Privacy Policy
SweetKora LLC (“SweetKora,” “we,” “us”) provides scheduling, client-management, payment and messaging software to salons, spas and similar businesses. This policy explains what information we handle, why, and the choices you have.
Two kinds of people, two relationships
Businesses and their staff sign up to use SweetKora. For their account information we decide how it is used, and this policy governs it directly.
Clients of those businesses — people who book appointments, fill in forms or receive reminders — have their information entered and managed by the business they visit. We process that information on the business’s behalf and under its instructions. If you are a client, the business you booked with is your first point of contact for your records; we will help them respond, and you can also write to us.
Information we handle
- Account details for business owners and staff: name, email, phone, role, and login credentials (passwords are stored only as secure hashes).
- Client details: name, email, phone, appointment history, service preferences, and how the client heard about the business.
- Forms, consents and service records that a business collects, including intake questionnaires, signed consent forms, service or treatment notes, and photos taken during a visit.
- Payment records: amounts, items and payment status. Card numbers are entered directly with our payment processor, Stripe, and are never stored by us.
- Messages sent and received through the platform by text message or email.
- Technical data: IP address and request information used for security and abuse prevention, and the cookies needed to keep you signed in.
How we use it
- To provide the service: bookings, reminders, client records, checkout and reports.
- To send text messages and emails on a business’s behalf, such as appointment confirmations, reminders and follow-ups.
- To process payments and prevent fraud.
- To keep the service secure, diagnose problems and respond to support requests.
- To provide optional AI-assisted features described below.
We do not sell personal information, and we do not use client information to advertise to anyone.
AI-assisted features
Some features a business may choose to use — summarizing service notes, analyzing before-and-after photos, drafting replies to client messages, and forecasting — send the relevant notes, photos or message text to Anthropic, through Vercel’s AI Gateway, to generate a result. That content is sent only to produce the requested output and is not used by us for any other purpose. AI output is an aid for staff, not professional or medical advice, and a person reviews it before it is relied on.
Service providers we share information with
We share information only with providers that help us run the service, each for its stated purpose:
- Supabase — database, authentication and file storage (United States).
- Vercel — application hosting, and the gateway for AI features.
- Anthropic — AI-assisted features.
- Stripe — payment processing.
- Twilio — sending and receiving text messages.
- Resend — sending email.
- Sentry — error monitoring, when enabled.
- Upstash and Cloudflare Turnstile — rate limiting and bot protection.
We may also disclose information when required by law, to protect the rights and safety of others, or as part of a merger or sale of our business, in which case this policy continues to apply.
Text messaging
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties, except the providers that deliver the messages. You can stop text messages at any time by replying STOP. Details are in our SMS Terms.
Cookies
We use only the cookies needed to keep you signed in and to protect your session. We do not use advertising or cross-site tracking cookies.
Retention
We keep information for as long as the business that owns it keeps an account with us, or as needed to meet legal, tax and dispute obligations. When a business closes its account, we delete its data on request. Removed records are hidden from the service immediately but may be retained internally, and in backups, for a limited period before permanent deletion.
Security
Information is encrypted in transit, access is limited by role, and each business’s data is isolated from every other business’s at the database level. No system is perfectly secure, and we will notify affected businesses of a breach as required by law.
Health information
SweetKora is not designed to meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA), and we do not currently enter into business associate agreements. Businesses that are subject to HIPAA are responsible for deciding whether and how to use the service.
Your choices and rights
- Reply STOP to any text message to stop texts, or use the unsubscribe link in any email.
- Ask the business you visited, or us, to access, correct or delete your information.
- Businesses can export their client records and remove clients from within the app.
Depending on where you live, you may have additional rights under state privacy laws. To make a request, email support@sweetkora.com. We will verify your request and respond within the time the law requires.
Children
The service is not directed to children under 13, and we do not knowingly collect their information without a parent or guardian arranging the appointment.
Changes
We will post any changes here and update the effective date. If a change is material, we will notify businesses using the service before it takes effect.
Contact
SweetKora LLC
2001 Loop 332, Liberty Hill, TX 78642
support@sweetkora.com
SweetKora LLC · 2001 Loop 332, Liberty Hill, TX 78642