Privacy policy

Data controller

The controller of personal data collected through this website is Musito Adam Muszalik, ul. Powstańców Śląskich 96, 44-177 Paniówki, Poland, VAT ID (NIP) 6431657937.

For any matter concerning personal data, write to adam@musito.pl.

This website

musito.pl sets no cookies, collects no visit statistics, does not profile visitors and embeds nothing from third-party services. Typefaces are served from the same server as the page, so opening this site sends no data to anyone else.

The hosting provider records the IP address, time and type of each request in its technical logs. That data is necessary to provide and secure the hosting service (Art. 6(1)(f) GDPR — legitimate interest).

Email and telephone contact

If you write or call, the data in your message is processed to reply and, where relevant, to prepare an offer — on the basis of Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (conducting correspondence).

Correspondence is kept for the duration of the discussion and then for two years, unless a contract is signed — in which case for its term and the limitation period for claims.

Data inside musito studio

Within musito studio, the controller of the salon's client data is the salon itself. Musito processes that data solely on the salon's documented instructions, under a data processing agreement concluded pursuant to Art. 28 GDPR.

In practice this means requests concerning a client's data — access, rectification, erasure — go to the salon first. Musito carries them out on the salon's instruction and helps the salon fulfil them.

Each salon's data is isolated at the database level. A salon has no technical means of seeing another salon's data.

Sub-processors

Providing the service relies on infrastructure providers: application and database hosting, file storage and an SMS gateway operator. Each processes data only under a processing agreement and only to the extent needed for its own service.

The writing assistant and graphic generation rely on AI model providers. They receive only what the salon submits when it presses the button — its own draft or posts, its service and offer details, and the reference images it has chosen, which may not show people. Client records are never sent to them.

The current list of sub-processors is made available to salons before a contract is signed, on request, and whenever it changes.

Integrations with third-party services

A salon may connect musito studio to its own profiles on third-party services — its Google Business Profile and its Facebook and Instagram accounts. The connection is made only by the salon's explicit action, through that service's standard authorisation flow, and can be withdrawn at any time.

Once connected, musito stores the connected profile's identifier and name and an access token. Profile details, statistics and recent posts are read to show them to the salon and are not stored. Copies are kept only of what the salon itself chooses to publish or import — the full list is on the Data deletion page.

What is sent to those services is salon business data — opening hours, and posts the salon has approved. Client personal data is not sent, with one exception: a photo of a client's hair that the salon publishes with that client's recorded consent.

Disconnecting is possible both inside musito studio and on Google's or Meta's side. Disconnecting inside musito studio also revokes musito's access on the platform's side and deletes the token and the profile identifiers immediately.

Transfers outside the EEA

Some infrastructure providers may process data outside the European Economic Area. Such transfers take place on the basis of Standard Contractual Clauses approved by the European Commission.

Your rights

You have the right of access to your data, to rectification, erasure or restriction of processing, the right to data portability, and the right to object to processing based on legitimate interest.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise any of these rights, write to adam@musito.pl. I respond within one month of receiving the request.

Deleting your data

Instructions for deleting data — including data obtained by connecting a Facebook or Instagram account — are on a separate page: Data deletion.

Changes to this policy

This policy is updated whenever the scope of the service or the list of sub-processors changes. The date of the last update is at the top of this page.