Vagaro EU Client Data Checks

Vagaro and EU Client Data: What Small Salons Should Verify

EU client data is not only a legal topic for salons. It shows up in normal work: a client profile, a birthday field, allergy notes, patch-test comments, appointment history, SMS reminders, deposits, invoices, photos, forms, and the staff account that can open all of it.

That is why a salon using Vagaro should not ask only, "Is this software GDPR-ready?"

The better question is: "Can we explain where client data lives, who can access it, how we export it, what we keep, what we delete, and what happens if we move systems?"

This guide is written for small EU salons and spas reviewing Vagaro from a data-protection and migration-risk angle. It is not legal advice. It is a practical checklist for owners who need a cleaner conversation with their software vendor, accountant, lawyer, and team.

For the commercial side of the same decision, read the Vagaro total cost model. If you are already planning a switch, pair this with the Vagaro migration checklist.

Quick Answer

Before an EU salon relies on Vagaro for client data, it should verify five things directly from current vendor materials:

Check	Why it matters
Hosting and international transfers	Client data location affects the salon's risk review and paperwork.
Vendor terms	The salon needs to know the vendor role and obligations.
Export paths	A salon should know how to leave before it needs to leave.
Deletion and privacy-request workflow	Clients may request access, correction, deletion, or marketing opt-out.
Staff access and message content	Most data problems happen during daily work, not in the contract.

Vagaro's own GDPR page says data is stored on servers located in the United States. Its support documentation also describes customer-list exports and note exports. Those are useful starting points, but the salon should verify the latest terms and actual account behavior before making a decision.

1. Start With A Data Map, Not A Vendor Name

Make a one-page data map before comparing systems.

List the client data you hold:

• Name
• Phone number
• Email
• Address
• Birthday
• Appointment history
• Service history
• Notes
• Patch-test or sensitivity notes
• Photos
• Intake forms
• Consent forms
• Payment and invoice records
• Marketing consent
• SMS and email history
• Staff assignment or preferred provider

Then mark where each item lives today. Some fields are in Vagaro. Some may be in email, Instagram DMs, Google Drive, paper forms, spreadsheets, payment tools, or staff phones.

This matters because a vendor review only covers the data actually inside that vendor. If your most sensitive notes live in a shared inbox or notebook, changing salon software will not fix the larger privacy problem.

2. Verify Hosting And Transfer Language

For EU salons, data location is one of the first checks.

Vagaro's public GDPR page says that data is stored on servers located in the United States. That does not automatically mean the software cannot be used by an EU business, but it does mean the salon should verify the current transfer language, vendor terms, and any safeguards that apply.

Ask the vendor or review the current legal pages for:

• Where customer, staff, booking, payment, and message data is stored.
• Whether any EU, UK, or EEA-specific terms apply.
• Whether Standard Contractual Clauses or equivalent safeguards are referenced.
• Which connected services handle hosting, analytics, messaging, payments, support, and email.
• Whether data can be restricted by region.
• Whether backups follow the same location and retention language.

Do not treat a GDPR marketing page as the whole answer. A salon needs the operational answer as well: where the real booking data and client records sit, who touches them, and how long they remain there.

3. Check The Privacy-Request Workflow

Vagaro publishes support material for GDPR and information privacy requests by customers of a Vagaro business. The page says customers can request removal of personal identifying information and tells users to contact Vagaro Support for removal requests, with processing and response time language.

That is useful, but a salon still needs its own internal process.

Write down:

• Who receives a privacy request from a client.
• How staff verify the client identity.
• Which systems need to be checked.
• What cannot be deleted immediately because of invoices, payments, legal retention, memberships, packages, or future bookings.
• Who contacts the software vendor if vendor action is needed.
• How the salon records that the request was handled.

The salon is the business relationship the client knows. Even when a vendor has a support workflow, staff still need a clear script and owner.

4. Test Customer Export Before You Need It

A salon should test exports while things are calm, not after deciding to cancel.

Vagaro support documentation says the business owner can export the Customer List from reports as PDF or Excel, and that filters affect the exported list. Vagaro also has a Customer List Report that can be exported from the web version.

Run a test export and inspect:

• Which columns are included.
• Whether phone numbers keep country codes.
• Whether marketing consent is included.
• Whether tags are exported cleanly.
• Whether appointment counts and spend fields appear.
• Whether deleted or merged profiles are included.
• Whether filters accidentally exclude important clients.
• Whether the owner is the only person who can run the export.

Then save the export path in an internal admin note. Do not wait until the week of a migration to find out which account can export what.

If you later move to another CRM, this export test becomes the first step in your import plan. Tregovia's Data Import module can be evaluated for CSV import workflows, but the salon still needs to clean, map, and verify fields before importing anything.

5. Treat Notes As A Separate Risk

Client notes are often the most sensitive salon data because they are informal.

They may contain:

• Allergies
• Skin reactions
• Patch-test details
• Preferences
• Behaviour notes
• Payment concerns
• Complaint history
• Health-adjacent details
• Personal comments staff should not have written

Vagaro support documentation says customer notes can be downloaded or exported on the web version, and that all of a customer's notes are exported to Excel or printed regardless of note category, with optional filters.

That makes note review important before any migration.

Decide:

• Which notes should move into a new CRM.
• Which notes should be archived only.
• Which notes should be rewritten in a more professional format.
• Which notes should be deleted under your retention policy.
• Which staff roles should be able to see sensitive notes.

For daily salon operations, notes can be as important as phone numbers. For privacy, they can also be the highest-risk field in the system.

6. Review SMS, Email, And Marketing Consent

Messaging is where CRM data becomes visible to clients.

Check:

• Which messages are transactional and which are marketing.
• Whether clients opted in to marketing.
• How unsubscribes are handled.
• Whether staff can edit templates.
• Whether SMS templates include sensitive details.
• Whether appointment reminders expose service details a client may consider private.
• Whether old campaign lists should be carried into a new CRM.

A simple rule helps: keep SMS short and operational. Avoid sensitive service details in text messages unless you have reviewed the policy and client expectations.

In Tregovia, evaluate messaging as part of the wider client workflow: client record, appointment, reminder, billing context, and consent process. That does not remove the salon's responsibility for consent, message wording, and staff policy.

7. Check Staff Access Before Importing More Data

Data protection is not only about servers. It is also about who can open the client profile on Monday morning.

Before staying with Vagaro or moving to another CRM, review:

• Every active staff account.
• Old employees who still have access.
• Shared logins.
• Owner-only settings.
• Manager permissions.
• Export permissions.
• Payment-report access.
• Client note visibility.
• Mobile app access.
• Password and two-factor settings.

If your salon uses one shared login at the front desk, fix that before importing more detailed notes or forms into any system.

Tregovia uses role-based access across tenant accounts, with routes and backend guards tied to staff roles. Public content should still stay conservative: role-based access helps structure permissions, but each salon must configure staff access correctly.

8. Forms, Photos, And Consent Need Their Own Plan

Forms are easy to overlook because they feel like attachments to the client profile. In practice, they have their own lifecycle.

For each form type, decide:

• Why you collect it.
• Whether it is still needed.
• How long you keep it.
• Who can view it.
• Whether clients can update it.
• Whether old submissions should be imported or archived.
• Whether photo consent is separate from treatment consent.

If forms are a key salon workflow, Tregovia's Client Forms add-on is the area to evaluate. It supports intake forms, consent forms, questionnaires, client links, submissions, and review workflows. Historic form migration should still be tested separately from client-list migration because form templates and form submissions rarely map cleanly without review.

For a practical field list, use the nail salon client intake checklist before rebuilding forms.

9. Watch The Cancellation Moment

The time to understand export and retention is before cancellation.

Vagaro support documentation about cancelling or pausing a subscription recommends exporting or printing sales data and customer lists before cancelling. That is a strong operational signal for any salon reviewing its data posture: keep your own records in order before account access changes.

Before cancelling any salon system:

• Export customer lists.
• Export notes where needed.
• Export sales and tax reports.
• Export unpaid balances.
• Export future appointments.
• Save form submissions or archives.
• Download policy, vendor, invoice, and subscription records.
• Confirm how long account access remains available.

Then store the files somewhere controlled, not on a staff member's desktop.

Review Tregovia As The Receiving Workflow

Tregovia should be evaluated as the receiving operating workflow, not as a shortcut around data responsibility.

Use a receiving-workflow review:

• Can exported client records be mapped cleanly before import?
• Can staff find future appointments, notes, billing context, and booking history from the client record?
• Can reminders stay transactional instead of blending into marketing?
• Can forms, photo permission, and sensitivity notes be reviewed separately?
• Can booking links, deposit rules, no-show review, and waitlist process be rebuilt from salon policy?
• Can old records be archived instead of forcing everything into the daily CRM?

The safest public claim is simple: Tregovia can be evaluated as a CRM workflow for salons that want client records, scheduling, billing, messaging, booking rules, reports, and forms in one operating environment.

Tregovia does not guarantee GDPR compliance. Compliance depends on lawful basis, vendor review, retention policy, staff permissions, message wording, training, and professional advice.

Start from Tregovia pricing, then model migration work alongside subscription cost. Use the Vagaro migration checklist for field mapping and cutover planning.

A Practical Review Worksheet

Use this worksheet before renewal, cancellation, or migration.

Question	Answer to document
What client data do we store?	List fields, notes, forms, photos, billing, and messages.
Where is it stored?	Vendor systems, email, files, paper, devices, spreadsheets.
Who can access it?	Owner, managers, front desk, staff, contractors.
How do we export it?	Exact report path, format, owner, limits.
What do we delete or archive?	Retention policy by data type.
What changes during migration?	New CRM fields, roles, imports, forms, booking links.
What needs professional review?	Vendor terms, transfer safeguards, tax records, payment records.

If you cannot answer a row, that is the next action.

Common Mistakes

• Asking "is it GDPR-ready?" without checking the actual terms.
• Forgetting that staff notes may contain sensitive information.
• Assuming customer export includes every operational field.
• Cancelling before exporting sales and customer records.
• Moving old marketing lists without reviewing consent.
• Importing duplicate clients into a new CRM.
• Giving every staff member broad access because it is faster.
• Putting private service details in SMS templates.
• Treating forms as part of the customer export without testing.
• Claiming a CRM solves legal compliance on its own.

Data Review Rules To Keep

• Vagaro publishes GDPR, privacy, customer export, note export, and cancellation guidance that EU salons should review directly.
• Vagaro's GDPR page says data is stored on servers located in the United States, so EU salons should verify current transfer safeguards.
• Customer lists, notes, forms, future appointments, billing records, and message history need separate export and retention decisions.
• Tregovia can be evaluated as a CRM workflow for client records and salon operations, but it should not be positioned as a compliance guarantee.
• A salon should test exports, clean data, review staff access, and document privacy-request handling before migration.

EU Data Questions Salon Owners Ask

Is Vagaro GDPR-ready for EU salons?

Vagaro publishes GDPR and privacy materials, but an EU salon should still verify the current terms, hosting location, connected services, transfer safeguards, retention language, export options, and deletion workflow before relying on any vendor.

Where does Vagaro say data is stored?

Vagaro's GDPR page says data is stored on servers located in the United States. EU salons should verify whether this is still current and what transfer safeguards apply before choosing or staying with the platform.

Can salon customer data be exported from Vagaro?

Vagaro support documentation says the Customer List can be exported from reports as Excel or PDF by the business owner. Customer notes have their own export path on the web version, so notes should be tested separately.

What should an EU salon check before moving data to Tregovia?

Check lawful basis, retention rules, consent status, staff permissions, duplicate records, note sensitivity, form history, future appointments, billing records, and whether exported fields map cleanly into the receiving CRM.

Does Tregovia guarantee GDPR compliance?

No. Tregovia can be evaluated as a CRM workflow for client records and operations, but the salon still needs professional review, vendor review, staff policy, retention decisions, and careful configuration.

Final Data Check

Vagaro and EU client data should be reviewed through the real salon workflow: what data is collected, where it is stored, who can access it, how it is exported, how long it is kept, and what happens when the salon changes systems.

The safest next step is not a software slogan. It is a documented data map, a tested export, a staff access review, a privacy-request process, and a migration plan that keeps client records, notes, forms, appointments, billing, and messaging under control.