MyBooth Privacy Policy

DRAFT for attorney review. Not in effect. Last updated October 21, 2026 (draft).

This policy explains how [COMPANY LEGAL NAME] ("MyBooth", "we") handles information about two groups of people:
1. Professionals who use MyBooth to run their business ("Pros"), and
2. Their clients, whose information Pros store in MyBooth ("Clients").

For Client information, the Pro decides what to collect and why. We process it on the Pro's behalf as their service provider (processor). Clients should contact their Pro first about their information; we will help Pros respond.

Information we handle About Pros: name, email, phone, business details, team members, license numbers, settings, payment-link handles, usage and device information.

About Clients (entered by Pros or by Clients through intake and booking links): name and contact details; appointment history; service charts and notes; intake answers that may include health-related information (for example allergies, medications, pregnancy, skin and medical conditions); signed consent forms and signatures; patch-test results; photos; message history; payment requests, their status, and the amount, tip and service fee. MyBooth does not receive card or bank details: payments happen on the Pro's own payment provider (for Stripe Connect payments, Stripe tells us whether the payment succeeded).

Consumer health data Some intake answers are "consumer health data" under laws such as Washington's My Health My Data Act. We collect and share it only to provide the service the Client and Pro requested, we never sell it or use it for advertising, and Clients can ask their Pro (or us) to access or delete it. [Attorney: add the separate Consumer Health Data Privacy Policy required by Washington and Nevada.]

How we use information To provide, secure and support the service; to send messages the Pro sets up (only to Clients who agreed); to back up data; to comply with law. We do not sell personal information or use Client information for advertising.

Who we share with Service providers that help run MyBooth under contract and only for that purpose: - Vercel (app hosting and servers, United States) - Neon (the database that holds account and client records, United States) - Cloudflare R2 (storage for photos and nightly backups, private, with short-lived links) - Clerk (sign-in), once sign-in is switched on - Stripe (MyBooth subscription billing and the service fee on Stripe Connect payments) - Twilio (text messages) and Resend (email), once messaging is switched on - Google Firebase (push notifications to Pros' phones) - Google or Apple speech recognition (only the audio of notes a Pro chooses to dictate; see below)

We may disclose information if the law requires it or to protect safety.

AI and automated features MyBooth does not send client records, intake answers or photos to AI models, and nobody uses them to train AI. The photo studio and paper-card scanning run on your own device. Voice dictation (the microphone button on notes) uses your browser's or phone's built-in speech recognition, which may send the audio to its maker (Google for Chrome and Android, Apple for Safari and iPhone) to turn it into text. Don't dictate anything you wouldn't type, and leave the button off if you prefer. We use no advertising or analytics trackers, and nothing you or your clients enter is shared with ad platforms.

Retention Pros control their records and can export them anytime. Records are kept while the Pro's account is active and for [30] days after it closes, unless the Pro deletes them sooner or the law requires longer retention. Nightly backups of records are kept for 30 days. Each photo is also copied once into backup storage; when a photo is deleted, its original and backup copy are removed within a day. When an account closes, its photos are removed within a day and its record backups within 30 days. [Attorney: confirm these retention periods.]

Security Encryption in transit, private photo storage with short-lived links, role-based access inside each business, and audit trails for consent changes. No system is perfectly secure; we will notify affected Pros of a breach as required by law.

Your choices and rights Depending on where you live, you may have rights to access, correct, delete or get a copy of your information and to opt out of certain uses. Clients: contact your Pro, or [PRIVACY EMAIL]. Texts: reply STOP. Emails: use the unsubscribe link or tell your Pro.

Children MyBooth is not directed to children. Pros who serve minors collect parent or guardian consent through intake.

Contact [COMPANY LEGAL NAME], [ADDRESS], [PRIVACY EMAIL].