In plain words
- Joining a line takes a first name. A mobile number is optional and only used for texts about that visit, if you tick the box.
- We delete names, phone numbers and visit links 30 days after the visit. We keep a scrambled code of the phone number so STOP keeps working and a number cannot hold two places in line.
- We never sell your information, and we never share mobile numbers for marketing.
- Shops see the first names and numbers of people in their own line. We are the service provider that runs the line for them.
- You can delete your information from the status page at any time, or write to our support email (coming soon).
Who we are
Walk-In Waitlist is a walk-in waitlist for barbershops, salons, spas, studios and other walk-in businesses ("shops"). It is run by Kallos Labs LLC, a company organized in Puerto Rico ("we", "us"). This policy explains what personal information we handle through the website, the join and status pages, the staff app for iOS and Android, our text messages and our emails.
Questions or requests: our support email (coming soon).
Two kinds of people use the service
Customers of shops join a shop's line from a QR code or a link, and may get texts about that visit. Customers do not create an account.
Shop owners and their team ("staff") sign in with an email code to run the line, set up the shop and pay for the service.
When a shop uses Walk-In Waitlist to run its line, the shop decides why its customers' information is collected, and we process it on the shop's behalf (we are its service provider, or "processor"). Our Data Processing Addendum covers that relationship. For a few things we decide ourselves (keeping the list of numbers that replied STOP, the records that prove consent to texts, security logs, our own website and our relationship with shop owners), we are responsible directly. This policy covers both.
What we collect from customers
| Information | When | Why |
|---|---|---|
| First name | You join a line, or staff add you at the counter | So the shop can call you |
| First names of people joining with you | You add someone, for example a child getting a haircut | So the shop knows how many people are waiting |
| Mobile number (optional) | You give it to get texts | To send texts about this visit only, and only with your consent |
| Your consent to texts | You tick the unchecked box on the join page | Proof of consent: the exact text you agreed to, its version, the language, the time, a scrambled code of your IP address and your browser's user agent |
| Visit details | While you are in line | The service and team member you picked (or "anyone"), your place, the times you joined, were called and were served, and how the visit ended |
| A private visit link | When you join | A random link to your status page; we store only a scrambled code of it |
| A scrambled code of your IP address | When you join | To limit how often one connection can join (abuse protection); we never store the address itself |
| Replies to our texts | If you reply | To honor STOP and answer HELP |
We do not ask for your last name, email, address, birthday or payment details, and we do not use your location.
A shop's staff can also add you to the line at the counter. If they enter your mobile number, the shop must have your permission to text you, and the same consent record is kept.
What we collect from shop owners and staff
- Account: your email address (to send sign-in codes) and the name shown in the shop.
- Shop details: shop name, link name, logo, business type, address and phone if you add them, hours, services, team members and their status, time zone, language and settings.
- Texting registration: US carriers require every business that texts to register. For that we collect the business's legal name, EIN (or that it has none), the owner's name, email, phone and business address, and website. We send them through our texting provider to The Campaign Registry and the carriers. Staff screens show only the last 4 digits of the EIN.
- Billing: Stripe collects and stores card details for us. We keep only Stripe's customer and subscription ids, the plan, the seat count, the billing status and dates. We never see or store full card numbers.
- Terms acceptance: the version of the Terms of Service accepted when a shop was created, when, and by which account.
- Activity: the queue changes staff make (who notified, started or finished a visit) for the shop's history and daily numbers.
Information collected automatically
- Website and join page: our hosting provider receives your IP address and browser details to deliver the pages and keep them secure. The join page uses Cloudflare Turnstile to tell people from bots (see Cookies).
- Analytics: on our marketing, legal and guide pages only, and only if you accept analytics cookies, Google Analytics measures visits. It never runs on the join page, the status page, the staff pages or the admin pages. See Cookies.
- Cookies and storage: a language cookie, sign-in cookies on the staff pages, and local storage that remembers your visit on your own device. The Cookie Policy lists each one.
- The app: the staff app does not include analytics or advertising tools and does not track you across other apps.
How we use information
- To run the line: show your place and wait estimate, let staff call you, and send the texts you agreed to.
- To prevent abuse: limit how often one connection can join, block bots and stop texts to numbers that opted out.
- To keep records the law asks for: consent to texts, opt-outs, invoices and tax records.
- To support shops: sign-in, setup, billing, the texting registration and support requests.
- To improve the service: counts and averages such as visits per day, wait accuracy and texts sent, without names or numbers.
- To communicate with shop owners: sign-in codes, billing and service notices (see the Email Policy).
We do not use customer information for advertising, we do not build profiles of customers across shops, and we do not use it to train artificial intelligence models.
Why we are allowed to use it
We use information to provide the service you asked for (joining a line, running a shop), with your consent (texts, analytics cookies), for our legitimate interests in keeping the service secure and working, and to meet legal duties (consent and tax records).
Text messages
Texts are only about the visit you joined, at most 3 per visit, and only if you ticked the box. Reply STOP to stop and HELP for help. The Messaging Terms explain the program in full.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.
Our texting provider receives your number and each message only to deliver it.
Who receives information
- The shop you joined sees your first name, the people with you, your visit details and your mobile number (team members who are not owners see a partly hidden number). Shops cannot see your information from other shops.
- Service providers that host, deliver or secure the service for us, under contracts that limit their use to our instructions. The Subprocessors page lists each one, what it receives and where.
- Our platform administrators can see shop, billing and team details to support shops. They cannot see customer names, phone numbers or text messages.
- Authorities, when the law requires it, or to protect the rights, property or safety of people or of the service.
- A buyer or successor, if the company or the service is sold or merged, under this policy.
We do not sell personal information and we do not share it for cross-context behavioral advertising.
How long we keep it
| Information | How long |
|---|---|
| Customer first names, mobile numbers, visit links and IP codes | Erased 30 days after the visit (the default; a shop can choose between 1 and 365 days), or right away with "Delete my info" |
| Visit links | Stop working about 12 hours after the visit ends; their codes are erased a day later |
| Text message bodies and the number they went to | Erased after 30 days; delivery status and cost stay for billing |
| Replies to texts | Deleted after 90 days |
| Scrambled phone code | Kept, so STOP keeps working, one number cannot hold two places in one line, and repeat visits can be counted without knowing the number |
| Consent records for texts | About 4 years, the period in which a claim about texts can be made |
| Visit counts and times without names | Kept for the shop's history and statistics |
| Customer data of a shop whose subscription has been suspended | Erased after 90 days of suspension |
| Staff accounts | Until the account is deleted (Delete your account) |
| Billing and tax records | As long as tax and accounting law requires |
Your choices and rights
- Delete your visit information now: open your status page and choose "Delete my info". It removes you from the line and erases your name, number and link right away.
- Stop texts: reply STOP (or PARAR) at any time. START turns them back on.
- Cookies: accept or reject analytics in the cookie banner, and change your mind with "Cookie settings" at the bottom of the page. We treat the Global Privacy Control signal as "Reject all".
- Access, correction or deletion: write to our support email (coming soon). Tell us the shop and the date of your visit, or your account email. We may need to confirm it is you, for example with a code sent to your number or email. Because shops decide why their customers' information is collected, we may pass your request to the shop and help it answer.
- Staff accounts: delete your account in the app or on the website (Settings, then Account). See Delete your account.
Depending on where you live, US state laws (for example in California, Colorado, Connecticut, Virginia and other states) may give you the right to know, access, correct and delete your personal information, to get a copy, and to opt out of its sale, sharing for targeted advertising or profiling. We do not sell or share personal information in those ways. We will not treat you differently for using your rights. You can appeal a decision by replying to our answer; if we still say no, you can contact your state's attorney general.
Children
The service is not directed to children under 13, and children under 13 should not use it themselves. A parent or guardian may add a child's first name to a visit (for example a child getting a haircut); that name is handled and erased like any other visit information. We do not knowingly collect personal information from children under 13 in any other way. If you think a child gave us personal information, write to our support email (coming soon) and we will delete it.
Security
Information is stored with our database provider in the United States, encrypted in transit and at rest. Each shop's information is separated by database access rules, so a team member only reaches the shops they belong to. Phone numbers and IP addresses used for limits and opt-outs are kept as keyed codes that cannot be turned back into the number without a secret key. Staff sign in with one-time email codes, and the staff app can be locked with a PIN on shared devices. No system is perfectly secure; tell us right away at our support email (coming soon) if you find a problem.
If there is a data breach
If a breach affects personal information, we will tell the affected shops without undue delay so they can act, and we will help them notify their customers. When a breach involves personal information as defined by Puerto Rico Act 111 of 2005 or by another state's breach law, we will notify affected people as that law requires and, for Puerto Rico residents, the Department of Consumer Affairs (DACO) within 10 days of detecting it.
Where information is processed
We and our providers process information in the United States, including Puerto Rico. If you use the service from elsewhere, your information is transferred to the United States.
Changes to this policy
We will post any change here with a new version number and date. If a change materially affects how we use information already collected, we will tell shop owners by email or in the app before it takes effect.
Contact
Kallos Labs LLC, our support email (coming soon).
Change log
- Version 1.0, October 1, 2026: First version.
Questions about this page? Write to our support email (coming soon).