Privacy Policy

From business Owners: name, email address, business name, and the services and staff they add. Payment details are collected and stored by our payment processor, Stripe — we never see or store full card numbers.

From guests booking an appointment: name, email address, and phone number. We require all three for every booking, so that booking confirmations, appointment reminders, and (if a business has this configured) review requests can reliably reach the right person.

• To create and manage bookings, and to prevent double-booking.
• To send booking confirmations, reminders, and cancellation/reschedule links by email.
• To send a review request email after an appointment, if the business has enabled this.
• To process subscription payments from business Owners.
• To attribute a new business signup to a referral link, where applicable.

We use a small number of third-party services to run Toosabai, and share only what each one needs to do its job:

• Supabase — hosts our database and handles account authentication.
• Stripe — processes subscription payments for business Owners.
• Resend — delivers our transactional emails (confirmations, reminders, review requests).
• Vercel — hosts the application itself.

We do not sell personal data to anyone, for any reason.

Booking and account data is retained for as long as the business’s account exists, including while a subscription is paused, expired, or locked for non-payment — we don’t delete data just because an account isn’t currently active. A guest can cancel their own booking at any time using the link in their confirmation email.

If you arrive at Toosabai through a business’s referral link, we store a small piece of information (a cookie) to remember which referral to credit if you later sign up as a business yourself. This is not used for advertising or tracking across other websites.

You can ask us to access, correct, or delete the personal information we hold about you. Guests can also self-manage their own booking (view, reschedule, or cancel) directly using the link sent to them by email, without needing to contact us. To make any other request, use the contact address provided on our website.

We may update this Privacy Policy from time to time; material changes will be posted here.