This Privacy Policy applies to all Pinkbook services — the booking platform, owner dashboard, client-facing booking pages, and associated features. It describes what personal information we collect, how we use and protect it, who we share it with, and what rights you have. We are committed to transparency and to handling information responsibly.
Pinkbook is a digital booking and business management platform built for beauty and wellness service providers — stylists, estheticians, nail technicians, and similar professionals — and the clients who book their services. Pinkbook can be reached at [email protected] for all privacy-related inquiries.
Pinkbook operates in two distinct data roles depending on context:
When a service provider creates an account, we collect:
Service providers configure their account through the Settings page. This configuration is stored in their account record and includes:
Third-party credentials security: Twilio credentials entered in Settings are stored encrypted in your account record. Pinkbook never exposes them client-side. You are responsible for rotating these credentials if you suspect compromise. Pinkbook is not liable for losses arising from credential exposure by the account holder.
Service providers manage their client list within Pinkbook. Each client record may contain:
Pinkbook stores this data on behalf of the service provider and does not use it for any purpose beyond operating the platform for that provider.
When a client books an appointment, a booking record is created containing:
If a service provider uses the waitlist feature, clients who join provide their name, email address, optional phone number, preferred service, preferred date, and an optional message. This data is retained until the service provider removes it, notifies the client, or closes their account.
When a gift certificate is created or redeemed through the platform, we store the certificate code, monetary value, creation date, redemption status, redemption timestamp, and the email address of the redeemer (if provided).
Pinkbook does not store full payment card details. All payment card processing is handled by Stripe. We retain Stripe session IDs and payment intent IDs as reference identifiers, and store Stripe Connect account linkage details (account ID, payout eligibility flags) to enable service provider payment features. Review Stripe's Privacy Policy for how Stripe independently processes payment data.
Pinkbook sends automated emails (booking confirmations, appointment reminders, password resets, email verifications) on behalf of service providers and directly for account operations. We maintain an operational email log that records:
j***@gmail.com) and domain only — full email addresses are never stored in the logSMS appointment reminders are routed through the service provider's own Twilio account. Pinkbook does not retain SMS message content after dispatch.
The booking flow records anonymized interaction events (e.g., calendar viewed, time slot selected, booking submitted) to help service providers understand how clients engage with their booking page. These events are linked to a one-way hash of the client's email address — not to their name or identity directly. This data is used to power the AI Brain feature (see Section 7).
For security and compliance, Pinkbook maintains append-only audit logs of actions taken by authenticated users. These logs capture the action type (e.g., booking created, settings updated), the IP address of the request, a timestamp, and a reference to the affected record. IP addresses are retained for security investigation purposes only and are not used for advertising or profiling.
Pinkbook uses browser localStorage to persist certain state locally on your device — including authentication tokens, calendar view preferences, working hours drafts, and UI settings. This data is stored on your device and is not transmitted to servers unless explicitly synced. Clearing browser storage will reset locally stored preferences.
Consumers who create a Pinkbook Discovery client account provide:
google_id) — if the account was created or linked via Google Sign-In (see 3.14)Client account data is used to pre-fill booking forms and personalise the discovery experience. It is not shared with service providers beyond the information you choose to include in a booking.
Verified client account holders may leave a star rating (1–5) and optional text comment on a service provider's Discovery profile. We store:
Review authors are displayed by first name and last initial only (e.g., "Sarah T."). Reviews are visible on the service provider's public Discovery page. You may delete your review at any time from your client account.
If you choose to sign in or create a client account using Google, we receive from Google:
We store your Google ID alongside your Pinkbook client account to enable future sign-in without a password. We do not receive, store, or access your Google password, contacts, calendar, or other Google account data through this process. You may disconnect Google Sign-In by deleting your Pinkbook client account or contacting us at [email protected].
Service providers can post their work to Discovery, the Pinkbook feed: photos, videos, before-and-after posts, captions, hashtags, "looks", the bookable service a post is linked to, and optionally the city it was taken in. Posts are public: anyone using Discovery, signed in or not, can see them, along with the provider's public profile.
Before posting a photo or video of a client, including a before-and-after, you must have that client's permission (see the Terms of Service).
When you use Discovery we record likes, comments, saves, saved pros, follows, shares, searches, and how the feed is used (for example which posts were viewed and for how long). We use this to rank the feed, to stop spam and abuse, and to show service providers aggregated insights about their own posts (such as views and saves). Feed analytics are recorded under pseudonymous identifiers (salted hashes), not names or email addresses. Comments, likes counts and follows are visible to other users.
Service providers can create designs in Brand Studio, publish a website, and add a business card to Apple Wallet. We store the designs, the website content you choose to publish (which is public), and generate the Wallet card from your business name, city, plan, brand colour, logo and booking link when you add it.
If you allow notifications, we store your device's push token (Apple Push Notification service on iPhone) or your browser's web-push subscription, and your notification preferences. These are used only to send you Pinkbook notifications and are deleted when you sign out of the device, turn notifications off, or close your account.
When an account is created we record the IP address used, the country of that connection as reported by our network provider (Cloudflare), and how you found Pinkbook: the referring website and any campaign tags on the link you followed. We do not collect precise location. Discovery's "Nearby" uses the city you or a provider has set, not your device's GPS.
We use the information we collect to:
Pinkbook does not sell your personal information to third parties and does not use it for targeted advertising or cross-platform tracking.
We process personal information under the following legal bases, consistent with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation:
Pinkbook shares data with the following third-party services only as strictly necessary to operate the platform:
Used to process deposits and subscription billing, and to facilitate Stripe Connect accounts for service providers. When a payment is initiated, relevant transaction data (amount, booking reference) is transmitted to Stripe. Stripe independently processes payment card data. See Stripe's Privacy Policy.
If a service provider has connected their own Twilio account, appointment reminders are routed through it. The client's phone number and a templated reminder message are transmitted to Twilio for delivery at the time of sending. Pinkbook uses the service provider's credentials for this; it does not maintain a shared Twilio account. See Twilio's Privacy Policy.
Pinkbook's AI features use DeepSeek's API (DeepSeek is based in China; data sent to it may be processed there). What is sent depends on the feature (see Section 7): for the AI Brain, pseudonymized booking patterns only (no names, emails or phone numbers); for client list import, the text a service provider pastes in, which can include their clients' names and contact details; for review moderation, the text of a review; for the Jasmine assistant, the questions you type. See DeepSeek's Privacy Policy.
Pinkbook's website traffic passes through Cloudflare for security and performance, which sees IP addresses and request details. Photos and videos posted to Discovery, websites published with Pinkbook, and feed analytics are stored with Cloudflare (R2). See Cloudflare's Privacy Policy.
Notifications to iPhones are delivered through the Apple Push Notification service, which receives the device token and the notification text. Apple Wallet business cards are generated by Pinkbook and handed to Apple Wallet on your device. See Apple's Privacy Policy.
If a service provider accepts PayPal, the client is sent to PayPal to pay, and PayPal receives the amount, the booking reference and the details the client enters with PayPal. See PayPal's Privacy Statement.
Emails (booking confirmations, reminders, receipts, password resets, and marketing emails a provider sends to their clients) are delivered through Brevo (Sendinblue SAS, France). The recipient's email address and the email content are transmitted to Brevo for delivery. Only a masked address and a hash are retained in Pinkbook's email log. See Brevo's Privacy Policy.
Pinkbook's backend, database, and application are hosted on Render's cloud infrastructure. All platform data resides on Render-managed servers. Render acts as a sub-processor under contractual data protection obligations. See Render's Privacy Policy.
We may disclose personal information when required by applicable law, enforceable court order, or regulatory authority, or when reasonably necessary to protect the rights, safety, or property of Pinkbook or its users.
Pinkbook's AI features are powered by DeepSeek's language model (see Section 6). They are:
The AI Brain can be enabled or disabled at any time in Settings.
When enabled, the AI Brain:
client_signals table and structured recommendations in the ai_recommendations tableProcessing uses pseudonymized data only. Clients are referenced by hashed identifiers and aggregated booking statistics — not by name, email address, or direct contact details — when generating AI outputs.
Service providers are solely responsible for how they act on AI-generated recommendations. Pinkbook makes no guarantee of accuracy or suitability for any particular business decision.
Disabling AI Brain stops new signal computation. Previously stored signals and recommendations remain in the database until the service provider deletes the associated client records, or until account closure.
Posts, comments and profiles in Discovery are screened automatically when they are published, and anyone can report content or block an account. Reported content is reviewed by Pinkbook, normally within 24 hours. Content that breaks the Terms of Service is removed; the original files are kept for the period needed to handle an appeal or a legal request, then deleted. You are told when your content is removed and can appeal from the app. We keep a record of reports, decisions and appeals.
We implement the following safeguards to protect your information:
No system can guarantee absolute security. In the event of a breach affecting personal data, Pinkbook will investigate, contain, and notify affected users as required by applicable law.
We retain data for as long as necessary to operate the platform and meet legal obligations:
You may request deletion of your data at any time by contacting [email protected], subject to retention obligations we are legally required to maintain.
Subject to applicable law, you have the right to:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may require identity verification before processing a request.
Clients of service providers: Your booking data is controlled by the service provider whose page you booked through. For deletion or access requests, contact that service provider directly. Pinkbook will assist with technical deletion upon confirmed request from the service provider.
United States residents: you can ask what personal information we hold about you, ask us to correct or delete it, and ask for a copy, by emailing [email protected]. We will not treat you differently for making a request. Pinkbook does not sell personal information and does not share it for cross-context behavioural advertising.
Discovery content: you can delete your posts, comments, likes, saves and follows at any time in the app. Deleting your account removes your Discovery data as well as your booking account.
Pinkbook does not use tracking cookies, advertising cookies, or third-party analytics scripts. The platform uses browser localStorage to store your authentication token, calendar view preferences, working hours settings, and UI state between sessions on the same device. This data is kept on your device, is never shared with third parties, and is not used for tracking or profiling. Clearing your browser's storage will reset all locally stored preferences.
Pinkbook is not directed at individuals under the age of majority in their jurisdiction (18 in most Canadian provinces). We do not knowingly collect personal information from minors. If you believe a minor has submitted information through the platform, contact us at [email protected] and we will promptly delete it.
Pinkbook is operated from Canada and serves service providers and clients in Canada and the United States. Its infrastructure is hosted by Render (United States), with media and network services from Cloudflare (global). Data may also be processed by our providers in other countries: Stripe and PayPal (United States and elsewhere), Twilio (United States), Brevo (European Union), Apple (United States) and DeepSeek (China, for the AI features described in Section 7). When data is transferred internationally we rely on the contractual protections and data processing terms of those providers.
By using Pinkbook, you acknowledge that your information may be transferred to and processed in jurisdictions outside your own. We take reasonable steps to ensure these transfers comply with applicable privacy law.
We may update this Privacy Policy from time to time. For material changes, we will notify affected users via email (to the registered account address) and/or via a prominent in-app notice at least 14 days before the change takes effect. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
For privacy questions, access requests, deletion requests, or to report a concern regarding your data:
If your privacy concern has not been adequately resolved, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.