Privacy and security

Primsy holds two kinds of data: yours, and your clients’. Both are handled the same careful way, and both belong to the people they describe.

What is stored

• About your business: your sign-in email and a scrambled form of your password (it is never stored as typed), your business details, your menu, your team, your hours.
• About your plan, if you choose one: the reference numbers Stripe gives your billing account, subscription and checkout, the plan, its status, and its billing dates: when the current period started and when it renews or ends. With extra texts switched on, also one record per renewal invoice: the reference numbers of the invoice and of its extra-texts line, how many extra texts it covered (sometimes none), the amount, and whether the line was added. Card details are typed into Stripe’s own page, not Primsy’s, and kept by Stripe; Primsy stores none of them.
• About your clients: name, mobile number, email, the bookings themselves, the notes you keep, their answers to your booking questions, and for mobile services the address you are visiting. For event requests, the guest count and the notes they sent.
• Reviews: the rating, the words, and the name they booked with.
• Waitlists: the name, mobile number and email a client gives to join, the day and part of it, and the services and team member they chose. Entries are deleted within three days after that day.

How it is protected

• Every page and every message link is served over an encrypted connection.
• Your password is hashed with a salted, slow algorithm, which means even we cannot read it. Reset it by email if you forget it — once your address is verified from Settings.
• A client’s booking link is a long random key — private to whoever holds it. It is sent to the contact given for that booking and nobody else (why). Tell clients not to forward it.
• Your console only ever shows your business. Nobody else’s data is reachable from it, by design.

Whose data it is

• Yours. Export your bookings and clients from Settings any time, on every plan. If you leave, ask and we delete the business and everything in it.
• Your clients’. Primsy stores and sends on your behalf; it does not use your clients’ details for anything else, does not show them to other businesses, and does not sell or share them. The one thing published is a review a client chooses to leave: your booking page shows its rating, its words and the name the client booked under. If a client asks to be forgotten, tell us and we remove their records.

Who else touches the data

Primsy runs on hosting, database, email, text-message and payment providers who process data under contract to do exactly that job. The privacy policy that accompanies the first open signup names them. If you connect a team member’s Google Calendar, their bookings are written to it, as Team and hours describes.

What Primsy is not for