Privacy policy

The short version

• We collect what it takes to run the tools you use, and nothing for advertising.
• We never sell your data or the data of the people who use your business.
• The businesses on Essentials own their customers' data; we hold it for them.
• You can ask for a copy of your data, or for it to be deleted, at any time.

Two kinds of people

People who use Essentials: owners and staff who sign in to run a studio, a shop, a website or a team. For your account we decide what is collected and why.

Their customers: people who book a class, buy something, or send a message through a business that uses Essentials. That business decides what it collects about you and why; we store and process it on its behalf. To see or delete what a business holds about you, ask the business. If it cannot help, write to us.

What we collect

• Your account: name, email address, and if you add them, a phone number and a photo. Your password is held by our sign-in provider, never in plain text. If you sign in with Google, we receive your name and email from Google.
• What you put into the tools: your business details, schedules, pages, products, messages, files and settings.
• What a business records about its customers: bookings, orders, memberships, waivers, inquiries sent through its contact form, and notes its staff write.
• Payment references: a card's brand, last four digits and expiry date, and the payment provider's token for it. The full card number and security code go straight to the provider; we never see or store them.
• Email: messages sent and received through Inbox, and the delivery records our email provider returns.
• Security records: sign-in events, the IP address and browser of a request that tripped a rate limit or used an admin account, kept to protect accounts.
• Page views, counted by Vercel Web Analytics without cookies or a profile of you.

How we use it

• To run the tools: show your schedule, take a booking, send a receipt, publish your site.
• To keep accounts safe: verify email addresses, require a second factor for administrators, stop abuse.
• To send the emails and notifications the tools exist to send. You can turn notifications off in your profile.
• To answer you when you write to us.

We do not use your data for advertising, we do not build profiles of you, and we do not sell or rent it to anyone.

Who helps us run it

These companies process data on our behalf, only to provide their part of the service:

• Supabase — database, sign-in and file storage
• Vercel — hosting, custom domains, and page-view counts without cookies (Web Analytics)
• Mailgun — sending and receiving email
• Helcim — card payments; Helcim holds the card, we keep its brand, last four digits and expiry
• LiveKit — voice and video in Lounge, relayed live and not recorded
• Cloudflare Turnstile — telling people from bots on public forms
• Google — sign-in with Google, and the Search Console and Business Profile features a site owner chooses to connect

We share data with anyone else only when you ask us to, or when the law requires it.

Google data, when a site owner connects it

A Showcase site owner can connect Google from the site's Settings → SEO. Nothing is read from Google until they do. When connected, Essentials reads:

• Search Console: how the site appears in Google Search (clicks, impressions, search terms and positions, indexing status of its pages). To set this up we verify the site with Google and submit its sitemap.
• Business Profile: the business's location details, reviews, photos, posts and performance figures. We read these and change nothing on the profile.

We use this data only to show the site's owner and staff their own information inside Essentials, and to point out problems they can fix. We do not use it for advertising, we do not sell it, and we do not share it with anyone else. Search figures are kept for 16 months. The Business Profile access token is kept encrypted, and only our servers can read it.

Essentials' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To disconnect, use Settings → SEO → Google on the site, or remove Essentials at myaccount.google.com → Third-party apps. Disconnecting stops every read; ask us and we delete what was stored.

AI assistants you connect

You can connect an AI assistant to work on your Showcase sites. It acts as you, reaches only your Showcase sites, and can do only what your role on each site allows. You choose the assistant, and its own privacy policy covers what it does with what it reads. Disconnect it any time in Profile → Security → Connected apps. Essentials itself sends none of your data to AI companies.

Cookies

We use only the cookies that keep you signed in. There are no advertising or tracking cookies. A Showcase website on its own domain sets no sign-in cookies at all.

How long we keep it

• Your account and what you put in: until you delete it or ask us to.
• What a business holds about its customers: as long as that business keeps it, or until it leaves Essentials.
• Payment and invoice records: as long as tax and accounting law requires, even after an account closes.
• Rate-limit records: two days. Search Console figures: 16 months.

Your choices

• See and correct your details in your profile at any time.
• Ask for a copy of your data, or for your account to be deleted, by writing to hello@essentials.studio. We answer within 30 days.
• Turn off notifications in your profile; turn off a Google or AI connection where it was made.

Depending on where you live, you may have further rights under laws like the GDPR or the CCPA. Write to us to use them.

Security

Data is encrypted in transit and at rest. Each business's data is kept apart from every other's by the database itself, not only by our code. Payment keys and access tokens are stored encrypted. Administrators use a second factor. No system is perfect: if something goes wrong that affects your data, we will tell you.

Children

Essentials is for running a business and is not meant for children under 13. We do not knowingly collect their data.

Changes

When this policy changes, the date at the top changes with it. If a change affects what we do with your data, we tell account holders by email before it takes effect.