Privacy Policy

1. Information we collect

• Business accounts: owner and team names, email addresses, phone numbers, sign-in details (passwords are stored only as secure hashes), business details, services, prices and hours.
• Clients of a business: name, email, phone, appointment history, notes, and any intake, consent or health forms the business asks clients to complete.
• Payments: handled by Stripe. Card numbers go directly to Stripe and are never stored by Studio. We keep payment records such as amounts, dates and status.
• Messages: appointment confirmations, reminders and messages sent by email or text, and their delivery status.
• Connected services: information from services a business chooses to connect, such as Google Calendar, an iCal calendar link or QuickBooks (see below).
• Usage and device data: pages visited, browser and device type, and logs we use to keep Studio secure and working.

2. Google Calendar and Google user data

A business can choose to connect a team member’s Google Calendar so that appointments already booked there appear in Studio and can’t be double-booked online.

• What we access: with the “View and edit events on all your calendars” permission, Studio reads the events on the connected account’s main calendar from one day ago to about a year ahead: each event’s time, title, description, location and guests, plus the account’s email address so the owner can see which account is connected.
• How we use it: only to show those appointments in that business’s Studio (matching them to the business’s clients and services, blocking the time from online booking, and keeping them up to date as events change), and to add the bookings made in Studio for that team member to their calendar, updating or removing them when they’re moved or cancelled in Studio. Studio checks the calendar about every 15 minutes.
• What we never do: Studio only creates, changes or removes the events it added for Studio bookings, never your other events; never sends texts or emails to the people in imported events, and never uses Google data for advertising.
• Storage and protection: the Google sign-in token is encrypted (AES-256) before it is stored and never sent to a browser. Imported appointment details are stored in that business’s Studio account and are visible only to its owner and authorized team.
• Disconnecting and deletion: the owner can disconnect at any time in Studio under Calendar sync. Disconnecting revokes Studio’s access at Google and removes the upcoming busy times that came from that calendar; events Studio already added stay in your calendar for you to keep or delete. You can also remove access at myaccount.google.com/permissions, or email us to delete everything that came from your calendar.

Studio’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it to train AI or machine-learning models, and do not let people read it except with the business’s permission, for security or legal reasons, or when it has been aggregated and anonymized.

3. How we use information

• To provide Studio: booking, schedules, client records, checkout, websites and apps.
• To send appointment confirmations, reminders and other messages a business turns on.
• To keep accounts secure, prevent fraud and fix problems.
• To support businesses and improve Studio.
• To meet legal, tax and accounting obligations.

4. How information is shared

We don’t sell personal information. We share it only:

• With the business a client books with, and its authorized team.
• With service providers who run parts of Studio for us under contract: Supabase (database), Vercel (hosting), Stripe (payments), Telnyx (text messages), Resend (email), Intuit QuickBooks (only when a business connects it) and Anthropic (AI features a business turns on). They may use the information only to provide their service to us.
• When required by law, or to protect the rights, safety and security of our users or others.
• In a business transfer, such as a merger, where this policy continues to apply.

5. Text messages

Businesses use Studio to send appointment texts from their own registered number. Clients can reply STOP to stop texts from that business, or HELP for help. Message and data rates may apply. Mobile numbers and texting consent are never shared with third parties for marketing.

6. Security

Studio uses encrypted connections (HTTPS), encryption for sensitive tokens, access controls so each business sees only its own data, and two-step sign-in for owners. No system is perfectly secure, but we work to protect your information and will notify affected users of a breach as the law requires.

7. Keeping and deleting information

We keep information while a business uses Studio and as needed for legal, tax and accounting records afterwards. A business can delete clients and records in Studio, and can ask us to delete its account. Clients can ask the business they booked with, or us, to access, correct or delete their information.

8. Your choices and rights

You can update your details in Studio, unsubscribe from marketing emails, reply STOP to texts, and disconnect connected services at any time. Depending on where you live, you may have rights to access, correct, delete or get a copy of your information. Email us and we’ll respond within the time the law requires.

9. Children

Studio is not directed to children under 13, and we don’t knowingly collect their information. Information about a minor client is added only by the business that serves them.

10. Changes to this policy

If we make important changes, we’ll update this page and the date above, and let businesses know in Studio or by email.