1. Who we are
Khesla (خصلة) is a platform that lets beauty salons send their clients a link to preview hair colours on their own photos. The salon then receives a text report of the client’s choice.
The platform is run by [Company name], Commercial Registration no. [CR number], based at [Address]. This policy covers the khesla.online website, the preview page a client opens from her salon’s link, and the salon dashboard.
2. The data we process
Client data
- The photo the client uploads, and the previews made from it.
- Her name (optional) and her mobile number or email, as the salon entered them to send the link.
- Her answer to “Is your hair coloured at the moment?”, and the approximate estimate of her hair level.
- The techniques and colours she tried, and the colour she chose.
- The session times, and her acceptance of this policy with its time and version.
- Her rating of the preview experience and her comment if she adds one; these are for Khesla only and the salon never sees them.
Salon user data
- The name, email and mobile number of each user of the salon dashboard.
- The sign-in log and important actions, such as creating links and credit movements, for security and accounting.
Data from people who write to us through the contact form
- Their name, salon name and mobile number, and the city and message if they add them.
- We use them only to reply to the message.
3. Why we process it
- To create colour previews on the client’s photo, and to check the photo’s quality.
- To send the preview link to the client by text message or email, as the salon chooses.
- To deliver the report of the client’s choice to the salon that sent the link.
- To calculate the salon’s credit and manage its account.
- To protect the platform and prevent misuse.
- To reply to people who write to us through the contact form.
We don’t use the data for advertising, and we don’t sell it to anyone.
4. The photo and previews
- The photo is used only to create the previews and to check its quality.
- Neither the photo nor the previews reach the salon or appear on any screen of its dashboard. The report it receives is text only.
- The photo, all its copies and every preview are deleted as soon as the choice is sent or the session ends, whether or not it was completed. A session lasts no more than one hour from the moment it starts.
- An automatic check runs every 5 minutes and deletes any photo older than 75 minutes.
- Photos are kept temporarily in private, encrypted storage outside backups, and are shown to the client through links that expire within 5 minutes.
5. Processing with AI
To create the preview and check the photo’s quality, we send the photo to AI model providers through an intermediary service, OpenRouter. Every request asks for providers that don’t collect data, and we never send the client’s name or contact details with the photo. Some of these providers may be located outside Saudi Arabia.
The preview is approximate, and no automated decision about the client is made from it; the final colour is decided with her colourist in the salon.
6. Who we share data with
- The salon that sent the link: receives the text report (the technique, the colour, what the client tried and a description of her hair), along with the name and contact details it entered itself.
- Service providers working for us: only as far as needed to provide the service (hosting, text messages, email, and AI image processing).
- The competent authorities: when there is a lawful request.
7. How long we keep data
| Data | Kept for |
|---|---|
| The photo and previews | Until the choice is sent or the session ends |
| The report: name, contact details and notes | 24 months after the session ends; then anything that identifies the client is deleted and only statistics remain |
| Log of messages sent | 90 days |
| Consent record | 24 months |
| Salon dashboard activity log | 12 months |
| Credit accounting records | As required by law |
| Contact form messages | 12 months, then deleted |
8. Cookies
We use strictly necessary cookies only: to run the preview session on the client’s device, and to sign in salon users. We use no advertising cookies, and no third-party tracking or analytics tools, on the preview page or on this website.
9. How we protect data
- Encrypted connections to the platform, and encrypted photo storage.
- Each salon’s data kept separate from every other, with permissions checked on every request.
- System logs contain no photos, preview links or contact numbers.
10. Your rights
Under Saudi Arabia’s Personal Data Protection Law, the owner of the data has the right:
- To know how their data is collected and used, which this policy explains.
- To access their data and obtain a copy of it.
- To ask for their data to be corrected or completed.
- To ask for their data to be destroyed when it is no longer needed.
- To withdraw their consent at any time. A client can also close the preview page before sending, and her photo is deleted when the session ends.
To exercise these rights, write to us at [Data protection email], and we will reply within [statutory period].
11. Contact us
- Data protection email
- [Email]
- Address
- [Address]
12. Changes to this policy
We may update this policy when the way the platform works changes. We publish the date of the last update at the top of this page, and ask the client for new consent after any material change.