Privacy Policy

This Privacy Policy explains how MedSpa Butler ("we," "us," or "our") collects, uses, and shares information when you use our software-as-a-service platform and websites (the "Service").

1. Information we collect

• Account information — the spa name, email address, phone number, and password you provide when registering.
• Client data you upload — information about your clients (such as names, contact details, appointments, and treatment records) that you import or enter to use the Service on your behalf.
• Billing information — handled by our payment processor, Stripe. We do not store full card numbers.
• Usage and device data — basic logs and analytics generated when you use the Service.

2. How we use information

• To provide, maintain, and improve the Service.
• To send messages on your behalf to your clients (for example, SMS and email reminders) as you configure.
• To process payments and manage your subscription.
• To communicate with you about your account, support requests, and service updates.
• To detect, prevent, and address security or technical issues.

3. SMS and text messaging

The Service sends SMS text messages on behalf of med spas to their clients — appointment confirmations, reminders before an appointment (which a client can reply to with CONFIRM or CANCEL), and post-visit follow-ups. Message frequency varies based on the client's appointments, typically a few messages per appointment.

Clients provide their mobile number and agree to receive these texts when they schedule an appointment with the med spa. Message and data rates may apply. Recipients can opt out at any time by replying STOP and can reply HELP for assistance. Consenting to text messages is not a condition of any purchase.

Mobile opt-in information, phone numbers, and messaging consent will not be shared with third parties or affiliates for marketing or promotional purposes. SMS messages are delivered through our messaging provider, Twilio.

4. Roles and your clients' data

For the client data you upload, you are the controller and MedSpa Butler acts as a processor that handles that data on your instructions. You are responsible for having a lawful basis and any required consents to process your clients' information and to contact them, including consent to send text messages.

5. How we share information

We do not sell your personal information. We share information with service providers who help us operate the Service, including:

• Supabase — database, authentication, and file storage
• Stripe — payment processing
• Twilio — SMS delivery
• Resend — email delivery
• Vercel and Railway — application hosting

We may also disclose information if required by law or to protect our rights, and in connection with a business transfer.

6. Data retention

We retain your information for as long as your account is active and as needed to provide the Service, comply with legal obligations, and resolve disputes. You may request deletion of your data as described below.

7. Security

We use reasonable administrative, technical, and organizational measures to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, or export your personal information. To make a request, contact us at the address below. If you are an end client of a med spa using the Service, please contact that business directly, as they control your data.

9. International transfers

Your information may be processed in the United States and other countries where we or our service providers operate.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy with a new effective date.

11. Contact

Questions or requests? Email support@medspabutler.com.