Privacy Policy

1. Scope

This Privacy Policy applies to personal information that we process through:

• the SimpleSpa business management software and related account portals;
• SimpleSpa online booking pages and booking widgets;
• our websites, including simplespa.com and related SimpleSpa domains;
• our customer support, sales, billing, and account communications;
• email and SMS communications sent through or in connection with the Services;
• Subscriber-authorized integrations and SimpleSpa APIs; and
• other products or services that link to this Privacy Policy.

This Privacy Policy does not govern the independent privacy practices of a Subscriber, payment processor, third-party integration provider, or other organization that processes information for its own purposes.

2. Our Privacy Roles

When SimpleSpa acts for its own purposes

SimpleSpa generally acts as a data controller, business, or similar responsible entity when we determine why and how personal information is processed. This includes information relating to:

• Subscriber account owners, administrators, and staff users;
• billing, subscriptions, trials, and purchases from SimpleSpa;
• website visitors and prospective Subscribers;
• support, security, fraud prevention, service improvement, and legal compliance; and
• SimpleSpa’s own marketing communications.

When SimpleSpa processes information for Subscribers

Subscribers use SimpleSpa to manage their businesses and their relationships with their customers. For personal information entered into the Services by or for a Subscriber—such as customer profiles, appointments, forms, treatment notes, photographs, service history, and marketing preferences—the Subscriber generally determines why the information is collected and how it will be used.

For this information, the Subscriber is generally the controller or business, and SimpleSpa generally acts as its processor or service provider. We process that information according to the Subscriber’s instructions, our agreement with the Subscriber, and applicable law.

3. Information We Collect

The information we collect depends on how you interact with the Services.

Account and business information

• name, email address, telephone number, and business address;
• business name, business type, website, locations, and operating information;
• account role, login information, and authentication details;
• subscription plan, billing status, invoices, tax information, and transaction records; and
• communications, support requests, feedback, and account preferences.

Subscriber customer information

Depending on the features selected and the information a Subscriber chooses to collect, the Services may process:

• customer name, telephone number, email address, postal address, and date of birth;
• appointment details, booking history, cancellations, waitlist entries, and attendance status;
• services, products, purchases, memberships, packages, gift cards, loyalty activity, and balances;
• communication preferences and consent records;
• forms, notes, intake responses, treatment information, allergies, contraindications, and related records;
• images, photographs, annotations, attachments, and other files uploaded by a Subscriber or its customer;
• staff assignments, service preferences, and customer requests; and
• other information a Subscriber configures the Services to collect.

Technical and usage information

• IP address, browser type, device type, operating system, and language;
• login time, activity logs, pages or features used, and referring pages;
• cookie identifiers and analytics information;
• error, diagnostic, performance, and security information; and
• API request details such as account identifier, endpoint, timestamp, IP address, response status, and request volume.

Payment and transaction information

We may receive transaction identifiers, payment status, amount, currency, card brand, expiration information, last four digits, processor tokens, refunds, disputes, and related records from payment providers. The precise information received depends on the payment service used.

4. How We Collect Information

We may collect personal information:

• directly from you when you create an account, contact us, subscribe, book, complete a form, make a purchase, or otherwise use the Services;
• from a Subscriber that enters or imports information into its SimpleSpa account;
• automatically from browsers, devices, cookies, logs, and security technologies;
• from payment processors, messaging providers, analytics providers, and other service providers;
• from integrations that you or a Subscriber authorize;
• from publicly available sources where lawful and relevant; and
• from referrals, business partners, or events where you have provided information or asked to be contacted.

If you provide personal information about another person, you are responsible for having the authority and any required notice or legal basis to provide it.

5. How We Use Information

We may use personal information to:

• provide, operate, maintain, and improve the Services;
• create and administer accounts, subscriptions, and user permissions;
• process bookings, purchases, payments, refunds, and other transactions;
• send appointment confirmations, reminders, receipts, service notices, and other requested communications;
• provide customer support, troubleshoot problems, and respond to requests;
• authenticate users and protect accounts;
• detect, investigate, and prevent fraud, misuse, security incidents, and unlawful activity;
• monitor availability, performance, reliability, and use of the Services;
• develop features and produce aggregated or de-identified analytics;
• manage trials, billing, accounting, tax, and administrative records;
• send SimpleSpa marketing communications where permitted by law and consistent with your preferences;
• enforce our agreements and acceptable-use requirements;
• comply with legal obligations and respond to lawful requests; and
• establish, exercise, or defend legal claims.

We may aggregate or de-identify information so that it cannot reasonably be linked to an identifiable individual. We may use and disclose properly aggregated or de-identified information for product improvement, analytics, security, business planning, and other lawful purposes.

6. Legal Bases for Processing

Where the European Economic Area (“EEA”), United Kingdom, Switzerland, or another jurisdiction requires a legal basis, we rely on one or more of the following:

• Performance of a contract: to provide the Services, administer an account, process a subscription, provide support, or complete a requested transaction.
• Legitimate interests: to secure and improve the Services, communicate with business users, prevent fraud, maintain records, and operate our business, provided those interests are not overridden by applicable privacy rights.
• Consent: where consent is required, including for certain marketing communications, cookies, or processing of sensitive information.
• Legal obligation: to comply with tax, accounting, regulatory, law-enforcement, or other legal requirements.
• Protection of rights and safety: where necessary to protect vital interests or the rights, property, and safety of users, SimpleSpa, or others.

When SimpleSpa acts as a processor for a Subscriber, the Subscriber is responsible for identifying the appropriate legal basis for its collection and use of customer information.

7. Subscriber Customer Data

Subscribers are responsible for the personal information they collect, enter, import, access, export, disclose, or otherwise process through SimpleSpa. Each Subscriber is responsible for:

• providing any legally required privacy notices to its customers and staff;
• obtaining any consent or other lawful basis required for its processing;
• collecting only information reasonably necessary for its business purposes;
• configuring user access and protecting account credentials;
• responding to privacy requests concerning its records;
• using messaging, marketing, photo, form, and integration features lawfully; and
• complying with laws applicable to its business, services, and location.

SimpleSpa does not independently determine the contents of Subscriber customer records. We may access those records as reasonably necessary to provide support, maintain or secure the Services, comply with law, or as otherwise permitted by our agreement with the Subscriber.

8. Sensitive Information

Some Subscribers may use SimpleSpa in connection with wellness, beauty, medical aesthetics, or other services and may choose to collect information that is considered sensitive under applicable law. This may include health-related information, treatment notes, allergies, contraindications, photographs, or form responses.

Subscribers should collect sensitive information only when it is necessary for their services and when they have a lawful basis to do so. Subscribers are also responsible for applying appropriate access restrictions and complying with any industry-specific laws that apply to them.

Do not submit highly sensitive information that a Subscriber has not specifically requested or that is not necessary for the relevant service. SimpleSpa should not be used to store passwords for other services, government account credentials, complete financial-account credentials, or other secrets unrelated to the Services.

9. Payments

Payments may be processed by third-party payment providers selected by SimpleSpa or by the Subscriber. Payment information submitted through hosted payment fields, terminals, wallets, or processor pages may be collected directly by the applicable payment provider and handled under that provider’s privacy notice and terms.

SimpleSpa generally receives payment status, transaction details, and tokenized or limited card information rather than a complete payment-card number. However, the exact data flow depends on the payment integration and configuration used.

Subscribers that enable payment services are responsible for complying with their payment-provider agreements and applicable payment, refund, dispute, and cardholder-data requirements.

10. Email, SMS, and Service Communications

SimpleSpa and its Subscribers may use the Services to send appointment reminders, confirmations, receipts, account notices, support responses, and marketing messages.

A Subscriber is responsible for the content, recipients, timing, and legal basis of messages it sends through SimpleSpa. Message and data rates may apply to SMS communications.

You may unsubscribe from SimpleSpa marketing emails by using the unsubscribe link in the message or by contacting [email protected]. You may still receive non-marketing communications necessary to operate an account, complete a transaction, provide security notices, or deliver requested Services.

To stop marketing messages sent by a Subscriber, follow the instructions in the message or contact that Subscriber directly. Appointment and transactional messages may continue where permitted by law.

11. Cookies and Analytics

We may use cookies, local storage, pixels, log files, and similar technologies to:

• keep users signed in and remember preferences;
• provide security and prevent misuse;
• understand website and feature usage;
• diagnose errors and improve performance; and
• measure the effectiveness of communications or campaigns where permitted.

Some cookies are necessary for the Services to function. Where required by law, we request consent before using non-essential analytics or advertising technologies. Browser controls may allow you to block or delete cookies, but doing so may affect functionality.

A Subscriber may also add its own analytics technology to an online booking page where SimpleSpa supports that configuration. The Subscriber is responsible for its use of that technology and for providing any required notice or consent.

12. How We Disclose Information

We may disclose personal information to:

• Subscribers: when an individual books, communicates, completes a form, makes a purchase, or otherwise interacts with that Subscriber through the Services.
• Service providers and subprocessors: companies that provide hosting, storage, backups, email, SMS, analytics, support, security, infrastructure, payment processing, and similar services on our behalf.
• Subscriber-authorized integrations: third parties that a Subscriber chooses to connect to its account.
• Professional advisers: auditors, insurers, attorneys, accountants, and consultants where reasonably necessary.
• Authorities and other parties for legal reasons: where we reasonably believe disclosure is required by law, legal process, or to protect rights, safety, security, and the integrity of the Services.
• Parties to a business transaction: in connection with a financing, merger, acquisition, reorganization, sale of assets, insolvency, or similar transaction, subject to appropriate confidentiality and legal protections.
• Other parties at your direction or with your consent.

SimpleSpa does not sell Subscriber customer records for money. SimpleSpa also does not disclose Subscriber customer records to unrelated third parties for those third parties’ own direct marketing purposes.

13. Integrations and API Access

Subscribers may choose to connect SimpleSpa with third-party services or may authorize approved access through a SimpleSpa application programming interface (“API”). When a Subscriber enables an integration, information may be exchanged between SimpleSpa and the selected third party as directed by the Subscriber.

SimpleSpa may log and monitor integration and API activity for authentication, security, rate limiting, troubleshooting, abuse prevention, auditing, and compliance. Logs may include account identifiers, user identifiers, IP addresses, endpoints, timestamps, response codes, and usage volume.

Third-party integration providers process information under their own agreements and privacy practices. Subscribers are responsible for selecting appropriate integrations, limiting access to what is necessary, protecting API credentials, and ensuring that connected third parties process information lawfully.

API access is also governed by the applicable SimpleSpa API Terms of Use and API documentation. SimpleSpa may limit, suspend, or revoke access where permitted by those terms, including to protect security, privacy, service availability, or legal compliance.

14. International Data Transfers

SimpleSpa is operated by Lasyk Networks, Inc. in the United States. Personal information may be processed in the United States and in other countries where SimpleSpa or its service providers operate. Those countries may have privacy laws that differ from the laws in your location.

Where required for transfers of personal information from the EEA, United Kingdom, or Switzerland, we use recognized legal safeguards. Depending on the transfer, these may include an adequacy decision, the European Commission’s 2021 Standard Contractual Clauses, the applicable United Kingdom transfer mechanism, or another lawful safeguard.

Information about the European Commission’s international-transfer mechanisms is available from the European Commission.

15. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including to:

• provide the Services and maintain an active account;
• comply with Subscriber instructions and contractual commitments;
• maintain transaction, tax, accounting, security, and support records;
• comply with legal and regulatory requirements;
• resolve disputes and enforce agreements; and
• establish, exercise, or defend legal claims.

Retention periods vary based on the type of information, the Subscriber’s account settings and instructions, legal requirements, backup cycles, and the need to maintain security and business records.

When a Subscriber account ends, information may remain available for a limited period for account recovery, export, legal compliance, security, and backup purposes. Information in backups may be deleted according to our normal backup rotation rather than immediately.

We may retain aggregated or de-identified information where it no longer identifies an individual.

16. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

Security also depends on users and Subscribers. Account holders should use unique, strong passwords; enable available security features; limit user permissions; keep credentials confidential; and promptly notify SimpleSpa of suspected unauthorized access.

No internet transmission, software service, or storage system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.

17. Privacy Rights and Requests

Depending on your location and the circumstances, you may have rights to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion of information;
• request restriction of or object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent;
• opt out of certain marketing communications;
• appeal a decision concerning a privacy request where applicable; and
• complain to an applicable privacy or data protection authority.

Requests concerning a Subscriber’s records

If your request concerns information held by a salon, spa, clinic, or other Subscriber—such as your appointments, forms, photographs, treatment notes, or purchase history—please contact that Subscriber directly. We may forward or refer the request to the Subscriber.

Requests concerning SimpleSpa

To submit a request concerning information for which SimpleSpa acts as controller or business, email [email protected] with the subject line Privacy Request.

Please describe your request and identify the email address associated with your account or interaction. We may request additional information reasonably necessary to verify your identity, locate the relevant records, prevent fraud, or confirm your authority to act for another person.

Privacy rights are not absolute. We may deny or limit a request where permitted by law, including when information must be retained for security, fraud prevention, legal compliance, transactions, recordkeeping, or legal claims. We will not discriminate against you for exercising an applicable privacy right.

EEA, United Kingdom, and Swiss residents may also lodge a complaint with the supervisory authority in their country or region. A list of EEA authorities is available from the European Data Protection Board.

18. California Privacy Notice

This section applies to California residents to the extent the California Consumer Privacy Act, as amended (“CCPA”), applies to SimpleSpa’s processing.

Categories of information

During the preceding 12 months, we may have collected the categories of personal information described below. Whether a category applies to a particular person depends on that person’s interaction with SimpleSpa.

We collect these categories from the sources described in Section 4 and use them for the purposes described in Sections 5 and 6. We may disclose them to the categories of recipients described in Section 12.

Sale and sharing

SimpleSpa does not sell personal information for money. SimpleSpa does not sell Subscriber customer records or disclose those records to unrelated third parties for cross-context behavioral advertising.

If our use of website advertising or analytics technology is considered “selling” or “sharing” under the CCPA, California residents may request to opt out by contacting [email protected]. Where legally required and technically applicable, we will also process recognized opt-out preference signals, such as Global Privacy Control.

We do not knowingly sell or share the personal information of individuals under 16 years of age.

California rights

Subject to applicable limitations, California residents may request to know, access, correct, or delete personal information; receive information about categories collected, sources, purposes, and disclosures; and opt out of sale or sharing where applicable. California residents also have the right not to receive discriminatory treatment for exercising CCPA rights.

To submit a California request, email [email protected] with the subject line California Privacy Request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and verification of the resident’s identity.

California “Shine the Light”

California Civil Code Section 1798.83 may permit California residents to request information about certain disclosures of personal information for third parties’ direct marketing purposes. SimpleSpa does not disclose Subscriber customer records to unrelated third parties for those third parties’ own direct marketing. Questions may be sent to [email protected].

19. Children

SimpleSpa is a business service and is not directed to children under 16. We do not knowingly invite children under 16 to create independent SimpleSpa business accounts.

A Subscriber may provide services to minors and may maintain records concerning a minor when permitted by law. In that situation, the Subscriber is responsible for obtaining any required parent or guardian authorization and for handling requests concerning the minor’s records.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Services, our practices, or applicable law. We will post the updated version at https://www.simplespa.com/privacy and update the “Last updated” date.

If a change is material, we may provide additional notice through the Services, by email, or by another appropriate method. Where required by law, we will request consent before applying a materially different use of personal information.

21. Contact Us