Cary Studio
A custom PHP platform for a curative pedicure salon in Bistrița: online booking with real availability, an in-house shop with Netopia card payments and SmartBill invoicing, QR-coded gift vouchers, and a PWA through which the team runs the salon from a phone — including scanning vouchers at the front desk.
Who the client is and what they wanted
Cary Studio is a curative, aesthetic and SPA pedicure salon in Bistrița — certified organic products, reflexology included in every session, and sterilisation to the legal protocol. It handles cases an ordinary salon refers elsewhere: callus and hard skin, plantar warts (HPV), fungal infections, onycholysis, ingrown nails.
They came to us with a simple problem: appointments arrived by phone and message, with all the back and forth that entails. They wanted a calendar people could book from themselves — day, time and treatment.
Once that was solved, the rest surfaced one at a time. They wanted to sell the products they use in the salon. Then the home-care courses. Then gift vouchers, because people kept asking for them before the holidays. And at some point it became clear the team needed something other than an admin panel built for a desktop: they needed something on a phone, usable between two clients.
Each step exposed the limits of off-the-shelf solutions. A booking plugin knew nothing about buffer time between sessions. A standard shop could not issue vouchers that validate at the front desk. That is why the platform is written from scratch, in PHP, shaped around how this salon actually works.
The solution we delivered
We built a complete platform in PHP 8.2 and MySQL — no WordPress, no framework — code written for this salon's workflow, covered by 250 automated tests and shipped through versioned database migrations.
A public site built for the searches that matter
Nine treatments, each with its own page, written in the words people actually search when something is wrong: plantar wart treatment, callus removal, nail fungus treatment, onycholysis, nail prosthetics — each with the city in the title. Someone searching for a specific condition lands on the page that solves it, not on a generic service list.
On top of that: structured data on every page, a dynamic sitemap, inlined critical CSS, lazy images, compression and caching at server level. A full SEO audit surfaced 23 issues — from HEAD requests returning 404 site-wide, to the www variant duplicating every page, to a 391 KB logo cut down to 10 KB. All fixed.
Online booking with real availability
A four-step wizard — day, time, treatment, your details — showing genuinely free slots instantly. The algorithm accounts for working hours, holidays, each treatment's duration, buffer time between clients and salon capacity.
- A firm booking, not a request. The slot is locked at the moment of confirmation, in a transaction with row-level locking — two people cannot take the same slot, however close together they tap.
- Confirmation with a calendar file. The client gets an email with an
.icsattachment that drops straight into their phone's calendar. - A reminder before the session — the cheapest thing in the system and the one that returns the most, because people genuinely forget.
- Confirmation nudges that stop themselves. The salon gets a repeat notification every 30 minutes until it confirms, but only during opening hours — a clock that rings at three in the morning would have been an easy mistake to make.
- One-tap rescheduling, with an updated email and
.ics, so the client's calendar corrects itself.
An online shop written from scratch
The care products used in the salon, session passes and courses all sell directly from the site. The cart lives on the server, not in the browser, so it survives across devices. Checkout is a progressive form that keeps working with JavaScript switched off.
Orders move through clear states — new, processing, shipped or ready for pickup, completed — with stock deducted inside a transaction, cancellation restocking exactly once, seven automated emails along the way, and courier tracking numbers. A scheduled process clears unpaid orders.
Card payments and automatic invoicing
- Netopia — card payment on the processor's own secure page. Payment confirmation arrives solely through the server-to-server notification, its signature verified cryptographically against the terminal's public certificate. We wrote that verification directly on OpenSSL rather than using the usual library, which carried an unpatched vulnerability. Confirmations are idempotent: the same notification received twice does not produce two payments.
- SmartBill — the invoice is issued automatically and emailed to the customer. For card or in-salon payment it is issued at the moment of payment; for cash on delivery, at dispatch. If issuing fails, the order is flagged and the administrator gets retry or manual-entry buttons — an invoicing error never blocks an order.
Gift vouchers that validate at the front desk
You buy a voucher, choose the value, write a message, and receive it by email as a PDF within seconds — or the system sends it straight to the person you are gifting. Each voucher carries a unique code and a 36 mm QR code printed on it.
Vouchers are issued only when payment is confirmed, once per order line, and cancelling the order voids them automatically. The QR generator is written in PHP, with no external dependencies.
The salon app — the part that changes the working day
A phone-installable web app (PWA), with accounts separate from the site admin, through which the team runs its day without opening a laptop:
- Today — the day's appointments, in order.
- Appointments — confirm, cancel, reschedule.
- Orders — what sold, what needs preparing.
- Messages — what people sent through the form.
- Scan — the phone camera reads a voucher's QR code and marks it used on the spot. No ledger, no calling the administrator, no risk of the same voucher being used twice.
Notifications reach the phone through Web Push, implemented directly on OpenSSL. Sign-in lasts 30 days, so nobody logs in ten times a day.
An admin they use, not one we use
Content is edited straight on the page: click a text, type, it saves. Over 100 editable areas on the home page alone, plus 18 image slots with preview, six typographic sets and the colour palette — all changeable without calling us.
Under the bonnet: Argon2id password hashing, rate limiting, a time trap and honeypot against bots, sanitisation of any content before it is stored, an audit log for every action, and a strict content security policy. The panel works from a phone too.
The result, put simply: the client books herself in under a minute and buys without calling, while the salon sees its day, its orders and its vouchers from a phone. Cary Studio looks after feet, not paperwork.
