Privacy Policy

This policy is for UNLIMOS, the software we built to stop salons and appointment businesses from paying a monthly tax to booking apps and CRMs. It covers the UNLIMOS website, the salon app, public booking, the client portal, SMS appointment messages, and optional Instagram or WhatsApp inbox if a salon connects it.

We run software. The salon owns its clients. We do not sell your people.

Company: Alison LLC d/b/a UNLIMOS

Business address: 1025 E Hallandale Beach Blvd, Suite 15, No. 1616, Hallandale, 33009, Florida, US

Privacy contact: privacy@unlimos.com

Website: https://unlimos.com

We play two roles. This split is the law for this policy and our Data Processing Addendum.

• You (the salon / Customer) are the controller (or Business under CCPA) of your clients’ CRM, bookings, and messaging content. You decide why and how those records are used in your business.
• UNLIMOS is a processor / service provider for salon operational data: we process it under your documented instructions (these Terms, the product, and our DPA) to run UNLIMOS as you turned it on.
• UNLIMOS is an independent controller for staff accounts, authentication, billing, security logs, product telemetry needed to operate the platform, and our own website about UNLIMOS.
• For Instagram and WhatsApp Meta Platform Data, UNLIMOS acts as a Tech Provider on behalf of and at the direction of the salon that connects its Instagram Professional account or WhatsApp Business number, for that salon’s purpose, not for our independent commercial purposes or another salon’s purposes.
• Meta remains a separate party under Meta’s own terms for Instagram and WhatsApp.

This policy applies to:

• Salon staff and owners who use UNLIMOS.
• End customers whose information a salon stores or messages through UNLIMOS.

• Account and business information: name, email, phone, salon/organization details, location settings, and authentication data.
• Customer and appointment information: client profiles, bookings, payments metadata, notes, and related salon CRM records.
• AI copilots the staff connects: when staff authorizes ChatGPT, Claude, or another MCP client, that host receives the tool results for the granted location (schedule, client lookup, finance mix, catalog, and the booking/client writes that staff seat may perform). Card numbers are not returned. Guest Booking MCP exposes public catalog, availability, and book — not the staff CRM.
• Communications data: messages, delivery status, and media shared in salon chat channels (including Instagram Messaging and WhatsApp).
• Gmail: when a salon connects a Gmail mailbox, message text needed to show customer letters in that salon inbox, plus the connection token that lets new mail arrive.
• Technical and usage data: device/browser signals, logs, and diagnostics needed to operate and secure the service.
• Meta platform data: account ids, granted scopes, and messaging webhook payloads when Instagram or WhatsApp is connected.
• When a salon connects Instagram: Instagram Professional account id, username, encrypted OAuth access token, granted scopes, and connection health.
• When a salon connects WhatsApp: WhatsApp Business account id, phone number id, encrypted business token, and message text Meta sends for that number.
• Messaging webhook payloads needed to deliver Direct messages and WhatsApp messages: Instagram-scoped user ids, usernames, phone numbers, message text, media, and delivery and seen signals.

We do not process Meta Platform Data for UNLIMOS independent advertising, cross-tenant profiling, sale of Platform Data, or training unrelated models on raw Platform Data, except as allowed by Meta terms and your instructions or law.

• Provide salon software: bookings, clients, payments, inventory, and messaging.
• Relay and store Instagram Direct messages and WhatsApp messages for a connected salon account, including replies within Meta’s messaging windows, under that salon’s instructions.
• Secure accounts, prevent abuse, enforce our Acceptable Use Policy, and keep the service reliable.
• Provide customer support and comply with law, including Meta-required cooperation.

When a salon connects a Gmail mailbox, UNLIMOS reads messages in that mailbox so customer letters can show in the salon inbox.

The letters we read are the text of the messages in that mailbox.

We store the connection so new mail can arrive. The mailbox connection is stored encrypted.

We use this Google data only to deliver those letters to the salon that connected the mailbox. We do not sell it. We do not give those letters to other salons or to advertisers. We do not use these letters to train a general AI model. Use of Gmail data follows the Google API Services User Data Policy, including Limited Use.

The letters and the connection are deleted when the salon disconnects Gmail. Email privacy@unlimos.com to ask for deletion.

Newsletters and mail the mailbox sends to itself are not kept as client letters.

These texts are appointment reminders and booking updates — not marketing blasts from the UNLIMOS platform number.

We do not share or sell mobile numbers or SMS opt-in information to third parties for promotional or marketing purposes.

UNLIMOS sends appointment reminders and booking updates. Message frequency varies. Msg & data rates may apply. Reply STOP to cancel, HELP for help. Privacy Policy: https://unlimos.com/privacy. Terms: https://unlimos.com/terms

We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

The salon owns 100% of its customer and client data. UNLIMOS does not sell customer records.

Salon Platform Data is logically separated from other salons’ data. We share a salon’s Platform Data with that salon’s third parties only on the salon’s express direction, with retained proof where required.

• Service providers / subprocessors that help us host, send email/SMS, process payments, or operate infrastructure.
• Integrations the salon enables (for example Meta, Instagram, or WhatsApp when the salon connects them).
• AI hosts that staff authorizes (ChatGPT, Claude, Codex, Cursor) via the Staff MCP OAuth grant — those hosts receive only the MCP tool responses for that grant.
• Authorities when required by law.
• Successors in a merger or transfer of business assets, subject to this policy.

When a salon connects Instagram or WhatsApp through UNLIMOS:

• The salon connects its own Instagram Professional account and grants us permission to act as its agent for that connection.
• The salon connects its own WhatsApp Business number. The WhatsApp Business app stays on their phone. We store the WhatsApp Business account id, the phone number id, and an encrypted business token for that number.
• Meta’s Terms, Developer Policies, and Instagram Terms apply to the salon’s use of Instagram and WhatsApp.
• UNLIMOS relays and stores what the product needs for inbox and messaging. Meta remains the messaging platform for Direct messages and WhatsApp.
• We process Platform Data for that salon’s purpose, plus security, abuse prevention, support, and Meta or legal compliance. Not for another salon.
• Deletion of connection credentials we hold follows Disconnect, Meta deauthorize or data-deletion callbacks, or a verified request. See /legal/data-deletion. Meta-side copies follow Meta’s tools and the salon’s Instagram or WhatsApp account.
• The salon is responsible for Instagram and WhatsApp account ownership, staff authority to connect, message content, legally sufficient opt-in and opt-out, and consumer-facing notices about those messages.

Deletion paths are split. More detail: /legal/data-deletion.

Under Meta’s Platform Terms we honor deletion of Meta platform data we hold even when local law would not otherwise require it, unless a law prevents us from doing so.

• Platform / staff account: email privacy@unlimos.com to request deletion of your UNLIMOS staff account data, subject to lawful retention.
• Salon CRM / client records: end customers contact their salon first. The salon controls CRM erase in the product. Off-platform copies remain the salon’s responsibility.
• You may also email privacy@unlimos.com. We may forward the request to the salon and require identity verification before acting on processor-held copies.
• Instagram or WhatsApp connection data we hold: salon admins use Settings, Integrations, Disconnect.
• Meta, Instagram, or WhatsApp: remove UNLIMOS from connected apps. Meta may call our callbacks and return a confirmation code at /legal/deletion-status.

We retain account and salon operational data while the salon uses UNLIMOS and for a limited period afterward as needed for backups, disputes, and legal obligations. Instagram and WhatsApp access tokens and location connection records on our servers are removed when a salon disconnects, Meta deauthorizes the app, or a Meta data-deletion request is processed. We complete deletion of Meta platform data we hold promptly and in any event within 90 days of a valid deletion request, unless law requires longer retention.

We use encryption in transit (TLS), encryption at rest for stored service data, and access controls. Integration secrets (for example Instagram and WhatsApp access tokens) are stored encrypted. Staff can sign in with passkeys. We do not store payment card numbers. Optional AI features can be turned off. No method of transmission or storage is 100% secure.

Depending on your location, you may have rights to access, correct, delete, or restrict processing of personal information, including under GDPR or CCPA where they apply. Contact privacy@unlimos.com. Salon end-customers should usually contact their salon first, because the salon is the business that manages their CRM records.

UNLIMOS is not directed to children under 13, or a higher age required by local law, and we do not knowingly collect their data.

We may process information in the United States and other countries where we or our providers operate. Where required, we use appropriate safeguards for cross-border transfers. See our Data Processing Addendum.

We may update this policy. The effective date will change when we do. Continued use after an update means you accept the revised policy.

This policy is governed by the laws of the State of Florida, United States.

Exclusive venue for any disputes is the state or federal courts located in Broward County, Florida.

Privacy inquiries: privacy@unlimos.com

Support: support@unlimos.com

Business address: 1025 E Hallandale Beach Blvd, Suite 15, No. 1616, Hallandale, 33009, Florida, US