Privacy

A braider signs up, and the software is hers. Her clients never sign up for anything — they land on her booking page and give what a booking needs. And an applicant is someone who has filled in the early-access form on our own front page and has no account at all.

Most of what follows is about the braider, because she is the one with an account. Where it is about her clients or an applicant, it says so.

• Her Google account — the verified email address, used to identify her at sign-in. Google owns the password; we never see one.
• Her business details — trading name, phone number, and the styles, prices and hours she enters.
• Her address, if she chooses to save one. It is shown to nobody and published nowhere. Many braiders work from home, and an address that appears the moment it is typed is not a layout decision.
• Photographs she uploads. Every one is re-encoded on our server, which strips the EXIF metadata a phone writes into a picture — including the GPS coordinates of where it was taken.
• Her signed-in devices, so she can sign a lost phone out. We do not store IP addresses. She could not tell you whether an address was hers, so keeping one would be collecting something for nobody’s benefit.

When someone books, they give their name, phone number and email, and may optionally add a note, a few words about their hair, and up to three reference photographs.

• Reference photographs are private and temporary. Only the person who booked and the braider can open one, and they are deleted thirty days after the appointment, or as soon as the booking is cancelled.
• Hair details are optional and stored on the booking rather than the person — what somebody said this time is not a permanent fact about them.
• A booking records that the braider’s policies were agreed to, and the exact words shown at the time, so a later disagreement can be settled by reading them.

This information belongs to the braider’s business. We hold it so her software works; we do not sell it, rent it, or use it to advertise anything.

The form on our front page is an enquiry, not a sign-up. It creates no account and gives you no access to anything. What it stores is what you typed into it: your name, your business name, your email address, and — only if you chose to give them — a phone number, a link to your Instagram, website or current booking page, how you take bookings today, a rough band for how many bookings you take a month, what you find hardest about booking, and any note you added.

• It is used to reply to you, and to decide whether BraidDeck suits how you work. Nothing else.
• It is not a mailing list. You are not subscribed to anything, and we do not send marketing off the back of it.
• A copy is emailed to us so it is actually read — that email goes through Resend, like every other message we send.
• It is never passed to a braider or to anyone outside BraidDeck.
• We keep it while we are still talking to you and for up to a year after, then delete it. Ask sooner and we will delete it sooner — the address below reaches us.

A braider may ask to be texted when someone books. It is off unless she turns it on — the phone number on her profile is the one her clients are given, and typing it in for them is not the same as asking to be texted on it. She ticks “Text me when someone books” on her own Profile page, having read what she is agreeing to beside the box.

• Who gets texted: the braider, on the number she entered herself. Never her clients. Nothing in BraidDeck sends a text to anyone but the account holder.
• How often: one message per booking — when a deposit lands, and when a client moves their own appointment. That is single digits a day for a working braider.
• What is in them: who booked, what they booked and when. Never marketing, never promotions, never anything sold to us by somebody else.
• Mobile numbers are not shared with third parties. They are not sold, rented, or passed to anyone for their own purposes. The only company that receives one is Twilio, our carrier, and only in order to deliver that message.
• Stopping: reply STOP to any message and they end immediately; HELP replies with how to get help. The switch on her Profile does the same thing, and unticking it stops them just as completely.
• Message and data rates may apply — that is between her and her own mobile network, and BraidDeck charges nothing for a text.

This section is about the data BraidDeck receives from Google when a braider signs in with Google or connects her Google Calendar. It applies only to braiders: clients never connect a Google account.

What we access

• Sign-in (Google scopes openid and email): her Google account’s verified email address, used only to identify her account when she signs in.
• Google Calendar (scope calendar.events, optional): the events on the one calendar she connects. We request no other Google data — not Gmail, Drive, Contacts, or any other calendar permission.

How we use it

• To know when she is busy, so her booking page never offers a client a time she is already committed to.
• To put the appointments she sells on her calendar, and update or remove each one when it is moved or cancelled.
• To hear about changes: Google notifies us that her calendar changed, and we read it again as above, so a booking made just after she blocks out an afternoon does not slip through.

We use Google user data only to provide these features to her, inside BraidDeck. We do not use it for advertising, do not sell it, and do not use it to build profiles of anyone.

What we store, and how it is protected

From each calendar event we store only its title, start and end time, whether it is all-day, and Google’s identifiers for the event and the calendar (so the same event can be matched next time). The title is shown back to her in her own dashboard so she can see what is blocking a slot. We never store event descriptions, attendees, locations or attachments. For the appointments we write to her calendar, we keep Google’s event identifier so we can update or remove that entry later.

Her Google access and refresh tokens are encrypted at rest. All data travels over encrypted (HTTPS/TLS) connections, and is stored in our own database on a server in the United States that only BraidDeck’s operator can access.

Who it is shared with

No one. We do not sell, transfer or disclose Google user data to any third party. It is processed only by the infrastructure that runs BraidDeck itself (our hosting provider and Cloudflare, which carry and store the site and its database), and is never passed to Stripe, Resend, Twilio, advertisers or data brokers.

How long it is kept, and how to delete it

• Disconnecting her calendar on her Connections page immediately deletes her Google tokens and every calendar event we stored, and tells Google to stop sending change notifications.
• She can also revoke BraidDeck’s access at any time at myaccount.google.com/permissions. We then can no longer read or write her calendar.
• Closing her account deletes everything we hold from Google, including her email address. She can also ask us to delete it at any time by writing to [email protected].
• Appointments already written to her Google Calendar are hers, in her calendar; she can keep or delete them there as she likes.

Limited Use. BraidDeck’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. No person at BraidDeck reads Google user data except with her permission, where it is necessary for security or to fix a problem she has reported, or where the law requires it.

Artificial intelligence. We do not use Google user data to develop, improve or train artificial intelligence or machine learning models, and we do not send it to any AI service.

Card details never reach BraidDeck. They are typed directly into Stripe’s own form, on Stripe’s systems. We never see, hold, or transmit a card number, and we never hold a braider’s bank details — those are entered into Stripe too.

Deposits are charged on the braider’s own Stripe account. She is the merchant of record: her name is what appears on her client’s statement. We record what a booking cost, what was paid, and Stripe’s identifiers for it, so the booking and any refund can be reconciled.

Only the services that make the product work. Each gets the minimum it needs to do its job.

• Stripe — payments. Receives what a charge requires, including the client’s email for a receipt.
• Google — sign-in, and the calendar for braiders who connect one. See “Google user data” above: nothing we receive from Google is passed on to anyone.
• Resend — sends the confirmation, reminder and cancellation emails, and therefore handles the recipient’s address and the message.
• Twilio — text messages to the braider about her own bookings, if she turns them on.
• Cloudflare and our hosting provider — serving the site and storing the database.

We do not sell personal information, and there are no advertising or analytics trackers on the booking pages.

• Reference photographs — deleted thirty days after the appointment, or when the booking is cancelled.
• Bookings, clients and their details — kept while the braider’s account is open, because they are her business records.
• Google tokens — until she disconnects, or revokes access at Google.
• An early-access application — up to a year after we have finished talking, or sooner if you ask.
• Everything about an account — deleted when the account is closed, apart from what we must keep for tax or accounting.

Write to [email protected] and we will tell you what is held about you, correct it, or delete it.

If you booked with a braider, she holds your details as her own business records and is the person to ask first — we will help her do it, and will act ourselves if you would rather ask us.

BraidDeck is for businesses and is not directed at children. A parent or guardian may of course book an appointment for a child; what is collected then is the booking, not the child.

When this changes materially we will say so here and date it, and tell braiders by email rather than hoping they re-read the page.

BraidDeck LLC is registered in Colorado, United States, and the data is stored there.