Privacy Policy

This policy covers personal information goldenhour collects from two groups: artists (the people who sign up to use the software) and end-clients (the people artists book through the software).

Artists are our direct customers. End-clients are customers of artists; we process their data on the artist's behalf as a data processor under GDPR / CCPA terms.

When you sign up + use the service:

• Account info: email, name, optional phone, optional logo. Stored in Postgres + Clerk (the credential).
• Business info: business name, mode (mobile / studio / hybrid), timezone, service area, hours, vertical. Stored in Postgres.
• Payment info: collected by Stripe, or by Square if you take payments through Square, not us. We see your Stripe Connect account id + status and, if you connect a Square account, its merchant + location ids and the access Square grants us, never the underlying bank/card details. For end-client cards we additionally keep non-PAN display fields and a card code issued by Stripe or Square (see below).
• Usage telemetry tied to you: what pages you visited, how long, which features you clicked, keyed to your account. Logged via PostHog when it is configured on the deployment, and only with your consent. Used to spot bugs and improve UX.
• Usage telemetry tied to nobody: cookieless page and event counts through Vercel Web Analytics, which runs on every deployment. These carry no cookie, no account id, no email and no business name. The event names are a fixed list (for example which setup screen was reached, or that a demo was requested) and their properties are fixed short lists, never free text. They tell us how many people reached a step, and never who.
• Support emails: when you email support, we keep the thread for as long as it's useful to resolving the issue and as documentation.

When you book through an artist's link, they collect (and we store on their behalf):

• Identity: first/last name, phone, optional email, optional birthday.
• Intake answers: whatever the artist's intake form asks (pregnancy flags, sensitivities, allergies, preferences). This is health-adjacent information and the artist is responsible for handling it lawfully.
• Booking history: appointments, services, prices paid, deposit status, no-show / cancel record.
• Communications: SMS and email threads between the artist and the end-client.
• Optional: photos the artist captures with end-client consent; intake-summary AI rollups; voice-note transcripts.
• Payment card details we keep for display and recognition: card brand, last four digits, expiration, and a Stripe-issued code that identifies the card without revealing its number. We use that code to recognize you as a returning client at checkout, so the business can attach your visit to your record. It is scoped to the business you are visiting and cannot be matched against any other business. Ask that business to stop and they can turn it off.
• Cards saved through Square, when the business takes card payments through Square: the card is held by Square in that business's Square account, under a customer record we create there with your name, email and phone. We keep the same display fields (card brand, last four digits, expiration), a code Square issues for the card, and Square's references to the card and to that customer record, which is what lets the business charge it. None of these reveal the card number, and Square's code is not used for the returning-client recognition above.

We treat all of the above as the artist's data. We process it to provide the service to them.

To run the booking + scheduling features (we need the data to schedule appointments).

To send transactional SMS + email on behalf of the artist (confirmations, reminders, after-care).

To compute aggregate insights for the artist (lifetime revenue per client, lapsed-client lists, etc.). These insights stay scoped to the artist's tenant.

To detect and prevent fraud / abuse (audit log + Stripe risk signals).

To debug bugs and improve the service (limited telemetry; no client PII in error reports).

When an artist or end-client provides a mobile phone number to goldenhour — through a public booking page (goldenhourhq.com/book/<slug> or a custom subdomain such as book.sobetan.com), through the SMS-OTP sign-in flow on the booking site, or by texting our business number directly — they are opting in to receive SMS messages from goldenhour and the artist whose booking page they used. Categories include booking confirmations, day-before reminders, after-care notes, two-way customer-service replies, and, only if the customer explicitly checks the marketing opt-in checkbox at booking, occasional rebook reminders, birthday treats, and promotions.

Mobile information (phone numbers collected for SMS) will not be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subprocessors that directly support the SMS program (Twilio, for carrier delivery) is permitted; all other use, sharing, or sale of mobile information for marketing purposes is excluded. This restriction applies regardless of any broader sharing language elsewhere in this policy.

Opt out at any time by replying STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT, REVOKE) to any message; you will receive a single confirmation reply and no further texts. Reply HELP (or INFO) for help. Message and data rates may apply. Message frequency varies by your booking activity.

For each SMS opt-in we record: the phone number, the opt-in method (booking form, OTP sign-in, or inbound text), the timestamp, the originating IP address, the user-agent string, and a cryptographic hash of the exact disclosure text the customer was shown. These records are retained for the lifetime of the account plus 4 years to satisfy TCPA evidentiary requirements.

Sub-processors are vendors who run pieces of our infrastructure. The trust page lists the full set; in summary: Stripe (payments), Square (payments for a business that chooses Square instead of Stripe, and the Square import and receipt lookup a business connects), Twilio (SMS), Resend (email), Clerk (auth), Neon (Postgres), Cloudflare (R2 storage + custom domains), Vercel (hosting, and cookieless Web Analytics), Anthropic (AI features), Sentry (error reporting), PostHog (product analytics, opt-in), Mapbox (address autocomplete + travel-zone maps).

Each sub-processor has independent SOC 2 Type II certification or equivalent. They handle only the data needed for their function.

We do not sell personal information. We do not share with advertisers, data brokers, or AI training corpora.

We may disclose data when required by law (subpoena, court order) or to protect against fraud / imminent harm. We notify the affected artist where legally permitted.

When enabled by the artist, certain features call Anthropic's API: intake-form TL;DR, voice-note transcription, growth analyst Q&A, tag suggestions.

These calls go to Anthropic under their zero-data-retention configuration for paid customers: the prompt is processed, a response returned, and the data isn't logged for training. We don't fine-tune any model on artist or end-client data.

AI features can be turned off at the deployment level (via env var) or at the artist level (per-feature toggles in Settings).

We use cookies for two things:

• Session cookies (managed by Clerk) that keep you signed in. These are first-party, http-only, and expire when you sign out.
• Functional cookies for the welcome-tour state (so we don't replay it every page-load), theme preference, etc.

We do not use advertising cookies. If PostHog is configured on the deployment, it sets a first-party cookie scoped to product-analytics only (not advertising).

We honor the W3C Global Privacy Control signal as a binding opt-out under CCPA / CPRA and the California regulator's 2024 guidance. When your browser sends the Sec-GPC: 1 header, our middleware records a gh_gpc_honored cookie that propagates to our analytics layer.

What that means in practice: PostHog event capture is suppressed for your sessions, server-side analytics calls tied to your identity are skipped, and a footer indicator on every page confirms the signal was received.

GPC is supported natively by Brave, Firefox (about:preferences#privacy), DuckDuckGo Browser, and via the Privacy Badger extension in Chrome / Edge / Safari. See /help/gpc for browser-specific enable steps.

GPC takes precedence over our cookie consent banner. If you've previously accepted analytics but later enable GPC, the GPC signal wins for everything tied to your identity: PostHog capture stops, and so does every server-side analytics call keyed to your account.

What GPC does not switch off, stated plainly rather than left to be discovered: the cookieless aggregate counters described under "What we collect from artists" keep running. They set no cookie and carry no account id, email or business name, so there is no identity in them to opt out of, and gating them on a per-visitor cookie would mean tracking the visitor in order to stop counting them. If you would rather they did not run at all, a content blocker stops them at the browser and we will not work around it.

Active accounts: data is retained as long as the account is active.

Closed accounts: 30-day export window, then purge of client records / photos / messages / intake answers. Audit-log entries (action records, no client PII) are retained 12 months for fraud + dispute defense.

Right-to-be-forgotten requests for specific clients: email support@goldenhourhq.com, and we purge within 30 days, retaining only what data-protection law requires us to keep.

Under GDPR (EU/UK), CCPA (California), and similar frameworks, you have the right to:

• Know what we collect about you and why (this page).
• Access a copy of your data: exports are available from /app for artists, and via your artist for end-clients.
• Correct inaccurate data: edit it directly in the dashboard, or email support.
• Delete your data: close your account, or email support for a specific deletion.
• Object to certain processing: for AI features, toggle them off in Settings.
• Lodge a complaint with a supervisory authority if you believe we're violating your rights.

We honor requests within 30 days. We don't charge a fee.

Our Postgres + photo storage default to US-East (Virginia). EU-tenant routing is on the roadmap; today an EU artist's data is stored in the US under Standard Contractual Clauses with our sub-processors.

If you're in the EU/UK and not comfortable with US-based processing, email support before signing up so we can talk timeline.

goldenhour is a B2B service for licensed beauty / wellness professionals. We do not knowingly collect information from anyone under 18 as an artist.

End-clients booked by an artist may be of any age; the artist is responsible for any minors' bookings and for getting parental consent where needed.

When this policy changes materially, we email artists in advance and update the LAST_UPDATED date below. The latest version is always at this URL.

Questions, requests, or complaints: support@goldenhourhq.com or gabriel@goldenhourhq.com. We respond within a business day.