

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1Who This Policy Applies To

CNL's Service has two distinct types of users. This Privacy Policy applies to both:

• Operators are CNL's direct customers, the owner-operators (such as solo salon owners) who subscribe to the Service to run their booking, payments, and reporting.
• End Customers are individuals who interact with an Operator's website to book appointments, make payments, or receive reminders. When you book an appointment through an Operator's site, the Operator is the controller of your personal information, and CNL acts as a data processor on the Operator's behalf. The Operator's own privacy practices may also apply; please review those separately.

Where this Privacy Policy distinguishes between Operators and End Customers, we say so explicitly. Where it does not, the section applies to both groups.

How your data is isolated. Each Operator's data, and the data of their End Customers, is stored in a database that is isolated from every other Operator's data at the infrastructure level. End Customer data from one salon is never accessible to a different salon through the Service.

2Information We Collect

We collect information in three ways: information you provide to us directly, information generated automatically when you use the Service, and information we receive from third parties.

2.1Information you provide

From Operators, we collect:

• Account information: full name, email address, phone number, username, and password (passwords are stored as cryptographic hashes; we do not store passwords in readable form)
• Business information: business name, business description, branding (colors, logos, photos), service catalog, calendar settings, custom domain
• Stripe Connect onboarding information: when an Operator connects their Stripe account, Stripe collects business identity, tax, and banking information directly for "know-your-customer" purposes. CNL receives only an identifier for the connected account and high-level status (e.g., whether charges are enabled). We do not see or store Operator banking or tax details.
• Communications with CNL: messages you send to customer support and the contents of those messages

From End Customers, the Service collects (on behalf of the Operator):

• Identity and contact: name, email address, phone number
• Booking information: requested service, date, time, requested staff member, any booking notes you provide
• Optional profile information: preferred language and consent preferences for marketing, SMS, and email
• Payment information: when you pay for a service, your card details are sent directly to Stripe, Inc. for processing on behalf of the Operator. CNL does not see, store, or have access to your full card number, CVV, or other sensitive payment credentials. We retain a transaction record (amount, currency, status, the last four digits of the card, and a Stripe-issued transaction identifier).
• Information the Operator records about you: the Operator may add notes about you (for example, service preferences, allergy information, or scheduling history) and may apply tags to your profile (for example, "regular" or "first-time"). These notes are written by the Operator's staff, not by you. CNL stores this information on the Operator's behalf and does not access or use it for any other purpose. Your right to request access to, correction of, or deletion of this information is described in Section 6.

2.2Information collected automatically

When you use the Site or the Service, we automatically collect:

• Device and browser information: IP address, browser type and version, operating system, device identifiers
• Usage information: pages or screens you view, links clicked, features used, session duration, referring URLs
• Cookies and similar technologies. Some are strictly necessary for the Service to function. On the cnlsystems.com website we also use optional analytics and advertising cookies that you can switch off. Our Cookie Policy explains what each category does.
• On the cnlsystems.com website only, and only while the advertising category is switched on: a recording of how a visit unfolded, including clicks, scrolling, mouse movement and the pages viewed. What you type into a form is masked in your browser before anything is sent, so form contents are not captured. No recording of any kind runs on an Operator's booking site.
• On the cnlsystems.com website only, and only while the advertising category is switched on: a report to Meta, to Google Ads, and to OpenAI of the pages you viewed, together with an identifier for your browser. This is advertising technology and we describe it as such. It measures whether an ad we paid for led to a signup, and it places your browser in retargeting audiences we can advertise to on Facebook, on Instagram, across Google's network, and on OpenAI's surfaces. Our Cookie Policy names the cookies involved. None of this runs on an Operator's booking site.
• Approximate location, derived from IP address

2.3Information from third parties

We receive limited information from our service providers as part of operating the Service:

• Stripe: transaction confirmations, payment intent status, dispute and refund events, and onboarding/account-status events for connected accounts
• Twilio: SMS delivery and failure reports for messages sent through the Service
• Resend: email delivery, bounce, and complaint reports for transactional email sent through the Service
• Microsoft: aggregated usage reports, heatmaps, and session recordings for the cnlsystems.com website, produced by Microsoft Clarity (see our Cookie Policy). We receive nothing from Microsoft about Operators' booking sites, because Clarity does not run on them.
• Google: aggregated usage reports for the cnlsystems.com website, produced by Google Analytics (see our Cookie Policy). We receive nothing from Google about Operators' booking sites, because Google Analytics does not run on them.
• Google (Google Ads): reports of how our advertising performed, including how many people who saw or clicked an ad went on to sign up, and the size of the remarketing audiences built from visitors to cnlsystems.com. We receive counts and campaign metrics, not a list of who is in an audience.
• Meta: reports of how our advertising on Facebook and Instagram performed, including how many people who saw or clicked an ad went on to sign up, and the size of the audiences built from visitors to cnlsystems.com. As with Google, we receive counts and campaign metrics, not a list of who is in an audience.

We do not purchase personal information from data brokers.

3How We Use Information

We use the information we collect to:

Provide and operate the Service

• Create and maintain Operator accounts and End Customer profiles
• Display booking calendars, services, and availability
• Process bookings, including confirmations and reschedules
• Process payments through Stripe on behalf of the Operator
• Send transactional messages, including booking confirmations, reminders, receipts, and password resets
• Provide reporting tools to Operators about their own business activity
• Provide customer support to Operators and respond to inquiries from End Customers

Communicate with you

• For Operators: account-related communications, billing notices, security alerts, Service updates, and occasional product news, feature announcements, and tips for getting more out of the Service. You can opt out of product news at any time without affecting your account.
• For End Customers: booking confirmations, reminders, receipts, and other messages directly related to a booking you made or service you received from an Operator. CNL sends marketing communications to End Customers only at the direction of and on behalf of an Operator, and only when you have opted in to receive them. You can opt out at any time through the unsubscribe link in any marketing email, by replying STOP to any marketing SMS, or by contacting the Operator directly.

SMS and text messaging Message frequency varies based on your activity: for example, booking confirmations, reminders, reschedule and cancellation notices, payment receipts, and one-time security codes such as password resets, tied to the appointments and account activity you initiate. Message and data rates may apply. Reply STOP to opt out or HELP for help.

Protect the Service and our users

• Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms of Service or Acceptable Use Policy
• Comply with legal obligations and respond to legal requests
• Enforce our agreements and protect our rights, property, and safety, and those of our users and the public

Improve the Service

• Understand how the Service is used in order to maintain, improve, and develop new features
• Aggregate or de-identify information so that it can no longer reasonably be associated with you, and use that aggregated information for any lawful business purpose

4How We Share Information

CNL does not sell personal information. CNL has not sold personal information about any consumer in the preceding twelve months.

We do use two third-party providers on the cnlsystems.com website, one for analytics and one for session replay. Our Cookie Policy says what each does, and Your Privacy Choices is where you switch them off.

We share information only as described below.

4.1With Operators (End Customer data)

If you are an End Customer, the information you provide through an Operator's website (including your name, contact information, booking details, payment status, and any notes you provide) is shared with and accessible to the Operator running that site, as well as to that Operator's authorized staff. The Operator controls the use of this information consistent with its own privacy practices and applicable law.

4.2With service providers (subprocessors)

We share information with third-party service providers that help us operate the Service. These providers are bound by contract to use your information only on our behalf and only as necessary to provide their services. Our current subprocessors are:

You can review each provider's privacy practices on their websites.

4.3For legal reasons

We may share information when we believe in good faith that disclosure is necessary to:

• Comply with a law, regulation, subpoena, court order, or other legal process
• Respond to lawful requests from public authorities, including for law enforcement purposes
• Investigate or address potential violations of our Terms of Service, Acceptable Use Policy, or this Privacy Policy
• Detect, prevent, or address fraud, security, or technical issues
• Protect the rights, property, or safety of CNL, our users, or the public

4.4In connection with a business transaction

If CNL is involved in a merger, acquisition, financing, sale of company assets, or similar transaction, your information may be transferred as part of that transaction. We will notify you of any change in ownership or control of your personal information.

4.5With your consent or at your direction

We may share information with third parties when you have given us your consent to do so or at your direction.

4.6What we do not do

• We do not share or sell mobile opt-in information or SMS consent data with third parties for marketing. No mobile information (including phone numbers and text-messaging opt-in or consent data) will be shared with or sold to third parties or affiliates for marketing or promotional purposes. This data is used solely to deliver the transactional messages (such as booking confirmations, reminders, and receipts) that you have requested, including sharing with our messaging provider (Twilio) strictly to carry out that delivery.
• We do not sell personal information for money. No payment flows to us, in either direction, in exchange for information about you. California law defines "sale" broadly and pairs it with "sharing," which covers disclosing personal information for cross-context behavioral advertising. The advertising tags described in Section 4.7 do that, and they are what the opt-out at Your Privacy Choices switches off.
• We do not use Service data for advertising. Bookings, payments, messages, and the notes an Operator records about an End Customer are never used to target an ad or to build an advertising audience. Advertising technology runs on the cnlsystems.com marketing website only, and Section 4.7 describes exactly what it does there.
• We do not provide Operator or End Customer personal information to third-party AI providers for model training. We may use de-identified data to improve the Service, including its automated features.
• We do not purchase personal information from data brokers, and we do not buy audiences, profiles, or retargeting lists from anyone.

4.7Advertising and cross-context behavioral advertising

We use personal information for cross-context behavioral advertising on the cnlsystems.com website, and only there. Three advertising tags run on that site while the advertising category is switched on: the Meta Pixel, a Google Ads tag, and an OpenAI advertising pixel. They report the pages you view to Meta, to Google, and to OpenAI. They let those companies credit a signup to an ad we paid for, and they add your browser to retargeting audiences we can then advertise to on Facebook, on Instagram, across Google's network, and on OpenAI's surfaces. Building an audience out of people who visited this site and did not sign up is one of the reasons those tags are installed. It is not a side effect of them.

This is the practice California law calls "sharing." It is what the advertising switch at Your Privacy Choices turns off, and what a Global Privacy Control signal turns off automatically (Section 10). In either case the tags are not placed in the page at all, rather than placed there and told to stay quiet.

The limits on it are these, and all three are real:

• Everything described above is built from visits to our own marketing website. We buy nothing from anyone.
• No advertising tag is placed on an Operator's booking site, and none will be. Someone booking an appointment with an Operator is not touched by any of this.
• The Service's own data is never used for it. Bookings, payments, and messages do not feed an advertising audience.

An earlier version of this policy said we ran no advertising tag of our own and built no retargeting lists. That stopped being true on August 28, 2026, and this section is what replaces it.

5Data Retention

We retain your information for as long as needed to provide the Service to you and for the additional periods described below.

Operator account data. We retain Operator account information for the duration of your subscription to the Service. After cancellation or termination, we delete or anonymize Operator account information within 30 days, except as described below.

End Customer data. End Customer information stored in an Operator's database is retained for as long as the Operator chooses, subject to the Operator's own retention practices. If the Operator cancels their subscription, the entire database (including End Customer information) is deleted within 30 days of cancellation, except as described below.

Longer retention for specific purposes. Certain information may be retained beyond these periods when we have a legitimate business or legal need to do so. Examples include:

• Transaction and tax records retained as required by financial recordkeeping and tax law (up to seven years)
• Fraud, abuse, and security records retained as needed to detect and prevent recurrence
• Backup copies retained on a rolling basis as part of our routine backup cycle, typically deleted within 30 days
• Aggregated or de-identified information that can no longer reasonably be associated with you, which may be retained indefinitely
• Information subject to a legal hold retained for the duration of the legal matter

Website analytics. Microsoft retains Clarity session recordings for 30 days, and heatmap data plus a randomly selected sample of recordings for up to 9 months. Google Analytics user- and event-level data is retained for the period configured in the property, currently Google's default of 2 months, and Google retains aggregated reporting beyond that. Our own first-party pageview records are pruned after 365 days.

Advertising. Meta and Google retain the advertising data described in Section 4.7 under their own policies, which we do not set. What we do set is how long a browser stays in an audience built from visits here, and each platform caps it: Meta allows at most 180 days from the visit, and Google Ads at most 540 days, after which a browser leaves the audience unless it visits again. The advertising cookies themselves expire on the schedule listed in our Cookie Policy. Switching the advertising category off stops anything further being sent, but it does not delete what has already been sent, and a request to delete that has to be made to Meta or to Google directly. We will point you to the right tool if you ask.

When we no longer need information, we delete it or de-identify it so that it can no longer reasonably be associated with you.

6Your Privacy Rights

Depending on where you live, you may have specific rights with respect to your personal information. We honor these rights regardless of where you live, subject to verification of your identity and any applicable legal exceptions.

6.1Rights available to all users

• Right to know. You may request a copy of the personal information we hold about you.
• Right to correct. You may request that we correct inaccurate personal information.
• Right to delete. You may request that we delete personal information we hold about you.
• Right to opt out of marketing communications. You may opt out of marketing emails using the unsubscribe link, opt out of marketing SMS by replying STOP, or contact us using the details below.
• Right to opt out of analytics and advertising. You can switch off either optional category at Your Privacy Choices. A category you switch off is never placed in the page at all. We also honor Global Privacy Control automatically (Section 10).
• Right to non-discrimination. We will not deny you the Service, charge you a different price, or provide a lesser quality of service because you exercised a privacy right.

6.2How to exercise your rights

If you are an Operator, contact us at robertlemmon@cnlsystems.com with the subject line "Privacy Request." We will verify your identity using the email address associated with your account and respond within 45 days.

If you are an End Customer of an Operator's salon, the Operator is the controller of most of your personal information. In most cases you should contact the Operator directly to exercise your rights (for example, to request a copy of your booking history or to delete your customer record). If you cannot reach the Operator, or if your request concerns information that CNL controls (such as automatically collected technical information), email us at robertlemmon@cnlsystems.com with the subject line "Privacy Request" and the name of the Operator's business, and we will help facilitate your request.

We will not respond to privacy requests received by other means. We may need to verify your identity before fulfilling a request; verification typically requires confirming control of the email address or phone number associated with your account or booking.

Authorized agents. You may use an authorized agent to submit a privacy request on your behalf. The agent must provide written permission from you, and we may still ask you to verify your identity directly.

Response timing. We will respond to verifiable requests within 45 days. If we need additional time, we will let you know and explain why.

6.3California residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following additional rights:

• Right to limit the use of sensitive personal information. We do not use or disclose sensitive personal information for purposes other than providing the Service.
• Right to opt out of "sale" or "sharing." CNL does not sell personal information for money. It does share it: the Meta Pixel and Google Ads tag described in Section 4.7 are "sharing" for cross-context behavioral advertising as California defines it, and there is no hedge to put around that. You can switch them off at Your Privacy Choices, and a Global Privacy Control signal switches them off automatically (Section 10). The same switch covers the session-replay provider, for the reason our Cookie Policy gives.
• Right to "Shine the Light" disclosures. Under California Civil Code §1798.83, California residents may request information about the categories of personal information shared with third parties for those third parties' direct marketing purposes. The advertising tags in Section 4.7 disclose information to Meta and to Google for our marketing, not for theirs, and we do not authorize either company to market to you on its own behalf using it. Any further use those companies make of it is governed by their own terms, which we do not control and do not ask you to take our word for.

Categories of personal information. Under the CCPA, the following categories of personal information have been collected from Operators and End Customers in the preceding twelve months:

We collect this information directly from you, automatically when you use the Service, and from our service providers (Stripe, Twilio, Resend, Microsoft, Google, and Meta) as described in Section 2.3. We use this information for the purposes described in Section 3, share it as described in Section 4, and retain it as described in Section 5.

Categories shared for cross-context behavioral advertising. Identifiers (the advertising cookie identifiers listed in our Cookie Policy, and IP address), internet or network activity (the pages viewed on cnlsystems.com, and whether the visit followed one of our ads and ended in a signup), and geolocation data (approximate location derived from IP address) are disclosed to Meta and to Google for the purposes described in Section 4.7. No other category is disclosed for advertising, nothing from an Operator's booking site is disclosed for advertising at all, and none of it is disclosed for another company's own direct marketing.

"Your Privacy Choices" link. A link titled "Your Privacy Choices" appears in the footer of cnlsystems.com and any Operator-facing dashboard. It is a single place to do two things: switch the analytics and advertising categories on or off, and submit a privacy request.

7Security

We take steps to protect your information against unauthorized access, disclosure, alteration, or destruction. Our security practices include:

• Encryption in transit. All connections to the Service use HTTPS with TLS.
• Password protection. Operator passwords are stored as cryptographic hashes using a one-way function. We never store passwords in readable form.
• Payment data isolation. Card information is collected directly by Stripe, Inc. and is never seen or stored by CNL. Stripe is certified as a PCI Service Provider Level 1.
• Tenant isolation. Each Operator's data is stored in a database that is physically isolated at the infrastructure level from every other Operator's data.
• Access controls. Internal access to production systems is limited to personnel who need it to operate the Service, and is logged.
• Infrastructure security. The Service is hosted on Vultr, which maintains security certifications including SOC 2 Type II and ISO 27001.

No security program is perfect. While we work to protect your information, we cannot guarantee that unauthorized access, disclosure, or destruction will not occur. In the event of a security incident affecting your personal information, we will notify you and applicable authorities as required by law, without unreasonable delay and in accordance with applicable breach notification statutes.

8Children's Privacy

The Service is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13.

If a parent or guardian uses an Operator's website to book an appointment for a child (for example, scheduling a haircut for a minor), the parent or guardian is providing the booking information on the child's behalf. The Operator is responsible for compliance with applicable law in connection with services provided to minors.

If you believe we have collected personal information from a child under 13 without parental consent, please contact us at robertlemmon@cnlsystems.com and we will delete the information promptly.

9Where Your Information Is Stored

The Service is operated from and hosted in the United States. If you access or use the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

Our service providers may process information on infrastructure they operate in the United States and elsewhere. Website analytics for cnlsystems.com are processed by Microsoft under Microsoft's own terms and by Google under Google's own terms, and the advertising described in Section 4.7 is processed by Meta and by Google under theirs. Switching the analytics category off at Your Privacy Choices stops the Google Analytics processing for you. Switching the advertising category off stops the Microsoft processing, the Meta processing, and the Google Ads processing for you, all three at once.

10Do Not Track and Global Privacy Control

On the cnlsystems.com website, while the advertising category is switched on, we do report your visit to Meta and to Google for advertising, and your browser can be placed in a retargeting audience we advertise to elsewhere. An earlier version of this policy opened this section by saying we did not track you across other companies' websites for advertising. That was true when it was written and is not true now, so it has been removed rather than reworded. Section 4.7 describes exactly what runs, our Cookie Policy names the cookies, and the switch that stops all of it is one click away.

We also use a third-party analytics provider and a third-party session-replay provider on that same website, both described in our Cookie Policy. None of the four runs on an Operator's booking site.

Global Privacy Control. We honor GPC in code, not only in policy. When your browser sends the Sec-GPC: 1 header, our server treats both optional categories as switched off for that request: the third-party script is never placed in the page at all, rather than placed there and then suppressed after the fact. We also do not show you the privacy notice bar in that case, because you have already told us your preference and asking again would be ignoring it. A GPC signal overrides any choice previously stored in your browser, for as long as your browser keeps sending it.

Do Not Track. We do not respond to the legacy Do Not Track ("DNT") browser signal. DNT was never completed as a standard and browsers send it inconsistently. GPC is the signal with a defined meaning and legal effect, and it is the one we act on.

If your browser sends no signal. Both optional categories are on by default, and you can switch either off at any time at Your Privacy Choices. None of this applies to an Operator's booking site: no analytics or advertising technology from CNL runs there at all.

11Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to the address associated with your account (for Operators) and by posting a prominent notice on cnlsystems.com at least 30 days before the changes take effect. Material changes will not apply retroactively to information collected under a previous version of this Privacy Policy without your consent.

Non-material changes (such as typo corrections, clarifications, or updates to subprocessor names) take effect when posted. The "Last Updated" date at the top of this Privacy Policy reflects the most recent revision.

12Contact Us

If you have questions or concerns about this Privacy Policy, or if you would like to exercise your privacy rights, please contact us:

CNL Systems, Inc. Attn: Privacy 3979 Alhambra Avenue, Apt 307 Martinez, CA 94553 Email: robertlemmon@cnlsystems.com