UPDATED 18 OCTOBER 2026
Privacy Policy
This Privacy Policy explains how SOLA (“SOLA”, “we”, “us”, “our”) collects, uses, stores, shares, and otherwise processes personal data when you visit our website, create a salon account, apply for verification, book a review visit, pay fees, subscribe, appear on the SOLA Beauty app (the public directory of Verified salons, sometimes called the SOLA Guide), appear in a salon article on the SOLA journal, or use the Marketing Directory as a Salon or as a Provider. SOLA is operated by its parent company, EMBER INNOVATIONS W.L.L, CR 197621-1. It is written for salon owners, authorised salon contacts, and Marketing Directory Providers in the Kingdom of Bahrain, and is intended to meet the transparency duties in Law No. 30 of 2018 with respect to the Protection of Personal Data (the “PDPL”).
Please read this Policy together with our Terms and Conditions and Refund Policy. Creating an account requires you to tick a checkbox confirming that you have read and agree to all three. That checkbox is our record of your written, specific consent under the PDPL, in addition to other lawful grounds described below. Providers who accept the Marketing Directory terms, and Salons who request a package, also rely on the Marketing Directory sections of this Policy.
No privacy notice can prevent every disagreement. What this Policy does is describe our real practices in plain language, set the limits of what we collect and why, and explain which records we must keep if a payment, visit, grade, listing, or Directory introduction is later disputed. If anything here does not match how you understood the service, do not create an account until you have asked us.
1. Who we are
SOLA is a salon verification service operating in the Kingdom of Bahrain. We run the SOLA website, salon dashboard, application and booking pipelines, expert review process, and the SOLA Beauty app listing of SOLA Verified salons.
SOLA is operated by its parent company, EMBER INNOVATIONS W.L.L, CR 197621-1. That company is the data controller of personal data processed to operate these services. The visiting expert reviewer and authorised SOLA staff process salon information on our instructions in order to shortlist, visit, grade, and list salons.
- Legal name: EMBER INNOVATIONS W.L.L
- Commercial Registration (CR): 197621-1
- Privacy and data requests: hello@emberinnovations.dev
- Website and salon platform: the SOLA site you are using (including /policies, /signup, /login, and /dashboard)
- Service territory: Kingdom of Bahrain
2. Who and what this Policy covers
This Policy covers personal data about identifiable individuals — typically the salon owner, authorised contact, and anyone whose details or image you submit. Business facts (salon name, CR number, status in our pipeline) are processed together with that personal data because they sit on the same account.
- Salon owners and staff who create or use a SOLA account
- People whose names, phone numbers, emails, or photographs appear in documents or images you upload
- Visitors to the public website (limited technical data only)
- SOLA Verified salons whose listing details are prepared for the SOLA Guide
- Marketing Directory Providers (agencies and freelancers) and Salons who request packages through the Directory
This Policy does not make SOLA the employer or data controller of your staff or clients. If you upload a staff list, a price list with employee names, or photographs in which staff or clients can be recognised, you must already have a lawful right to share that material with us. You remain responsible for that content.
3. Why we need this data — the SOLA process
SOLA is not an open directory. A salon moves through a defined pipeline. We process data only as needed for the stage you are in, and we keep a verification archive so later stages (and later years) are not a blank slate.
- Account creation (Registered). You give owner/contact name, salon name, city or area, email, your contact number, the salon contact number, CR document, price list, logo, and a password. We use these to create the account, confirm the business exists, and hold Guide listing assets for later.
- Application window (Applied). When an intake is open you add a Google Maps link, Instagram handle, and salon photographs. We use these to assess the application.
- Shortlisting. SOLA staff decide whether you are shortlisted. That decision is human, capacity-limited, and discretionary — not an automated credit or reliability score. If you are not shortlisted you return to Registered, keep your account, and we email you when a later window opens.
- Pay for the visit. Shortlisted salons pay for their Expert Evaluation during an admin-set payment window, agree the Refund Policy, and pay. You do not choose a date or time. After payment the expert visits unannounced within that window’s day-count. A paid visit is not cancellable or refundable, and there is no reschedule.
- Visit and report. Admin marks the visit completed after the expert’s on-site form is received. Your dashboard then shows that the report is being prepared. The expert’s written report and star grade are uploaded. Every reviewed salon receives the report. Four or five stars is Accepted; one to three stars is Not Accepted. Not Accepted is not a dead end: you may re-apply in a later window, and if you are shortlisted again you can see past grading history.
- Subscribe and SOLA Verified. Accepted salons may subscribe. SOLA Verified requires both Accepted standing and an active membership, and lasts one year. We then use your phone, price list, and logo to prepare the Guide listing and related membership materials (including plaque fulfilment).
- Annual cycle. Verification is never permanent. During the year, cancelling or a failed payment pauses the badge and listing immediately. Resubscribing before the one-year mark restores the same year clock with no new review. If the one-year mark arrives while lapsed — or if you stay subscribed to term — you are auto-shortlisted for re-review (unless you opt out in Settings). Re-review follows the same Pay → Mystery visit → Report → Accept / Not Accept → Subscribe path. Renewals reuse the same SOLA Beauty guide profile (hidden until you subscribe again); no new password is issued.
3A. Consultation — a separate service
Consultation is a side service. It is not an application for verification, it does not shortlist or grade the salon, and it does not make the salon SOLA Verified. Sending the enquiry is your agreement to this Privacy Policy, the Terms, and the Refund Policy, including that a consultation fee is not refundable.
From the enquiry we store the contact name, role (owner, manager, or other), salon name, email, phone, area in Bahrain, Instagram handle if you give one, what you want help with, the time you agreed, and the status of the consultation. If you do not already have an account, we create one and keep login closed until you open the invite we send. If the email already belongs to a salon account, we attach the consultation to that account.
If you proceed after the introduction, we email you a payment link. We do not take that fee in the verification checkout. Deliverables are sent to the email on the enquiry. They are not uploaded to the public website, the journal, the SOLA Beauty app, or the verification report. We may keep a private copy. That copy, the enquiry, and our working notes can be opened only by the consultant assigned to you and by authorised SOLA administrators. We may use the phone number on the enquiry to call or message you about the consultation and for further details.
4. What we collect
We collect the following categories. Fields marked as required at signup or application are mandatory. If you do not provide them we cannot create the account, accept the application, or complete the relevant stage.
Identity and contact. Owner or contact name; email address; salon phone / listing phone; login credentials (your password is stored hashed by our authentication provider — we do not keep it in plain text); one-time login codes (stored hashed, short-lived); trusted-device tokens (stored hashed).
Salon and business. Salon name; city or area; Commercial Registration number; CR document (PDF or image); Google Maps URL; Instagram handle; pipeline status (for example Registered, Applied, Shortlisted, Not shortlisted, Visit pending, Under review, Accepted, SOLA Verified, Not accepted); notes added by SOLA staff on an application.
Files you upload. CR document; price list; salon logo; salon photographs (at least three at application). Files are stored in private storage, not on a public website folder.
Visit, grading, and membership. Review type (Expert Evaluation); whether the review fee is paid; payment-window snapshot and visit-within day-count; visit-completed timestamp (set by admin, not a public visit date); visit history; written expert reports (PDF) and star grades; verification start and expiry dates; whether listing is paused; whether you declined re-verification; Guide listing preparation status; encrypted one-time SOLA Beauty temporary password for first-time 4★+ salons until it is emailed and purged on subscribe.
Payments. We do not store card numbers, CVV, or full payment-account credentials. We store operational references needed to match a payment to your salon: Telr agreement, order, and transaction references, transaction fulfilment state, membership status (none, active, past due, canceled, or complimentary/legacy), scheduled cancellation date, the period already paid through, and an order reference we generate for emails. Telr, as our payment gateway, collects payment details on its hosted payment page under its own privacy notice.
Communications. Emails we send you (welcome, window open, application received, shortlisted or not shortlisted, payment confirmed, visit completed, report ready, membership confirmed, SOLA Beauty temporary password, badge paused, membership restored, renewal reminder, auto-shortlisted, removed from shortlist, payment window open, inactivity reminders while you still need to apply, pay, or subscribe, 48-hour window-closing notices, listing-paused restore reminders, login codes, password reset). We also send a WhatsApp Utility message for selected dashboard updates (application window open for Registered salons, first-time shortlist, not shortlisted, report ready, guide profile live, verification year ended, and payment/visit window open for auto-shortlisted re-review). Marketing Directory Providers receive operational emails when a salon requests a package, and reminder emails if a request is not marked contacted. We also send operational notices to SOLA administrators (for example a new application, a paid review, or unpaid shortlisted salons when a payment window is about to close) so the team can run the pipeline. We keep a send log so inactivity reminders are capped and closing notices are not repeated.
Security and technical data. Authentication session cookies; OTP-gate and trusted-device cookies; hashed device/session tokens; timestamps; and server or hosting logs that may include IP address, browser type, requested URL, and time of request. These are used to keep accounts secure, prevent abuse, and debug faults. We do not currently run advertising pixels, social-media tracking plugins, or third-party analytics products on the SOLA site.
Account timeline. A history of operational events on your salon (for example application submitted, payment fulfilled, report uploaded) so you and SOLA staff can see what happened and when.
We do not ask for sensitive personal data as defined in the PDPL (for example race, religion, health, or criminal record). Do not upload such data. A CR document or salon photograph should not include national ID copies, passports, or health information. If you upload them anyway, we may delete those files and still keep the rest of the verification record.
5. How we collect it
- Directly from you: signup, onboarding if signup files did not finish, application form, booking and payment, Settings (password, membership, re-verification opt-out), and emails or messages you send us.
- From our systems as you use them: status changes, visit records, login and security events, email-send records.
- From SOLA staff and the expert reviewer: shortlisting outcome, visit attendance, written report, star grade, Guide listing preparation, admin notes.
- From Telr: payment success, agreement and order references, and transaction references needed to keep membership in sync.
- Automatically: cookies and hosting logs as described in the cookies section.
6. Why we process it (purposes and lawful grounds)
Under the PDPL, we process personal data with your consent and/or because processing is necessary to perform the verification contract you ask us to enter, to take steps at your request before that contract, to comply with law, or to pursue legitimate interests that do not override your rights. In practice:
- Create and secure your account; send login codes and password-reset mail; remember a trusted browser — consent, contract, and legitimate interests (security).
- Verify that the salon is a real Bahrain business (CR number and CR document) — contract and legitimate interests (integrity of the SOLA Standard).
- Run application windows, shortlisting, booking, visits, reports, and grading — contract and consent.
- Take review fees and memberships, match payments to salons, pause or restore membership — contract, and our payment processor’s handling of payment data under its terms.
- Prepare and publish a Guide listing after you are SOLA Verified; pause or remove it when membership lapses — contract and legitimate interests (clients must see current standing only).
- Email you about windows, bookings, reports, renewals, and account security — contract. These are service messages, not advertising. Selected dashboard updates are also sent by WhatsApp Utility template. You cannot opt out of security and booking emails while you have an account, because the pipeline cannot run without them.
- Keep a verification archive (applications, visits, reports, grades, payment references, status history) so re-applications, re-verification, refund disputes, and claims about “what SOLA said” can be answered with records — legitimate interests and legal claims.
- Improve operations (for example seeing that a slot was held and then paid) — legitimate interests. We do not sell personal data and we do not use it for third-party advertising.
- Comply with accounting, tax, law-enforcement, or PDPA requests — legal obligation.
You may withdraw consent by emailing us or closing the account. Withdrawal does not undo processing that already happened, and it does not require us to delete records we still need for the contract, security, accounting, or to defend a dispute (see retention and your rights below).
7. Who we share data with
We do not sell your personal data. We do not rent our salon list. We share data only with people and providers who need it to run SOLA, or where the law requires it.
- SOLA staff and authorised administrators — to review applications (including exported PDFs with salon details and photograph links), book visits, upload reports, and manage membership.
- The expert reviewer and authorised review team — to prepare and carry out the unannounced on-site visit and write the report. They see the salon profile, application materials, and address/map link. They do not receive a visit date chosen by the salon.
- Google — used for notes taken during the on-site review. Google handles that information under its own privacy notice.
- Hosting and application platform (currently Vercel) — to serve the website and dashboard.
- Database, authentication, and file storage (currently Supabase) — accounts, salon records, private files (CR, photos, reports, Guide assets), and security tokens.
- Email delivery (currently Resend) — transactional and security emails to you and operational emails to SOLA administrators.
- WhatsApp Cloud API (currently Meta) — operational Utility templates to salons for selected dashboard updates. Meta receives the salon WhatsApp number required to deliver the message.
- Payments (currently Telr) — hosted checkout, memberships, and payment fraud checks. Telr receives the email you use at checkout and any billing details you enter on Telr’s payment page. Card data is handled by Telr, not stored in SOLA’s database.
- Guide / plaque fulfilment — once you are SOLA Verified, listing assets (name, area, phone, logo, price list, verification standing) are used to prepare the public Guide profile and membership materials. Only current SOLA Verified standing is presented as live; a pause or lapse removes or pauses public listing.
- Professional advisers (lawyers, accountants) and insurers — if needed to handle a claim or audit, under confidentiality.
- Authorities — if required by Bahrain law, a court, public prosecution, or the Personal Data Protection Authority.
Those providers act on our instructions or as independent controllers of the data they must process to provide their service (especially Telr for payments). We require them to protect the data. Their own privacy notices also apply when you use their checkout or infrastructure:
- Telr — https://telr.com/privacy-policy
- Supabase — https://supabase.com/privacy
- Vercel — https://vercel.com/legal/privacy-policy
- Resend — https://resend.com/legal/privacy
- Meta / WhatsApp — https://www.facebook.com/privacy/policy and https://www.whatsapp.com/legal/privacy-policy-eea
- Google — https://policies.google.com/privacy
8. Storage location and transfers outside Bahrain
SOLA is operated for Bahrain salons, but the website, database, files, email, WhatsApp delivery, and payment systems are cloud services. That means personal data is transferred to, stored in, or accessed from countries outside the Kingdom of Bahrain (commonly including the United States, the United Kingdom, and European Economic Area countries, depending on the provider’s region).
Bahrain Resolution No. 42 of 2022 lists countries treated as providing adequate protection. Several of the countries in which our providers operate appear on that list (including the United States, the United Kingdom, and EU member states). By creating an account, applying, uploading files, or paying, you expressly consent to this transfer and processing so we can provide the service. If you do not accept that transfer, do not use SOLA — the platform cannot run on Bahrain-only servers at this time.
We take contractual and technical steps with providers (access control, encryption in transit, private file buckets, hashed secrets). We do not transfer your data to random third countries for marketing.
9. What becomes public on the SOLA Beauty app
The dashboard is private. Your CR document, full application photos, expert report, and grade are not published on the public marketing website.
If you become SOLA Verified, we use the listing assets you submitted at signup — salon name, city or area, listing phone, logo, and price list — plus the fact that you are SOLA Verified for the current year, to prepare your profile on the SOLA Beauty app (sometimes called the SOLA Guide). That profile is meant to be seen by the public. A paid membership is what keeps it live. Do not submit a phone number, logo, or price list you are not willing to have used for that purpose after you are Verified.
If membership payment fails or you cancel, the badge and listing are paused immediately. If you resubscribe before the one-year mark, listing can be restored on the same clock. When the year ends without a completed re-verification, Verified standing ends and public listing is not kept live. Past private reports remain on your account as described below.
A salon review and an owner spotlight on the public journal (/blog) are part of an active SOLA Verified membership, in the same way as the SOLA Beauty app profile. They are published only after you subscribe. The review is written from your expert report. The spotlight is written from the interview answers you submit. While the membership is active, those articles can be read by anyone on the website, so your salon name, and whatever you wrote in the interview, become public. If the membership is paused or ends, every article tied to your salon is taken off the website. We do not delete the article or the interview. If you subscribe again, the same article can be shown again. You cannot ask us to edit it. Journal articles that are not tied to a salon are not affected.
9A. Marketing Directory
The Marketing Directory is a benefit for eligible SOLA Verified salons. It lets salons request packages from independent third-party marketing agencies and freelancers (“Providers”) who list their own services on SOLA. This section explains what we collect for that feature and what Salon contact details we disclose to a Provider, and when.
What we collect from Providers. Business or agency name, location (where based), logo, listed packages, pricing, and discount percentages; and account contact details for the Provider’s own dashboard access. Membership and payment references (payment partner customer and membership identifiers, membership status, and billing dates); request status history (Contacted, In Discussion, Completed); and a log of the notification emails we send you. Card details are collected by our payment partner and are not stored by SOLA.
What we disclose to a Provider, and when. When a Salon requests a Provider’s package through the Marketing Directory, we disclose to that Provider: the Salon’s name, phone number, email address, owner name, salon location, and Instagram handle, so the Provider can follow up. These details are shared with the Provider as soon as the Salon submits the request, provided the Provider has an active membership. Providers do not pay per request to see them.
Lawful basis. A Salon’s submission of a request through the Marketing Directory constitutes its consent to this specific disclosure, in addition to performance of the SOLA Partners Membership contract, of which the Marketing Directory is a benefit.
Once disclosed, the Provider is an independent controller. SOLA’s responsibility for a Salon’s contact information ends at the point of disclosure. What a Provider subsequently does with that information — how they store it, contact the Salon, or use it for their own purposes — is governed by the Provider’s own privacy practices, not SOLA’s. Salons should be aware of this before submitting a request.
Providers as data subjects. A Provider’s own business and account information is handled under the same principles as any other business user of the platform, as set out elsewhere in this Policy.
Retention. We keep Provider account, listing, membership, and request records while the account is active and for at least five (5) years afterwards. This allows us to handle billing questions, disputes between Salons and Providers, and suspension decisions.
10. Cookies and similar technology
We use cookies and similar storage that are required to run the service. We do not use them to advertise SOLA or anyone else across the web.
- Authentication cookies set by our auth provider (Supabase) — keep you signed in. These are essential. Duration follows the auth session.
- sola_otp_ok — after a successful email login code, this httpOnly cookie proves this browser passed the extra login step. It lasts 12 hours. Admins always use this step; salons use it unless the device is trusted.
- sola_trusted_device — optional, salon accounts only. If you trust the browser, a hashed token is stored for up to 30 days so you can skip the email code on that browser (up to a small number of devices). Logging out does not always delete this cookie, so that the next login on the same browser can skip the code. Do not tick trust on a shared or public computer.
- Browser local storage — a flag so we do not repeatedly show the “you are SOLA Verified” welcome message. This stays on your device and is not sent to us as a tracking ID.
- Telr checkout — when you pay, Telr may set its own cookies on its hosted payment page to process the payment and prevent fraud. Those cookies are governed by Telr.
You can delete cookies in your browser. If you delete essential cookies you will need to log in and complete the email code again. The site does not offer a non-account “cookie settings” panel because we are not running optional advertising cookies.
11. How long we keep data
We keep data only as long as needed for the purpose, then delete or irreversibly restrict it unless a longer legal or dispute period applies. In outline:
- Account profile and salon record — for as long as the account exists, and then as part of the verification archive below.
- Login codes — hashed, expire after about 10 minutes, and are removed after use or expiry.
- OTP sessions — until the 12-hour gate expires or you log out.
- Trusted devices — up to 30 days, or earlier if the token is revoked or expired.
- Hosting and security logs — typically a short operational period set by the host (often weeks, not years), unless an incident requires a longer hold.
- Telr payment event IDs — so the same payment is not applied twice; kept as an operational log.
- Verification archive — applications, photographs, CR documents, visit dates and tiers, payment and membership references, reports, grades, status history, re-verification opt-out, and related emails. We keep this for the life of the programme and for at least five (5) years after your last application, visit, payment, or status change, whichever is later. We do this because SOLA standing is a public claim, fees are non-refundable, Not Accepted salons may re-apply with past grades visible, and both sides may need evidence if there is a complaint about shortlisting, the visit, the report, the Guide listing, or a charge.
If you ask us to delete your account, we will close login access and stop using your data for new applications, bookings, emails (other than a confirmation), and Guide listing. We will not erase the verification archive where we still need it to prove what happened, to meet accounting or legal duties, or to prevent someone recreating an account to dispute a past grade or fee. Public listing is removed or paused when you are not SOLA Verified.
12. How we protect data
- Passwords, login codes, and trusted-device tokens are stored hashed, not in recoverable plain text.
- CR documents, photographs, reports, logos, and price lists sit in private storage. Access is limited to the salon owner (own files) and authorised SOLA administrators, using signed links rather than public URLs.
- Database access is restricted with role-based rules so a salon account cannot read another salon’s records.
- The site is served over HTTPS in production.
- Payment card data is collected by Telr on its hosted payment page, not typed into SOLA’s own forms.
No method of transmission or storage is perfectly secure. We take reasonable technical and organisational measures appropriate to a verification platform that holds CR documents and reports. We do not warrant that unauthorised access is impossible. If we become aware of a breach that is likely to affect your personal data, we will notify you and, where required, the Personal Data Protection Authority, in line with applicable law.
13. Your rights under Bahrain law
If we process your personal data, you may, with proof of identity, email hello@emberinnovations.dev and ask us to:
- Tell you whether we process personal data about you, and provide a copy of the data, its source, purposes, and categories of recipients (PDPL Article 18 — we aim to respond within 15 working days).
- Correct inaccurate or incomplete data (you can also update password and some account settings yourself).
- Object to processing for direct marketing (we do not currently send promotional marketing; operational pipeline emails are not marketing). If we ever send marketing, we will honour an objection within 10 working days.
- Object to processing that causes unwarranted substantial damage, where the PDPL allows.
- Request rectification, blocking, or erasure where processing is unlawful, inaccurate, incomplete, or outdated (PDPL Article 23 — we aim to respond within 10 working days, with a lawful justification if we cannot fully comply).
- Withdraw consent where processing is based on consent, without affecting earlier lawful processing.
- Ask that a decision about you is not based solely on automated processing of the PDPL Article 22 type. Shortlisting, grading, and SOLA Verified standing are human decisions by SOLA staff and the expert reviewer, not a machine-only score.
We may refuse or limit erasure or blocking where we have a legally acceptable justification. That includes: the data is still needed to perform the verification contract; to show a visit was booked and paid; to show a report and grade were issued; to keep Guide listing accurate; to satisfy tax or accounting rules; to investigate abuse; or to establish, exercise, or defend legal claims (including arguments about refunds, which our Refund Policy states are not available for review fees). Blocking, if granted, means we stop using the data except with your consent, for evidence, or to protect third-party rights.
These rights belong to the individual (for example the owner whose name and email we hold). A salon cannot use a privacy request to rewrite an expert grade or to force a refund. Grades and visit outcomes are professional records of the review, not a preference setting.
14. Your responsibility for what you upload and link
You must make sure that CR documents, photographs, logos, price lists, Google Maps links, and Instagram handles are accurate, that you have the right to give them to us, and that they do not unlawfully include someone else’s personal data. In particular:
- Do not upload client photographs unless every identifiable person has agreed to that use.
- If staff appear in salon photographs, you must have a lawful basis under Bahrain law to share those images with SOLA for verification.
- Do not upload another person’s identity document.
- Google Maps and Instagram are third-party sites. We store the links you provide; their privacy rules apply when you or we open those links.
If a third party complains that you uploaded their data without permission, we may remove the file, pause the application, and give the complainant our account of what we hold. You agree that SOLA may do so to comply with the PDPL and to limit harm.
15. Children and legal capacity
SOLA accounts are for salon businesses. They are not for children. Consent under the PDPL must come from a person with full legal capacity (or their lawful guardian). Do not create an account for anyone who cannot validly contract. We will close an account if we learn it was opened without capacity.
16. Changes to this Policy
We may update this Policy when the product, providers, or the law changes. The date at the top of this section is the current version. The latest text will always be at /policies#privacy. Material changes will be posted there. Where the law requires, we will also email the address on the account. Continuing to use SOLA after the updated date, or ticking agreement again at signup or payment, means you accept the updated Policy. If you do not agree, stop using the service and contact us to close the account.
17. Complaints and governing law
Please contact us first at hello@emberinnovations.dev so we can try to fix the issue. You also have the right to lodge a complaint with the Personal Data Protection Authority at the Ministry of Justice, Islamic Affairs and Waqf in the Kingdom of Bahrain if you believe we have breached the PDPL.
This Policy is governed by the laws of the Kingdom of Bahrain. Courts of the Kingdom of Bahrain have jurisdiction over disputes arising out of this Policy, without limiting any mandatory right you have to complain to the Authority.
18. How to contact us
Email hello@emberinnovations.dev with the subject line “Privacy request”, your salon name, and the email on the account. We may ask for extra identification before we release or change data, so we do not disclose a salon’s file to the wrong person.
