Pankiman

Privacy policy

This policy explains what information Pankiman holds, why it is held, where it is stored, and how it is deleted.

Effective 3 October 2026.

What Pankiman is

Pankiman is salon and small-business management software. A salon uses it to keep its own working records: customers, appointments, services, staff, completed service history, work photos, expenses, and a record of how each service was paid for.

Two different kinds of people appear in this policy. You, the person who signs in, have a Pankiman account. The salon you work in has business records, which the salon's own team enters and owns. Pankiman holds those records so the salon can run; the salon decides what goes into them.

Your account

Signing in to Pankiman involves:

  • your email address and a password you choose
  • a verification code sent to your email when you create the account or recover a password
  • your authenticator enrolment, if you set one up — Pankiman uses it to protect sensitive actions such as deleting an account or a salon
  • the sessions that keep you signed in on your devices
  • a profile name and your chosen interface language

Your account also records which salons you belong to and your role in each one — owner, manager or staff — including invitations that were sent to you and access that was revoked.

Pankiman stores a password in the form kept by its authentication provider, not as text anyone can read. Nobody at Pankiman can see your password, your authenticator secret, or any one-time code.

Salon business records

A salon's records in Pankiman can include:

  • the salon's own settings, such as its name, time zone, currency and opening hours
  • its service list and prices
  • its team: staff identities, roles, commission arrangements and invitations
  • its customers — typically a name, and whatever contact details the salon chooses to record
  • appointments and the services booked on them
  • completed services, including which services were performed, by whom, what was charged, and the commission recorded at the time
  • photos of completed work
  • expenses and payment records

Customer information is entered by the salon's own team. If you are a customer of a salon that uses Pankiman and you want your details changed or removed, ask the salon first — they control their own records. You can also write to us and we will help the salon act on it.

Photos

A salon can attach photos of finished work to a completed service. Those photos may show a customer's hands, hair, nails or similar, so they are treated as part of the salon's customer records.

A photo you take in the app is first written to a staging area on your own device, then uploaded. Staging is what lets a photo survive a lost connection or a closed app. Staged photo files are ordinary image files on the device; they are not separately encrypted by Pankiman, and they rely on the protection your device gives to an app's private storage. They are removed once the upload completes, and also when you sign out, delete the salon or delete your account.

Uploaded photos are stored with the rest of the salon's records and are deleted when the salon or the service record they belong to is deleted.

Payments

Pankiman records how a service was paid for — whether payment was received, the method the salon chose, and the amount recorded against the service. A salon may also store a payment QR image belonging to its own bank or wallet account.

Pankiman does not take custody of anyone's money. It does not move funds, hold balances, settle payments or act as a payment processor. Money passes directly between the customer and the salon, by whatever means they use. Recording a payment in Pankiman is bookkeeping, not a payment.

Pankiman does not collect or store card numbers, bank credentials or wallet credentials.

Why this information is used

  • to provide the salon-management features the salon signed up for
  • to keep a usable history of appointments, completed services and payments
  • to let a team work together with the right access for each role
  • to sign you in, keep you signed in, and protect sensitive actions with your authenticator
  • to keep the service working — synchronising your device with the salon's records, retrying an upload that failed, and recovering work that was interrupted
  • to act on deletion and privacy requests

Pankiman does not use this information for advertising, does not build behavioural profiles, and does not sell it.

What is stored on your device

So the app works while you use it, Pankiman keeps some things locally:

  • your sign-in session, so you do not have to sign in again each time. It is held in encrypted form, and the key that protects it is kept in the secure storage your device provides
  • drafts of a service you are in the middle of recording, also held in encrypted form, so an interrupted entry is not lost
  • photos staged for upload, and a note of which upload is still outstanding
  • your interface language, which is a device preference rather than account data

Signing out clears this device's copy of your working state. The session, the drafts, the staged photos and the outstanding-upload records are removed, and only the interface language is kept. If you have photos that have not finished uploading, the app tells you how many before you sign out, because signing out discards them. Deleting your account clears the same local state.

Where information is stored

Pankiman uses Supabase to provide backend database, authentication, and cloud storage services.

Beyond that, Pankiman does not share salon or customer information with third parties, except where it is needed to answer a request you make or where the law requires it.

International data transfers

Pankiman relies on third-party providers for the parts of the service it does not run itself: the backend database, authentication, cloud file storage, the email that carries verification and recovery messages, and related infrastructure.

Those providers operate in more than one country. Information held in Pankiman — your account details, and the business records a salon keeps — may therefore be processed or stored in a country other than the one you or your salon are in.

Where that happens depends on the provider, and can change when a provider changes its own infrastructure. This policy does not name a processing country, because doing so would state something Pankiman cannot keep accurate for every provider at every moment.

If you need to know where information about you or your salon is processed, write to privacy@pankiman.com and we will tell you what we know.

How long information is kept

Information is kept while the relationship that needs it continues, and is removed by the deletion you choose. Pankiman does not keep a fixed countdown on business records: a salon's books exist for as long as the salon does.

  • Your account exists until you delete it. Deleting it removes your login, your authenticator enrolment, your sessions, your profile, your access to every salon, and this device's local copy of your data.
  • A salon's records exist until the salon is deleted. They do not belong to any one login, so deleting only your personal account does not delete them.
  • Work recorded under your name stays with the salon after you delete your personal account — the completed services, the amounts charged and the commission recorded at the time. The salon still needs these for its own books. Your name remains on them as a business record; your login and profile do not survive.
  • Deleting a salon removes its records and its stored files, including service photos and payment QR images.

Where the law requires a particular record to be kept for a period, that requirement applies regardless of this policy.

Deleting your account or your salon

There are four outcomes, and you choose which one you want:

  • Delete your personal account. Available when deleting it would not leave a salon without an owner.
  • Transfer ownership, then delete your account. For an owner who wants the salon to carry on under someone else.
  • Delete the salon only. The salon and its records go; your personal Pankiman account stays.
  • Delete the salon and your account. Both go together. No ownership transfer is needed for this one.

A salon is never deleted just because someone asked to delete a personal account. The combined option has to be chosen deliberately. Deleting a salon does not delete the personal Pankiman accounts of the people who worked in it — only their access to that salon.

How to delete your account

Your requests

You can ask what information is held about you, ask for a correction, or ask for deletion. Write to privacy@pankiman.com from the email address on your Pankiman account, so we can tell who is asking.

Where a request concerns a salon's customer records rather than your own account, the salon decides — we will pass the request on and help them act on it.

Never send us secrets

Pankiman will never ask for these, and you should never put them in an email:

  • your password
  • a one-time code sent to you
  • an authenticator or TOTP code
  • recovery codes or recovery links
  • access or refresh tokens

A request that contains any of these will be refused and the message deleted.

Children

Pankiman is a tool for running a business and is not intended for children. Accounts are for the people who work in a salon.

Changes to this policy

When this policy changes, the effective date at the top changes with it. A change that materially affects what is held or why will be announced in the app.

Contact

Privacy questions and requests: privacy@pankiman.com