Privacy policy

Two kinds of people

SensaBook is used by businesses — an independent therapist, stylist or similar professional — to manage their own clients.

For information a business enters about its clients, the business decides what is collected and why; SensaBook stores and processes it on their behalf. If you are a client of a business that uses SensaBook and want your details changed or removed, ask that business — they control the record, and they can do it themselves.

What we hold

If you run a business here

• Your email address, and your name if you give one.
• A password, stored only as a cryptographic hash by our authentication provider — or, if you use “Continue with Google”, no password at all.
• Your business details: business name, timezone, services, prices, working hours, and the content of your public booking page.

If a business books you as a client

• Your name, and the email address and phone number you or the business provide.
• Your appointments with that business, past and upcoming.
• Any preferences and session notes the business writes about your appointments.

Clients do not have SensaBook accounts and are never asked to create one. Managing your own appointment works through a private single-purpose link in your confirmation email.

Session notes never leave the app

Notes a business writes about a client are the most sensitive thing SensaBook stores, and they are treated that way. Note content is never included in an email, a reminder, a booking page, a link, or an address bar, and is not stored on the device you browse from. This is enforced by the software and covered by automated tests, not left to habit.

What we do with it

• Run the service: show calendars, take bookings, keep records.
• Send appointment email — confirmations, reminders, reschedules and cancellations. These are transactional: they are about a specific appointment.
• Keep the service secure and diagnose faults.

We do not sell or rent personal information, we do not use it for advertising, and we do not send marketing email from SensaBook. There are no advertising or analytics trackers on these pages or in the app.

Who else touches the data

SensaBook relies on a small number of providers, and only for the purposes below:

• Supabase — hosts the database and the sign-in system in the United States.
• Amazon Web Services (Amazon SES) — delivers the appointment emails described above.
• Google — only if you choose “Continue with Google”. We ask Google for your basic profile: your identifier, email address and name. SensaBook does not request and cannot read your Gmail, Calendar, Contacts or Drive.
• Our hosting provider — runs the application server.
• Cloudflare — we use Cloudflare Turnstile to tell real people apart from automated abuse on the booking form and the sign-in pages. To do that, Cloudflare receives technical signals from your browser — things like your IP address, browser characteristics and how the page was interacted with. It does not receive your appointment details, your contact information or any session note.

Cookies

Only what sign-in requires. A session cookie keeps you logged in, and it is cleared when you log out. There are no advertising, profiling or third-party analytics cookies, so there is nothing to consent to and no banner to dismiss.

Keeping it safe

• Traffic is encrypted in transit with HTTPS.
• Data is encrypted at rest by our database provider, in line with their standard practice.
• Each business is isolated from every other one at the database level, so one business cannot read another's clients, appointments or notes.
• Links that let a client manage their own appointment are single-purpose random tokens, stored only as hashes and kept out of our logs.

No service can promise perfect security, and we do not. SensaBook makes no HIPAA compliance claim, offers no Business Associate Agreement, and is not intended as a medical records system.

How long we keep it

Business and client records are kept while the account is in use. When a business deletes its account, its clients, appointments and notes are deleted with it. Appointment history is retained rather than erased while the account is active, because it is the business's own record of work done.

Your choices

If you hold an account, you can view, correct and delete what is in it directly in the app, including deleting the account. If you are a client of a business using SensaBook, contact that business — they hold the record and can change or remove it. Depending on where you live you may have additional rights over your information; we will honour valid requests passed to us by the business responsible.

Changes

If this policy changes materially, the date above changes and account holders will be told before the change takes effect.

Contact

Clients should contact the business they book with — they hold the record. Account holders can reach us through the contact details supplied when their account was set up.

See also the terms of service.