Data Processing Agreement (DPA)

Effective Date: May 25, 2026

This Data Processing Agreement ("DPA") governs the processing of personal data in connection with the salon management services provided by TressyPOS (developed by AsanWebs) to you, the salon or spa business owner ("Customer" or "Data Controller"). By utilizing the TressyPOS platform, you acknowledge and agree to the terms detailed herein.

1. Scope and Roles of the Parties

Under global data protection standards (including the General Data Protection Regulation - GDPR and California Consumer Privacy Act - CCPA), the roles of processing salon business information are designated as follows:

• The Customer (Salon Owner) is the Data Controller: You retain complete ownership, decision-making capabilities, and responsibility regarding the personal data of your salon staff, active barbers, and beauty clients. You dictate what data (such as names, phone records, appointment times, or loyalty points) is collected.
• TressyPOS is the Data Processor: We process personal data solely on your behalf and in strict accordance with your documented operational configurations within our application interface.

2. Types of Data Processed

The TressyPOS engine processes the following categories of information strictly to deliver operational management, system automation, and point-of-sale functionality:

• Client Demographics: Contact details (names, phone numbers, emails), transaction history, and custom loyalty metrics.
• Staff Records: Employee rosters, scheduling calendars, commission percentages, and mathematical face descriptors (used for the AI biometric attendance module).
• Financial Records: Transaction details, sales ledger balances, invoices, and service prices.

3. Our Unique Architecture & Data Security

TressyPOS implements an industry-leading decentralized architecture to minimize data risk:

A. Local-First Processing (IndexedDB)

The primary execution of transactional operations, invoice generation, and customer record updates takes place directly on your physical hardware utilizing isolated browser-level IndexedDB. This ensures that your client data is locally sandboxed and remains operational even during an internet blackout.

B. Private Cloud Synchronization

When internet connectivity is active, the desktop engine securely transmits incremental encrypted data packets via TLS 1.3 to our dedicated Hetzner VPS cloud servers to facilitate backup, multi-branch dashboard synchronization, and calendar updates.

C. Zero-Rent & No-Selling Protocol

Under no circumstances does TressyPOS sell, rent, lease, or distribute your salon’s financial information, staff rosters, or client databases to third-party advertisers, data brokers, or profiling agencies.

4. Sub-Processors

TressyPOS employs highly secure third-party cloud infrastructure components (Sub-Processors) to assist in rendering the application experience. These processors are restricted to operating under strict privacy frameworks:

• Firebase (Google LLC): Utilized strictly for master authentication, administrative licensing, and user account verification tokens.
• Hetzner Online GmbH: Serves as our primary isolated cloud hosting VPS infrastructure for database backends and synchronization pipelines.
• Supabase Inc: Utilized for securely managing real-time database syncing layers and secure row-level security (RLS) query processing.

5. Data Subject Rights & Deletion

As the Data Controller, if one of your beauty clients or staff members requests to access, modify, or permanently erase their personal information, TressyPOS provides comprehensive administrative controls directly within your software dashboard. These actions allow you to execute database commands that instantly update both your local machine and your private cloud storage.