Data Protection

Account Security

• Passwords are never stored in plain text — they're hashed before being saved
• Sign-in is verified with a signed, time-limited session token
• Access to admin and staff tools is restricted by account role, so a client account can never reach booking-management or admin data

Payment Data

We don't process card numbers ourselves. Card, Cash App Pay, Apple Pay, and Google Pay details are collected directly by Square, our PCI-compliant payment processor, inside a secure form we don't have access to. Our servers only receive a one-time payment token and Square's confirmation that a charge succeeded.

Storage and Transmission

• Data is transmitted over encrypted HTTPS connections
• Your account and booking data is stored with a managed, access-controlled database provider
• Profile photos are hosted by a dedicated media provider rather than on our own servers

Data Retention

We retain account and booking records for as long as your account is active, and afterward only as needed to meet legal, tax, or dispute-resolution obligations. You can request deletion of your data as described in our Privacy Policy, subject to those obligations.

In the Event of a Breach

If we become aware of a security incident affecting your personal data, we will notify affected users and any relevant authorities as required by applicable law.