Privacy Policy
Lour - لور Privacy Policy
Effective date: 7 September 2026
1. Who we are and scope
This Policy explains how the operator of Lour - لور collects, uses, shares, retains, and safeguards personal data across the mobile application, website, and customer, salon, and administration tools. It is designed with Syrian Personal Data Protection Law No. 12 of 2024 and its applicable instructions, Cybercrime Law No. 20 of 2022, and relevant consumer and electronic-transactions rules in mind. Salons also handle customer booking data to deliver services and must follow platform instructions and applicable law.
2. Account and device data
We may process your name, normalized phone number, country code, last four digits, verification status, city, optional gender, language, notification choices, and a strong one-way password hash rather than a readable password. We process session, device, platform, reduced or hashed network identifiers where appropriate, login failures, lockouts, and security audit events. A database uniqueness control prevents the same normalized phone number from creating two identities.
3. Location
With permission, the application uses device location while in use to sort nearby salons, calculate distance, and support map views. A saved-address book is not required. You may deny access and manually select an available city. Precise location is not used for advertising and is not collected in the background unless a separate feature, notice, and permission are provided. A salon location pinned by its owner becomes part of the public listing after approval.
4. Booking and business data
We process the salon, services, professional, appointment time and branch timezone, policy, price, currency, status, cancellation or reschedule requests, reviews, and waitlist entries. Business data can include salon names, descriptions, address, coordinates, contacts, hours, chairs, staff, permissions, services, accepted currencies, subscription, invoices, collections, and reports. We do not ask for health data; unnecessary sensitive information sent to support may be removed or access-restricted.
5. Media and content
The platform may process salon imagery, logos or visual identity, portfolios, avatars, payment receipts, review attachments, and advertising creatives. Files are validated for type, size, and technical content and stored using controlled keys and expiring signed links. They are not used to train general-purpose models or for unrelated purposes without an appropriate legal basis and notice.
6. Support communications
When you open a support request, we process its subject, category, messages, attachments, status, sender identity, and read or reply timestamps. Only authorized administrators can access the support inbox. Data is used to resolve the issue, prevent abuse, improve the service, and document complaints. Never submit passwords or full payment-card details.
7. Purposes and legal bases
We use data to create, verify, and secure accounts; provide customer mode and salon workspaces; operate discovery, proximity, booking, and reminders; manage subscriptions and invoices; review salons and content; deliver requested notifications; answer support; prevent abuse; create aggregate performance reporting; comply with valid legal duties; and establish or defend rights. Depending on context, the basis is contract performance, steps requested before contracting, consent for optional features, legal obligation, or a proportionate legitimate interest in security and service improvement.
8. Advertising and analytics
City, language, audience, and placement may be used to choose an eligible advertisement, enforce frequency limits, and record impressions or clicks. We do not sell phone numbers or allow an advertiser to contact you merely because you viewed an ad. Random or aggregate identifiers are used where possible. Marketing can be disabled in preferences without disabling necessary booking and security communications.
9. Recipients
We provide the minimum necessary booking data to the relevant salon and professional. Data may also be handled by contracted hosting, storage, communications, mapping, notification, and payment providers when enabled, and by professional advisers or competent authorities where a valid legal requirement applies. Personal data is not disclosed in return for sale. Administrative access is role-limited and audited.
10. Storage and international transfers
Hosting and processing locations are governed by operational settings and contracts. If data is transferred outside Syria, we use safeguards and mechanisms permitted by personal-data law and assess the recipient, purpose, and security. Enabled external services may process network addresses or device identifiers under their policies and are activated only after suitable configuration and disclosure.
11. Retention
Account data is retained while the account is active and for a period needed to close it and resolve claims. Booking, invoice, and audit records are retained for applicable legal, accounting, contractual, and fraud-prevention periods and then deleted or de-identified. Slot holds, sessions, and tokens use short operational lifetimes and expire or are revoked. Support requests are normally retained for up to three years after closure unless a complaint or legal rule requires a different period. More specific schedules can be configured but cannot override mandatory retention.
12. Security
Controls include encrypted transport; recoverable phone encryption plus a unique keyed lookup hash; memory-hard password hashing; rotating refresh sessions and device revocation; rate limits and lockouts; branch isolation; backups; signed media URLs; audit records; and least-privilege access. No system is risk-free. We investigate and contain incidents and notify authorities and affected people where law requires.
13. Your rights
Subject to legal conditions, you may ask what data is processed; request access and correction; update preferences; withdraw optional consent; object or request restriction; request deletion where no lawful retention reason remains; and receive a usable copy where applicable. You can revoke sessions and change your password in the application. Submit requests through Support. Identity may be verified, and any lawful refusal will be explained. Exercising a right will not be penalized.
14. Children
The service is not intended for independent child accounts without legally valid supervision. If we learn that a child’s data was collected without an appropriate basis or authorization, we restrict the account and take steps to delete it or obtain authorization. Children’s data is not used for behavioral advertising.
15. Automated processing
Algorithms may rank salons by proximity, rating, or availability and select eligible advertising. They do not independently make a legal or similarly significant decision about you. Material salon approval and account restriction have human authority and a support path.
16. Device choices
Location and notification permissions can be changed in device settings, and language, theme, and marketing choices can be changed in the application. Blocking notifications may cause you to miss an alert, but appointment status remains available in the app. Removing the application does not close the account; data remains until closure is requested or the retention period ends.
17. Updates and contact
Changes are published with a version and effective date, and material changes are highlighted. Arabic and English versions are available and the app displays the selected language. For questions, complaints, or rights requests, open Support and select the Privacy category. The message, status, and administrator reply remain visible in the application.
Geographic data sources: City coordinates/names: GeoNames (https://www.geonames.org/); Arabic locality names: OpenSyria Data Geography (https://opensyria.org/datasets/geography), using nearest released locality within 5 km. Derived city catalogue; OpenSyria records trimmed to the city name where applicable. Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).