Privacy Notice

Information you provide

• A booking request includes your name, email address, requested studio, date and time, duration, guest count, selected add-ons, and any promo code or booking notes you submit.
• The application stores the booking rules shown at checkout and the time those rules were accepted.
• Staff-managed customer records can also contain a phone number, company, referral source, social links, tags, notes, pricing rules, and promotion eligibility when that information is provided or added for operations.
• Customer account access uses your email address and an authentication session provided by Supabase.

Payments and booking records

Analytics, attribution, and security signals

• With “Measure site visits and bookings” enabled, Google Analytics measures public page visits, booking-link clicks, and subsequent paid bookings and refunds. It receives a GA4 client/session identifier, transaction reference, studio, currency, amount, and payment time. Visitors who previously agreed only to public-visit measurement are asked to choose again before purchase measurement begins. The booking flow can also remember approved values supplied in utm_source, utm_medium, utm_campaign, utm_content, utm_term, and ref URL parameters.
• Vercel provides cookieless page-view and application-event analytics separately from the optional preferences, with tokenized booking, confirmation, and customer-booking URLs excluded and public referrers reduced to their origin.
• Google Analytics loads only after analytics consent on public marketing and public booking pages. Google browser tags are excluded from private booking confirmation and management pages, account, admin, and authentication pages. Consented Google Analytics purchase and refund events are sent separately by our server, without customer names, email addresses, phone numbers, card details, Stripe payment identifiers, or private links. Analytics events deny advertising use. With the current “Measure our ads” permission, our website and server share a hashed version of your booking email with Google Ads to match bookings to ads. Hashing supports matching and does not make the information anonymous. Website matching happens when you continue to payment; only a confirmed payment is reported as a purchase. Automatic form-data scanning and advertising personalization are disabled. With “Measure our ads” enabled, a valid Google click identifier can be encrypted on the server and connected to a later paid booking through an opaque first-party cookie.
• Vercel BotID checks booking-creation requests for automated traffic.
• Application and provider logs can contain routes, timestamps, booking references, delivery references, calendar event references, recipient addresses, and error details used to operate and troubleshoot the service.

How information is used

• Information is used to calculate a quote, check availability, create and manage a booking, connect a payment, and provide customer account access.
• Information is used to send booking messages, create or update calendar events, process cancellation or rescheduling actions, and support operational review.
• Analytics and attribution data are used to understand site use and booking-flow activity.
• Security signals and operational logs are used to protect the booking flow, diagnose failures, and reconcile booking, payment, email, and calendar activity.

Service providers

• Supabase provides customer authentication and session handling.
• Stripe provides hosted payment checkout and payment processing.
• Resend receives recipient and booking-message content to deliver transactional email.
• Google Calendar receives the customer name and email, session schedule, guest count, selected add-ons, and submitted booking notes when a booking event is created or updated.
• Vercel hosts the application and provides analytics and bot-protection services used by the site.
• When you choose “Measure our ads,” we may share purchase value, currency, time, a booking reference, available ad-click identifiers and a hashed version of your booking email with Google Ads to match bookings to ads. Hashing transforms your email for matching; it does not make it anonymous. With that permission, we also use landing-page campaign information, session timing and browser information to connect your visit with a booking. We do not send your email hash to Google Analytics or include your name, phone number, card details or payment identifiers in these advertising uploads. Visitors with older advertising preferences are asked to choose again before email matching is authorized.

Retention and requests

Account and booking-link protection