Privacy Policy

Personally identifiable information that you give to us when you register with the App or use it. You create your account and sign in on the NexStrive account portal, which shares your name and email address with NexStyle. When you set up your salon, we store the salon and branch names, your name and your 6-digit stylist PIN. If you are a content partner, we store your name, company name, contact name, email address and phone number, and the salon you work with can see them.

The staff you add to your salon (name, role and 6-digit PIN), your services and prices, and each sale: the services, prices, chair, stylist, start and end times, and whether the client paid by Cash or QR pay (DuitNow QR, or a QR payment through your HitPay account). A sale is linked to a customer only when that customer collects the visit with the membership card (see Salon Customers below). Sessions cancelled before payment are recorded in the same way, with the reason if one is given.

If a salon switches on the membership card, its tablets show a QR after each paid sale. A customer who scans it for the first time joins with their name, phone number and email address. All three are required. A member's card holds:

• their name and phone number, to run the card and to find it again if they change phones;
• their email address, to send the emails that set up or reset their member PIN (see Member PIN below);
• a birthday (day and month only, never the year), which is optional and which the member can add later under Your details;
• whether they want offers from that salon, and when they made or changed that choice;
• the visits they collect, each linked to the sale, so the member sees a receipt for each visit and the salon sees their visits, spend, stylists, branches and services;
• if the salon runs a loyalty programme, the rewards they earn, each with a reward code, and when staff mark a reward as used.

The customer's phone keeps a random card key in a cookie so later visits need only a scan. A member belongs to the salon chain they joined: other salons on NexStyle cannot see them. The salon decides how this list is used and is responsible for it; we store and process it on the salon's behalf.

Once their card is unlocked with their member PIN, members can change or clear their birthday and offers choice under Your details at any time. They can also stop offers from the link in any email or by replying STOP to an SMS. They can remove the card from their phone at any time, which leaves their membership and visits with the salon, and they can ask the salon to delete their details, which the salon can do on its Customers page.

Until a member creates a 6-digit member PIN, their card shows the visit count only, on every phone and browser. It never shows their name, visit history, receipts, reward codes, offers or Your details. Visits keep counting with or without a PIN.

To create a PIN, the member taps Create PIN to see your details. We email them a link and a 6-digit code. The code can be used once and expires after 10 minutes. The member opens the link or types the code, which confirms their email address, then chooses a PIN and types it twice. On a new phone or browser, they tap Enter PIN to view details. If they forget their PIN, they enter their email address, we email a new link and code, and they choose a new PIN. Salons are not involved in any of these steps. At a salon that sends SMS codes, typing the code sent to the member's phone also opens the full card on that phone.

We store the PIN only as a one-way hash, which cannot be turned back into the PIN. Salons, the salon admin, exports and tablets never see the PIN or its hash. After 5 wrong PINs the card is locked for 15 minutes, and for longer after repeated failures. Easy PINs such as 123456 are refused.

We hold the confirmed email address and the PIN hash centrally, not as part of any one salon's customer list, so that one PIN opens the member's card at every NexStyle salon where they have a card with the same confirmed email address. We use the confirmed email address only to link those cards and to send PIN emails. Linking cards this way does not let one salon see another salon's members, visits or spend.

On Android phones, a member can tap Add to Google Wallet on a card unlocked with their PIN to keep the card in Google Wallet. This is optional, and the web card works without it. The pass shows the salon's name and logo, the member's name, their visit count and stamps, up to 5 unused rewards with their codes, and links to the card and to the visit scanner. It does not include the member's phone number, email or birthday.

To make the pass, we send these details to Google when the member taps the button. For a member who has the pass, after each collected visit and each reward marked as used we send the updated details so the pass stays current; for anyone else we send Google nothing but the pass number, to check whether a pass exists, and Google may show a notification when a new reward is ready. Google holds the pass under its own terms. To remove the pass, delete it in the Google Wallet app. Removing the card from the phone, or the salon deleting the member, does not remove a pass already saved in Google Wallet.

When a salon sends offers by SMS, WhatsApp or email, NexStyle sends them through the salon's own Twilio and email accounts, only to customers who chose to receive offers. For each campaign we keep its text and, for each customer, who it went to, the channel, the time and whether the provider accepted it. A salon can also switch on automatic messages: a thank-you after a visit, a reminder when a customer has not been back, a note when a reward is ready, and birthday wishes. Automatic messages also go only to customers who chose to receive offers. Birthday wishes go only to members who saved a birthday on their card, once a year on that day, from 9 am Malaysia time. For these we keep the type of message, who it went to, the channel, the time and the result, but not the text sent to each customer. If Twilio tells us a customer replied STOP to the salon's number, we switch their offers off.

If a salon uses a walk-in kiosk, a guest who joins the queue gives a first name and can add a phone number, a service and a preferred stylist. We keep the queue entry and when the guest was called and served. The phone number is cleared 7 days after the guest joins. If the salon has SMS set up in its own Twilio account, a guest who gave a number gets one "your turn" SMS when they are called. The kiosk screen never shows phone numbers; the salon's POS tablets do.

Information our servers record when you or your tablets use the App: the IP address, the browser or app type, and the time. We keep this in activity logs for actions such as changes to branches, services and stations, and for requests from paired tablets. When a tablet is paired, the NexStyle POS app creates a random device ID, which we store with the station together with the time the tablet last checked in. Each tablet keeps a copy of its station's services, staff names and PINs, your DuitNow QR image and the videos it plays, so it can keep working when the connection drops, plus any sales it has not yet sent.

NexStyle does not collect card numbers. You add your payment card and pay for your subscription in your NexStrive account, not in NexStyle. We store only very limited, if any, financial information that we collect. Otherwise, all financial information is stored by our payment processor, and you are encouraged to review their privacy policy and contact them directly with your questions. For sales at the chair, NexStyle records the amount and whether the client paid by Cash or QR pay (DuitNow QR). It does not take card payments at the chair. If a salon connects its own HitPay account, QR payments and sponsor payments are made to that account: we record the amount, the payment method, HitPay's payment reference and the status, and never hold the money or see card or bank details. The HitPay, Twilio and email keys a salon saves are encrypted before they are stored and are never shown again in full.

If you upload videos, images, or other media (for example, your salon's own videos, sponsor videos, logos, service photos, your DuitNow QR image, a proof of payment for a sponsor booking, or a file attached to feedback), we store the uploaded files and associated metadata (such as file name, size, timestamps, and the account or workspace that uploaded it). When a video plays on a station, the tablet reports which video played, on which station, when, and for how long, and we keep daily and hourly counts of these plays. We may review or remove uploaded content that violates applicable laws, our policies, or the rights of others.

NexStyle uses cookies to keep you signed in and to remember your choices. A sign-in cookie set by the NexStrive account portal keeps you signed in, a short-lived cookie is used while that sign-in is refreshed, and a cookie remembers which page tips you have dismissed, for up to one year. Customers who hold a salon membership card keep a cookie with a random card key on their phone for up to 400 days, renewed when they use the card, and while they create or reset their PIN, a cookie that points to that request for up to 45 minutes. Your browser also keeps a few settings on your device, such as the report period you chose and whether you hid the setup checklist or the install prompt, and the web app keeps copies of its pages and files in your browser so it loads faster. NexStyle does not set marketing or analytics cookies.

When a sponsor sends a video, and when a salon owner, admin or branch manager approves one or sets up sponsors, we record who accepted, the exact wording they accepted, when, and the IP address and browser they used. We keep these records after a booking, sponsor or salon account is deleted, so we can show them if a question about a video comes up.

To create an account you must give your name and email address; without them we cannot provide NexStyle. To join a salon's membership card, a customer must give a name, phone number and email address. A birthday, offers and a Google Wallet pass are optional. A member PIN is also optional, but without one the card shows the visit count only. Sponsors must give contact details to make a booking.