Privacy policy

Who this covers

• Studio owners and their team who use the Studio Solos app.
• Clients who book with a studio, sign its forms or pay it through a studio's booking page or website.
• For clients' details, the studio decides what to keep and why; we keep them on the studio's behalf and only use them to run the service for that studio.

What we keep

• Owners and team: your email address, the studio's details (name, address, hours, services, prices, team), and your settings.
• Clients: name, phone, email, notes the studio writes, appointment history, waitlist requests, and answers to the studio's intake and consent forms (these can include health questions, for example about eye conditions before lash work), with the name typed as a signature.
• Payments: amounts, tips, what they were for, and whether they went through. Card payments are handled by the payment processor; we only see the card brand and last four digits, never the full number.
• Gift cards and promo codes: who bought a card and for whom, its balance, and when codes were used. Gift card codes are stored only in scrambled (hashed) form.
• Technical records: IP addresses when someone asks for a sign-in link or a client code, holds a time, joins a waitlist or signs a form (to stop abuse and as a record of signing), and error codes from our servers (never the text of your data).

What we use it for

• To run bookings, reminders, the calendar, payments, forms, gift cards, waitlists and the studio's website.
• To send emails the studio has switched on: confirmations, reminders, review requests and rebooking reminders. Clients can opt out of review requests and rebooking reminders from the email.
• To keep the service safe and working: rate limits, monitoring and backups.
• We don't sell personal information, and we don't use clients' details for our own marketing.

AI features

Studio Solos can draft website words, replies to Google reviews and social posts. For these we send an AI model provider the studio's own details (services, hours, about text) and, for review replies, the public review. We don't send clients' contact details, notes or form answers. The studio reviews every draft before anything is published.

Who helps us run the service

These companies process data for us, only to provide their part of the service:

• Fly.io: hosting the app.
• Neon: the database.
• Resend: sending emails.
• Square (and Stripe, when a studio uses it): taking card payments, and importing a studio's existing Square data when the studio asks.
• Google: reading busy times from calendars a studio connects.
• bundle.social: connecting a studio's Google Business Profile and social accounts, when the studio asks.
• Anthropic: the AI model behind the drafting features.
• An S3-compatible storage provider: encrypted backups.
• Twilio: text alerts to our own team about outages (no studio or client data).

Cookies

We use only the cookies the service needs: to keep owners signed in, to remember which studio is open, to hold a chosen time while a client books, to remember a promo code or a returning client on a booking page, and to keep a social post draft. We don't use advertising or analytics cookies.

How long we keep it

• Studio and client records: while the studio uses Studio Solos, or until the studio deletes them or asks us to.
• Error records and server logs: 30 days.
• Backups: encrypted copies, the newest 30 kept, so deleted data disappears from backups within about 30 days.

Your choices

• Studios can download all of their data at any time (Settings → Your data) as spreadsheets.
• To have a studio's data deleted, or to close an account, email [privacy contact email]. We confirm by email and delete within 30 days, apart from records the law requires us to keep.
• Clients: to see, correct or delete what a studio keeps about you, contact the studio. You can also write to us and we'll pass it on and help the studio respond.

Security

Each studio's data is kept apart from every other studio's by the database itself. Connections are encrypted, sign-in links work once and expire after 15 minutes, and backups are encrypted before they leave our servers. If we learn of a breach that affects you, we'll tell you without undue delay.

Children

Studio Solos is for businesses. Studios decide whether to see clients under 18 and are responsible for any consent that needs.

Changes and contact

If we change this policy in a way that matters, we'll tell studio owners by email before it takes effect. Questions: [privacy contact email], [Company postal address].