Customer data and privacy basics

Client names, phone numbers and addresses are personal information. Pasting them into a chat tool sends them to someone else's computer. Usually you don't need to. Don't.

The simplest habit

Write the question without the person in it. "A client asks whether her dog can come on Friday" gives a tool everything it needs. Add the name, number and dog's name yourself afterwards.

Australia's regulator says privacy duties follow personal information into an AI system¹. It also advises organisations to avoid typing personal details, sensitive ones above all, into public AI chatbots¹. That's a recommendation and not a ban, but it shows which way to lean.

Free tools and paid tools differ

A free public chatbot and a business plan with a written agreement are not the same. Read the maker's privacy terms for the exact plan you use. Look for who can see what you enter, whether it's kept, and whether it's used to train the tool. Terms change, so read them again now and then.

Ask the same questions of booking software, answering services and reminder tools. They hold your whole client list.

Do the privacy laws cover you?

It depends on where you are and how big the business is. In Australia, the regulator says most small businesses aren't covered by the Privacy Act 1988, though some are². It defines a small business by annual turnover of $3 million or less². The page lists the exceptions, so read it for your case.

Being outside the law doesn't make careless handling a good idea. Clients still expect care. Wouldn't you?

In the United States and the United Kingdom, the rules are different. In the United Kingdom the ICO publishes AI and data protection guidance, which it says is under review and may change³. In the United States, the FTC has a guide for businesses on protecting personal information⁴. This site can't say what applies to you. Start at the regulator's own page.

Habits that help in any country

The FTC's guide sets out five short steps for personal information⁴. Here's how each looks in a grooming shop.

• Take stock. The FTC's first step is to know what personal information you have in your files and on your computers⁴. List where client details live: the booking app, your phone, a paper diary, a shared drawer.
• Scale down. The FTC's second step is to keep only what you need for your business⁴. If you don't use a birth date, don't ask for one. Under this step the FTC also names the "principle of least privilege": each employee should have access only to those resources needed to do their particular job⁴. A weekend helper may not need the whole client list.
• Lock it. The FTC's third step is to protect the information that you keep⁴. Our own suggestion: keep client details to the people who need them.
• Pitch it. The FTC's fourth step is to properly dispose of what you no longer need⁴. Our own suggestion, not the FTC's: shred old paper forms and delete old exports.
• Plan ahead. The FTC's fifth step is to create a plan to respond to security incidents⁴. Our own example, not the FTC's: decide now what you'd do if a phone with client messages were lost.

Keep a person in the loop

Don't let a tool send messages or change records by itself unless you've checked how it works. The Australian guidance asks businesses to build human oversight into their processes¹. At a small salon, that means you read it before it goes out.

Staff need the rule too

A rule only you know isn't a rule. Write two lines for anyone who works the desk: what may be pasted into a tool, and what may not. Pin it up.

Answering booking messages shows what a no-names draft looks like in practice.