Privacy at Hyalite

Your login and your business

For each person who signs in, Hyalite keeps their name, their email address, a scrambled form of their password that can't be turned back into it, and when they last signed in. While you're signed in, Hyalite keeps your session, with the browser or phone it's on and the network address it came from, for up to 30 days. When a login's email address changes, or a reset link is sent, Hyalite keeps a record of it, so that a change nobody asked for can be traced.

For your business, Hyalite keeps what you enter: its name, address, phone number, booking page address, hours, services and prices, providers, policy, and the photos and logo on your booking page.

If you pay for Hyalite, Stripe takes the payment. Hyalite keeps Stripe's reference to your subscription, never your card.

Your clients' details

A business keeps its clients' records in Hyalite, and those records are the business's. For each client, Hyalite keeps what the business or the client enters: their name, phone number, email address and birthdate; their appointments and what they booked; notes; what they paid, and any tip or refund; the texts between them and the business; whether they agreed to texts, and when; and whether they asked for no more optional emails, such as birthday wishes.

Hyalite also keeps a record of each text and email it sends a client for the business: when, to which number or address, and whether it arrived. It doesn't keep the words of an email or a reminder once sent.

Notes, booking notes and texts are encrypted as they're saved. A client's details are never sold, never used to advertise, and never shown to another business.

When a client pays by card from their own phone, they type their card into Stripe's page, and Hyalite never sees it. Hyalite keeps what was paid and Stripe's reference to the payment.

The iPhone app

When you allow alerts in the iPhone app, Hyalite keeps the token Apple gives your phone for them, with the login and business it alerts for, the app's version, and when it was last seen. Signing out in the app switches its alerts off, and so does Apple telling Hyalite the app was removed.

Face ID, when you use it to unlock the app, stays on your phone. Hyalite never sees your face or your fingerprint.

The app has no advertising and no tracking, and shares nothing with advertisers or data brokers.

Who Hyalite shares it with

Only the services that run Hyalite, each for its own part, and only what that part needs:

Stripe takes payments: Hyalite's own subscriptions, with your business's name and your email address, and the card payments a client makes to a business.

Twilio sends and receives the business's texts, with the client's phone number and the words of each text.

Resend sends Hyalite's emails, with the address, the subject and the words of each email.

Cloudflare hosts Hyalite: the app runs on Cloudflare and everything Hyalite keeps is stored there.

Apple's push service carries the iPhone app's alerts to your phone.

TypeSafe sorts a client's reply to a text, such as whether they want to cancel or move their appointment, from the words of the reply and the service and time of the appointment it's about: never the client's name, number or record.

Hyalite shares nothing else with anyone, unless the law requires it.

Inside Hyalite, a platform admin can open your business only to help you with it, and never sees notes or texts there. Every time they do, it is logged and you can see it in Settings.

This website

Hyalite's own pages use no analytics and no advertising. They keep two small cookies: one that keeps you signed in, and one that remembers the language you chose. The trial form keeps your studio's name, your name and your email only so that Hyalite can answer you, and they are never sent to anyone else. The marketing pages load a typeface from Google Fonts, which sees your network address when it sends it.

How long Hyalite keeps it

A business's records, and its clients' details in them, are kept for as long as the business has a Hyalite account, and after a trial or a plan ends, until the business asks for them to be deleted. Nothing is switched off or deleted while you decide whether to stay.

A client's details are kept until the business deletes the client, or asks Hyalite to delete its records.

Some things go sooner: a session ends after 30 days, a reset link after an hour, and the record of each reset email after 90 days. Only the latest export of a business's clients is kept, and each new one replaces it.

Cloudflare keeps backups and request logs for up to 30 days, so something deleted from Hyalite is gone from those within 30 days more.

How to have it deleted

A business can delete any client itself, from the client's page in the front desk: Delete this client removes them for good, with their appointments, sales, notes, texts and consents.

To have your business deleted, with your login and every client in it, write to contact@hyalite.io from the email address you sign in with. Hyalite sends you an export of your clients first if you want one, and deletes everything within 30 days of your asking.

If you're a client of a business that uses Hyalite, the business decides about your record, so ask the business to delete it. If you write to Hyalite instead, Hyalite passes your request to that business and helps it do so.

Stripe, Twilio and Resend keep their own records of the payments, texts and emails they handled, under their own privacy policies.

Questions

Write to contact@hyalite.io. If this page changes, the date at the top changes with it.