Terms of Service - Salons

Effective: 8 October 2026

These terms cover use of the daya platform, operated by PAP NOÉMI E.V., as a salon: the subscription, the salon account and staff access. By starting a subscription the salon accepts them, together with the data processing agreement in Annex 1.

Booking an appointment as a customer? Then the Terms of Service for Customers apply.

The whole thing in one sentence: daya is software that lets a salon offer appointments and a customer book them. The beauty service is provided by the salon, not by us - we are responsible for the software.

1. Definitions

• Platform - the daya website, mobile app and the service behind them.
• Operator (we) - PAP NOÉMI E.V., 1135 BUDAPEST, TATAI UTCA 20..
• Salon (you) - the business offering appointments on the platform. Our subscribing customer.
• Staff member - a person using the system on the salon's behalf.
• Customer - anyone booking an appointment, with or without a registered account.

2. What daya is - and is not

daya is software for beauty salons to take appointments and manage customers. We do not provide beauty services and are not a party to the agreement between a salon and its customer.

It follows that:

• The salon is responsible for the content, quality, price and performance of the service.
• The salon sets its cancellation, lateness and no-show rules, and enforces them.
• The customer pays for the service directly to the salon; there is no customer-side payment on the platform.

3. The salon account and staff

A salon account is created by the salon owner, who is responsible for who gets access on the salon's behalf. Staff can only be added by invitation.

The salon is responsible for its staff's use of the system, and for revoking access when someone leaves.

Everyone is responsible for keeping their own credentials safe. If you notice unauthorised access, tell us at hello@daya.now. Platform-administrator access requires two-factor authentication.

One email address can hold both a customer and a salon account. These are separate accounts: separately verified, with separate settings and separate notifications. In a salon account you act on the salon's behalf, in a customer account as a private individual; customer data seen in the salon account is not available to you as a customer, and vice versa. Deleting one does not affect the other. See section 2 of the Privacy Notice for details.

4. Subscriptions, fees, cancellation

• Salons pay by package. Prices are shown per country in local currency on the pricing page.
• Subscriptions start with a 30-day free trial. During the trial you can walk away at any time with no consequences.
• Payments are processed by Stripe. Card data never enters our systems.
• A subscription runs to the end of its billing period and can be cancelled at any time. Fees already paid are not refunded unless the law requires it.
• We may change prices. Salons are notified at least 30 days in advance and the change takes effect from the next billing period only. If you do not accept it, you may cancel.
• If payment fails, the service may be restricted. Salon data is not lost immediately - see section 12.

A salon uses the service as a business, so the 14-day withdrawal right available to consumers does not apply to the subscription.

5. Salon obligations

The salon undertakes that:

• the details it enters (company data, address, prices, opening hours) are true and up to date;
• it honours the appointments it publishes, or notifies the customer in good time;
• it holds the permits its activity requires and complies with the law applying to it;
• it uses customer data only to provide the service, and complies with the data protection rules applying to it as controller;
• it has the right to publish the content it uploads.

5.1 Health and special category data must not be requested

The prohibition. In the booking questionnaire and in photo requests the salon must not request special category data. Special category data is data listed in Article 9(1) GDPR: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data and biometric data used for identification, health data, and data concerning sex life or sexual orientation.

Examples. In the beauty industry health data is the typical risk. A salon therefore may not ask, for instance, about illness, allergies, medication, pregnancy, disability, or skin, nail or scalp conditions under treatment, nor request a photo intended to show such a condition. It may ask, for instance, about hair length, previous colouring, the style wanted, or for a reference picture.

How the system handles it. The system warns about the prohibition when a questionnaire is edited. Because questions are free text, we cannot enforce the prohibition automatically: the salon is responsible for complying.

If a salon needs health information to perform a service safely, it must obtain that outside the platform, on its own responsibility and as its own controller - in person, on paper, or in its own system.

Breach of this prohibition is a material breach of contract. We will delete the question and the answers received, require the salon to correct it, and on repetition may suspend the account. The salon is liable for all consequences arising from data collected in breach of this clause.

6. The salon's tools

Stamp cards. A salon may run a stamp card: it sets which service it applies to, how many completed bookings earn it, and what the reward is. We keep the count, the salon gives the reward - redemption happens at the salon. It is the salon that owes redemption to the customer; if the salon's account ends or is suspended, stamps collected there cannot be redeemed.

Discount codes. A salon may issue its own discount codes. Their size, validity and withdrawal are the salon's decision, and the salon bears the discount.

Referral programme. Salons and their staff get a referral code. If a referred salon signs up and three of its invoices are paid, the referrer earns one month of SOLO-tier subscription credit, applied to their next invoice. A salon may earn at most 12 months of credit this way. A referral made with a customer account earns no credit. We may change or discontinue the programme at any time; credit already earned is unaffected.

Customer groups and early access. A salon can create customer groups by email address, and members of a group see and can book newly released slots earlier than everyone else. A group belongs to that salon: no other salon sees it, and membership does not affect the customer's bookings elsewhere.

The salon may only enter an email address it has a proper legal basis to process and whose owner it has informed - an address entered into the system is the salon's processing, even where no daya account exists for it yet. This follows from clause A3 of Annex 1.

Calendar sync. A staff member can follow their own schedule by subscribing to a calendar address. That address contains a secret key, and can be regenerated or revoked at any time. If the salon or the staff member adds it to an external calendar provider (Google Calendar, say), booking data reaches that provider too - that is the salon's own processing decision, and the salon is responsible for where the address is shared.

Data export. A salon can export its statistics and customer list as a spreadsheet or PDF. The exported file leaves our systems, so the data protection obligations attaching to it become the salon's - storing it, passing it on and deleting it alike.

Embedded booking widget and brand mark. A salon may embed its booking surface into its own website using the snippet generated for it. The embedded surface is provided by us: its content, its behaviour and the marks shown on it are determined by the subscription tier, not by the embedding page.

Removing, hiding, covering or cropping the “Powered by daya” brand mark - including obscuring it with the host page's styles, by clipping the frame, with an element placed over it, or by any other display trick - is permitted only on a subscription that includes that right (the plan descriptions state which ones do). On plans that do not include it, the mark must remain legible and unobstructed. The same applies where a salon bypasses the embedded surface and calls the booking functionality from its own front end in order to obtain an absence of branding its plan does not include.

Breaching this is a breach of these terms. Where it happens we will - alongside the process in clause 8 - ask the salon to restore the mark, and may charge the price difference of the plan that includes the right for the period during which the mark was not visible on the salon's site.

dayacademy. We make training videos available to salons and their staff on the platform. They are our intellectual property: a salon may use them to train its own staff, but may not publish them or resell them.

7. User content, moderation and reporting

Who owns content. Content uploaded by a salon belongs to the salon; photos uploaded by a customer remain the customer's. By uploading, a user grants us only the licence needed to store the content and display it within the service - no more, no less. A customer's photo is used solely to fulfil that booking, never for marketing.

What is prohibited. Unlawful, deceptive or abusive content; content infringing another's rights; unauthorised publication of a third party's personal data; content contrary to the purpose of the service.

Reporting. If you encounter unlawful content on the platform, report it at info@daya.now. We examine reports without undue delay and inform both the reporter and - where we remove content - the user concerned, with reasons. Our decision can be contested at the same address.

Checking public images. Images shown publicly are put through automated content screening; a flagged image is quarantined and decided on after human review. The salon is notified of the decision.

8. Acceptable use

Do not use the platform for unlawful purposes, to obtain other users' data without authorisation, for automated bulk querying, to overload the system, or to circumvent its security measures. Do not reverse-engineer the service or build a competing service derived from it.

On a substantiated complaint we may suspend a salon or staff member; the party concerned is notified and given the reason.

9. Availability, bug reports and changes

We aim to keep the service continuously available, but we do not guarantee uninterrupted operation. Planned maintenance is announced in advance. We develop and occasionally change features; salons are informed in advance of material adverse changes.

Bug reports. You can file a report from the app or the website. The description, any screenshots attached, your contact details and the technical data needed for debugging reach us and are used solely to investigate the fault. Each report gets a reference number so it can be traced.

We may amend these terms. Amendments are published, and salons are notified of material changes. Continuing to use the platform after an amendment counts as acceptance.

10. Support access to a salon account

For support or abuse investigation, an authorised member of the platform team may sign into a salon account and use it on the salon's behalf. We have kept this narrow:

• every sign-in requires two-factor authentication;
• access lasts at most 30 minutes, cannot be extended, and a new sign-in requires authenticating again;
• while signed in, the support team member cannot change the salon's password or sign-in details;
• every entry and exit is logged - who signed in, to which salon, when and from which device - and log entries cannot be altered afterwards;
• access is limited to what the fault, the support request or the report under investigation requires.

During such a sign-in the support team member may also see the salon's customer data; in that respect they act as processor under Annex 1, bound by confidentiality.

On request, we tell a salon about the log entries concerning it.

11. Liability

We provide the platform with its features as they stand from time to time, as described in the plan descriptions. We do not warrant fitness for any particular business purpose beyond what the description states.

We are not liable for:

• the service provided by a salon, its quality, its non-performance, or a dispute between the salon and a customer;
• loss arising from inaccurate or incomplete data supplied by a user;
• lost profit and indirect damage;
• outages caused by circumstances outside our control that could not be foreseen or avoided.

Our total liability towards a salon is limited to the subscription fees actually paid by that salon in the 12 months preceding the claim.

The exclusions and the limit above do not apply to breaches of contract committed intentionally or with gross negligence, by a criminal offence, or causing harm to life, bodily integrity or health. Liability that is mandatory under Article 82 GDPR is not affected by the limit.

This section does not limit rights a consumer has under mandatory law.

12. Termination and what happens to data

A salon may cancel its subscription at any time. We may terminate if a salon materially or repeatedly breaches these terms - with prior warning, unless immediate action is warranted by unlawful conduct or a security risk.

After termination, salon data remains available for export for 30 days, then it is deleted or anonymised. Customer data is governed by the Privacy Policy.

13. Governing law and disputes

These terms are governed by Hungarian law, excluding its conflict-of-law rules. Disputes arising from the relationship with salons fall under the jurisdiction of the Hungarian courts.

For any dispute, write to hello@daya.now first - most matters are settled in one exchange.

14. Operator details

Name: PAP NOÉMI E.V. (sole trader) · Registered address: 1135 BUDAPEST, TATAI UTCA 20. · Registration number: 62737177 · Registering authority: Belügyminisztérium (egyéni vállalkozók nyilvántartása) · VAT: 92321146-1-41 · Email: hello@daya.now · Hosting: Railway Corp. (Európai Unió (EU))

Related documents: Privacy Policy · Cookie Notice · Terms for Customers · Legal notice

Annex 1 - Data Processing Agreement

This annex is concluded between the salon (controller) and the operator (processor) under Article 28 GDPR and takes effect when the salon accepts its subscription. It does not apply to customers.

A1. Subject matter of the processing

A2. Processor obligations

1. Acting on instructions. We process personal data only on the salon's documented instructions; ordinary use of the service constitutes such an instruction. If an instruction would breach the law, we say so without delay.
2. Confidentiality. Our personnel with access to the data are bound by confidentiality.
3. Security. We apply the measures required by Article 32 GDPR: encrypted transmission, encrypted password and secret storage, access control, logging, regular backups.
4. Sub-processors. The salon gives general authorisation for the sub-processors listed in Annex 2. We give at least 30 days' notice before adding a new sub-processor; if the salon objects on reasonable grounds, it may cancel the subscription with a pro-rata refund for the remaining period. We impose the same obligations on sub-processors and remain liable for their performance as for our own.
5. Data subject rights. We assist the salon in handling data subject requests through the self-service tools in the product (viewing, correcting, deleting and exporting data). If a request reaches us about data the salon controls, we forward it to the salon and do not answer it on the merits ourselves.
6. Breaches. In the event of a personal data breach we notify the salon without undue delay and within 48 hours of becoming aware, with the information needed for its own notification to the authority.
7. Cooperation. We provide reasonable assistance with data protection impact assessments and prior consultations.
8. Deletion at the end. 30 days after the subscription ends we delete or anonymise the personal data, unless the law requires retention.
9. Audit. We make available the information needed to demonstrate compliance and - on reasonable notice, at most once a year, without disrupting operations - allow an on-site inspection or independent audit.
10. International transfers. Data is transferred outside the EU only under the safeguards set out in section 8 of the Privacy Policy.

A3. Controller obligations

The salon warrants that it has a proper legal basis for processing customer data, that it has informed its customers, that it observes the prohibition in clause 5.1 in its booking questionnaire, and that it enters only data needed to provide the service.

Annex 2 - Sub-processors

The current list is in section 7 of the Privacy Policy and is updated with it. Salons are notified of changes in accordance with clause A2.4.