Privacy Policy

This explains what ChairSlay does with personal information — yours and your clients’.

Three commitments up front. They shape everything below.

1. We never sell your data. No advertising market, no data brokers, no “anonymized” hand-offs.
2. We never hold your money. Payments your clients make to you flow through your own Stripe or Square account. We don’t touch the funds, so we don’t store card data either.
3. Your clients are yours. You can download your whole book — contacts, notes, color formulas, custom prices, appointments, photos — as one file any time you have a trial or a plan, and for 30 days after your access ends. No premium gate.

1. Who we serve

ChairSlay is a tool for independent beauty pros (“you”) and the clients who book with them.

• You create an account, set up services, and run your booking page. With respect to your account data, ChairSlay is the controller.
• Your clients book appointments with you. With respect to client records, you are the controller — ChairSlay processes them on your instructions. We never share client data across pros, across accounts, or with anyone else.

Studio / operator features are forthcoming on the roadmap. When the operator product launches, this section will be updated to describe the additional party (studios) and how the privacy line is enforced between them and the pros who rent from them.

If you’re a client and want to access, correct, or delete your data: contact the pro you booked with. We’ll support them in responding, but we can’t act unilaterally on client data.

2. What we collect

From you (the pro)

• Identity: name, business name, email, phone.
• Authentication: sign-in links and one-time codes (short-lived, single-use, stored hashed) and session cookies. ChairSlay is passwordless — we don’t store passwords.
• Billing: your billing address (for sales tax), your plan and invoice history, and the last-4 / brand / expiration of the card you pay us with (via Stripe). Full card numbers go to Stripe directly and never reach our servers.
• Usage telemetry: device, browser, IP, referrer, request logs. Retained for 90 days for operational diagnostics.
• App notifications: if you turn on notifications in our iPhone, iPad, or Android app, a device token so Apple or Google can deliver them. The alerts are generic (“A client booked an appointment”) and never include a client’s name.

From your clients (on your behalf)

• Contact + booking: name, email, phone, appointment history, your notes about them.
• Intake-form answers: whatever you ask them to provide. You agree (see the Acceptable Use Policy) not to use ChairSlay to collect protected health information (PHI), Social Security numbers, or government ID numbers.
• Photos: before/after, color formulas, lash maps, etc. You’re responsible for getting their consent before uploading.
• Booking-page sign-ins and text-message consent: when a client signs in on your booking page or agrees to text reminders, the time, IP address, and device, and for texts the consent wording they agreed to.
• Card data: never collected or stored by ChairSlay. Card information goes from your client’s browser straight to Stripe or Square, who tokenize it. We store only the processor-issued token + last-4 + brand.

From third-party services you connect

If you connect a Google or Microsoft calendar, we read only the start and end times of your events (your busy times) so we can block those times on your booking page. Event titles, attendees, locations, and descriptions aren’t read. We also add your ChairSlay appointments to that calendar, showing the service name and time, never the client’s name.

From app stores

If you choose a plan in our Android app, Google requires us to report that transaction to Google Play: the amount, tax, date, your billing state, and a Google-issued transaction token. No client data is included. Plans chosen on the web or in the iPhone and iPad app aren’t reported to an app store.

From our marketing site

If you join a waitlist on chairslay.com, we keep your email, anything else you add on the form (like your name, business, or a note), how you heard about us (if you tell us), the page and campaign link you arrived from, and technical details (IP address, browser, and country) that help us block spam. A copy goes to our team inbox by email. We keep waitlist entries until you ask us to remove them: email privacy@chairslay.com. If we promised you the first-chair rate in writing before sign-up opened, we keep a one-way code made from your email (not the email itself) so we can honor that promise when you create your account.

3. How we use what we collect

• To operate the Service — accept bookings, accept payments, send confirmations and reminders, generate reports.
• To authenticate you and detect abuse or security incidents.
• To communicate with you about your account (billing, outages, product changes).
• To comply with legal obligations (tax, subpoena, court order, consumer-protection inquiries).
• To enforce our Terms and protect ChairSlay, our users, and the public.

We don’t use client data to train machine-learning models. We don’t share client data across pros.

4. Legal bases (GDPR / UK GDPR)

• Contract — to deliver the Service we agreed to.
• Legitimate interests — security, abuse detection, product improvement.
• Consent — for marketing SMS or email you send your clients through ChairSlay. You capture that consent; we don’t.
• Legal obligation — tax records, law-enforcement requests.

5. Who we share data with

• Subprocessors. Listed at /legal/subprocessors. Each is bound by a data-processing agreement and processes data only on our instructions.
• Your processor (Stripe or Square). To move money from your clients to you, we share booking and line-item metadata. Card data goes directly from your client’s browser to the processor — not through us.
• Calendar providers (Google / Microsoft), if you’ve connected them — only the data described in §2 above.
• Google Play, if you choose a plan in our Android app — only the transaction details described in §2 above.
• Business transfers. In a merger, acquisition, or asset sale, we may transfer data — the acquirer must honor this Policy or give you an opportunity to delete first.
• Legal. When required by law, subpoena, or to protect our rights, users, or the public.

We don’t sell personal information. We don’t share for cross-context behavioral advertising. (These are CCPA / CPRA / VCDPA / CTDPA / UCPA / TDPSA / OCPA-specific disclosures.)

Mobile information (phone numbers and SMS opt-in data) is not shared with third parties or affiliates for marketing or promotional purposes. We use mobile information only to send transactional appointment reminders and cancellation notifications, and to process opt-out requests. For details on the SMS program, see SMS Terms.

6. Your rights

Depending on where you live, you may have rights to:

• Access what we hold about you;
• Correct what’s wrong;
• Delete your data (subject to legal-hold exceptions);
• Port it in machine-readable form;
• Object to or restrict certain processing;
• Withdraw consent where processing is consent-based;
• Complain to your local data-protection authority (EU/UK) or state AG (US).

You can do the two most common ones yourself, in the app: download your whole book any time you have a trial or a plan, and delete your account (Settings → Plan & billing → Delete account), which offers your book download first. For anything else, email privacy@chairslay.com. We’ll respond within 30 days (extendable by 60 for complex requests). If you’re a client of a pro on ChairSlay, contact the pro first; we’ll support them.

7. How long we keep things

• Active accounts: as long as you have a trial or a plan.
• After your access ends (your trial ends without a plan, your paid month or year runs out after you cancel, or a renewal payment stays unpaid past its 7-day grace period): you have 30 days to download your book or restore it by choosing a plan. Then we delete your book and client data; all of it is gone within 90 days of your access ending. Your sign-in (name and email) and your ChairSlay billing records stay, so you can come back later; delete your account to remove your sign-in. Client payments still in progress (a pending charge, refund, or dispute) are kept until resolved. Visits still booked 85 days after your access ends are canceled, and clients are notified.
• Deleted accounts: when you delete your account in the app, we delete your book right away, usually within minutes. We keep only what’s listed below.
• ChairSlay invoices and plan history: kept for accounting and tax records, including after your account is deleted. This includes the record of the plan terms you agreed to and any transaction reports sent to Google Play.
• First-chair rate records: the record that an account holds a first-chair spot, and any one-way code from a written promise, kept with no name or email as evidence of the rate promise. Each first-chair spot also carries a one-way code made from the owner’s email (not the email itself) so the rate stays one per person; it’s removed when an unused hold is released and kept with a spot that’s been used or promised.
• Your email after a deletion: kept only until we’ve emailed you that your account is deleted.
• Free-trial check: a one-way code made from your email (not the email itself), kept for 3 years after your account is deleted, so a new account can’t start a second free trial.
• Handle forwarding records: if your booking link is yours for good (12 paid months in a row, or one annual payment), we keep the handle → destination mapping for as long as we run chairslay.com to honor the Yours-Forever Handle promise. Mapping fields are minimal — handle, destination URL, and contact email for forwarding updates — nothing about your past clients. A link that isn’t yours for good is held for 90 days after your access ends, with only the handle and any forwarding address you set, then released.
• Telemetry logs: 90 days.
• Backups: each backup is deleted 34 days after it’s taken, so data deleted from ChairSlay is gone from backups within 35 days of its deletion.

8. International transfers

ChairSlay’s application and database run in the US (Hetzner Cloud, Ashburn, Virginia). Photos, book downloads, and encrypted database backups are stored in Cloudflare R2. If you access ChairSlay from outside the US, your data is transferred to and processed in the US. We rely on Standard Contractual Clauses where EEA/UK personal data is involved; a copy is available on request.

9. Security

Covered in detail in the Security Overview. The summary: TLS 1.2+ in transit, encryption at rest, role-based access, breach notification within 72 hours where GDPR applies and per state law in the US.

10. Children

ChairSlay is for users 18 and over. If you serve clients who are minors, you’re responsible for parental / guardian consent under COPPA (US, <13) and applicable state / EU law.

11. Cookies

• Strictly necessary — session, CSRF, authentication. No consent needed; disabling breaks the Service.
• Functional — preferences like locale and timezone.
• Analytics on client booking pages: none. No third-party trackers run on the booking pages your clients see.
• Marketing site analytics: cookieless. Our public marketing site uses Cloudflare Web Analytics to count page views and referrers. It sets no cookies, does no cross-site tracking, and builds no profile of you.
• Advertising cookies: none.

12. State-specific disclosures (US)

• Categories collected in the last 12 months: identifiers, commercial information, internet activity, inferences.
• Categories sold or shared for cross-context behavioral advertising: none.
• Sources: directly from you; from your browser/device; from subprocessors that deliver the Service.
• Sensitive personal information: we don’t use sensitive personal information to infer characteristics about you.
• Automated decision-making with legal effect: none.

13. Changes to this Policy

We may update it. Material changes take effect on 30 days’ notice to your account email. Prior versions live at chairslay.com/legal/privacy/archive.

14. Contact

Foocorp LLC · privacy@chairslay.com · DPO / EU rep: dpo@chairslay.com