Privacy Policy

Last updated: June 12, 2026

This policy explains what information Booktato collects, why we collect it, and how we handle it. We keep it short and in plain English because we'd actually like you to read it.

1. Information we collect

Studio owner account data. When you create a studio account we collect your business name, email address, password (stored hashed, never in plain text), and the settings and content you add — services, schedules, pricing, and your booking page.

Client booking data — collected on behalf of studios. When a client books with a studio through Booktato, the studio collects that client's name, contact details, appointment history, and any answers the client gives on the studio's intake forms. Intake forms may include health information the studio chooses to ask about. This data belongs to the studio, not to Booktato — we store and process it only so the studio can run its business. If you are a client of a studio that uses Booktato, the studio is responsible for how your information is used, and requests about your data should go to the studio first.

Visit addresses — mobile studios only. Some studios travel to their clients. When a studio has that turned on, its booking page asks for the address of the appointment (and any access notes you choose to add, such as a gate code), so the therapist knows where to go. To work out travel and whether the address is inside the studio's service area, we send the address — and nothing else, never your name or contact details — to the U.S. Census Bureau's free public address-lookup service, which returns approximate coordinates. We store the address, notes, and coordinates encrypted, and they are visible only to that studio. If the lookup fails we simply keep the address as you typed it. Studios that don't travel to clients never collect any of this.

2. Our role: processor, not owner

For client booking data, Booktato acts as a data processor on the studio's behalf and on its instructions. The studio is the data controller. We do not use client data for our own purposes, we do not build profiles from it, and we never sell it.

3. How we protect your data

All traffic to and from Booktato is encrypted in transit. Sensitive fields — such as health-related intake form answers, and the visit addresses and coordinates a mobile studio keeps — are additionally encrypted at rest in our database, and are kept out of our application logs. Access to production data is restricted to the small number of people who need it to operate the service.

4. Payment information

Payments are handled by Stripe and Square. When you or your clients enter card details, those details go directly to the payment provider — Booktato never sees or stores full card numbers. We keep only what we need to show payment status, such as the last four digits and the transaction outcome. Stripe's and Square's own privacy policies govern the data they handle.

5. Cookies and local storage

Booktato uses browser localStorage and sessionStorage to keep you signed in and to remember small preferences (like a dismissed banner). We do not use third-party advertising cookies or cross-site trackers.

6. How long we keep data

We keep your account and your studio's data for as long as your account is active. After an account is closed, data is retained for a short grace period so you can export it, then deleted from our active systems, except where the law requires us to keep specific records (for example, billing records for tax purposes).

7. Deletion requests

Studio owners can request deletion of their account and all associated data by contacting us. Clients of a studio should send deletion requests to the studio they booked with; as the data controller, the studio decides, and we carry out the deletion on its instruction. We respond to deletion requests within 30 days.

8. We don't sell data. Period.

We do not sell or rent personal information — yours or your clients' — to anyone, and we do not share it with third parties for their marketing. We share data only with the service providers we need to run Booktato (such as hosting, email delivery, and payment processing), each bound to use it only to provide their service to us, or when the law requires it.

9. Text messages (SMS)

If you give a studio permission to text you (by checking the SMS consent box when providing your phone number), your number is used only to send appointment-related messages — confirmations, reminders and changes, payment links and receipts, intake-form links, replies to messages you send, and sign-in codes — on that studio's behalf. Message frequency varies with your appointments; message and data rates may apply. Reply STOP at any time to opt out, or HELP for help. Mobile numbers and SMS consent are never shared with or sold to third parties for their marketing purposes.

Some studios also take calls on their Booktato number. A call to that number is connected to the studio's own phone; Booktato keeps a record of the call for the studio (your number, the time, and how long it lasted) and does not record the conversation. If the studio can't answer, it may text you once to follow up on your call; reply STOP if you'd rather it didn't.

10. Changes to this policy

If we make material changes to this policy we will notify you by email or in the app before they take effect. The "Last updated" date at the top always reflects the current version.

11. Contact

Questions or requests about your data? Get in touch through our contact form.