Privacy Policy

1. Information We Collect

Account Information. When you create an account, we collect your name, email address, phone number, and password (stored as a hashed credential), or the account details Google or Apple share if you sign in with them. Salon owners and team accounts may also provide business name, address, and billing information.

Business and payout information. To set up payments, we collect the details Stripe requires to verify your identity and business, such as your legal name, date of birth, address, tax ID and bank account. These are sent to Stripe for verification.

Client Data. Stylists using Sable store client records on the platform, which may include client names, phone numbers, email addresses, birthdays, appointment history, service notes, formula records, allergies, answers to the salon's forms (which can include health questions the salon asks), signatures, records of a client's consent to texts or to a saved card, messages and photos. This data is owned by the stylist or salon and processed by us on their behalf.

Booking and Transaction Data. We collect information about appointments booked through Sable, including service type, date, time, and associated payments. Payment card information is handled directly by Stripe and is not stored on our servers.

Messages. Texts and photos sent between a business and its clients through Sable, and emails Sable sends, pass through our messaging and email providers and are stored so the conversation can be shown and kept.

Jules and voice. What you ask Jules, its answers, and any images you share with it are stored with your account. When you talk to Jules by voice, your audio is streamed live to produce a response and is not recorded or kept.

Time clock and location. If your salon requires clocking in at the salon, Sable reads your device's location once when you clock in or out and stores that reading with the time entry. Only people allowed to see pay, and you, can see it. We never use it for anything else.

Usage and Device Data. We automatically collect information about how you use Sable, including IP address, browser type, device identifiers, the Sable site origin, and actions taken within the app. For fraud prevention and account security, device signals may include display, canvas, WebGL, audio, font, storage-capability, hardware, and network characteristics. We do not include page paths, query strings, fragments, or authentication tokens in the security provider's identification URL. Our marketing website uses Google Analytics (via Google Tag Manager), which sets cookies to measure visits and signups in aggregate.

Product analytics. In the Sable app we use PostHog to see which screens and buttons are used and where people get stuck. This includes recordings of app sessions. A recording shows each screen with the app's own words, such as menu items, page titles and button names, and where people click. It hides everything typed; names, contact details, messages, notes, formulas and form answers; every number, such as prices, phone numbers, dates and times; and all images, charts and maps. Analytics are linked to your account and business IDs, never your name, email or phone number. PostHog never runs on the pages clients use to book, pay or fill out forms, so those pages are never recorded. Product analytics are part of using the Sable app and the iOS app, and start once you've accepted these terms. PostHog acts only as our service provider: we don't sell or share this information, or use it for advertising or to follow you across other sites.

Diagnostics and Crash Reports. When the Sable app or website hits an error, crashes, or stops responding, we send a diagnostic report to Sentry, our error monitoring provider. To help us fix the problem for the right person, the report is linked to your account: it includes your user ID and email address, the business you were working in and your role there, your device model, operating system and app version, the screen you were on, and the steps that led to the problem (the screens you visited and the controls you tapped). Diagnostic reports never include what you typed, your clients' records, message contents, payment card details, passwords, or sign-in tokens. We use them only to find and fix problems, never for advertising or tracking.

Communications. If you contact us for support, including through the help center chat, or submit feedback, we retain those communications to improve our service and assist with future inquiries. When you message Sable Support from the app, your message and any screenshots you attach are sent to Plain, our support provider, together with details that help us answer you: your name, email address and role, the topic you choose, your business's plan, team size, time zone, account and setup status (including its payment account ID and status), the app version and device you are using, the screen you were on, and references to any related error reports. Support messages never include your passwords or sign-in codes, card or bank numbers, or your clients' records.

From services you connect. If you connect Google Calendar, Google Business Profile, Gusto or an outside assistant, or ask us to move your business from another booking platform, we receive the information that connection or move provides.

2. How We Use Information

• Provide, operate, and maintain the Sable platform
• Process bookings, payments, and refunds
• Send transactional messages such as booking confirmations and appointment reminders
• Send SMS and email marketing with your prior consent
• Authenticate your identity and maintain account security, and prevent fraud
• Respond to support requests and improve customer service
• Analyze usage patterns to improve features and performance
• Power Jules and other intelligent features you use
• Comply with legal obligations and enforce our Terms of Service

We do not use your information or your clients' information for advertising, and we do not sell it.

3. SMS / Text Messages

Sable uses SMS messaging for the following purposes:

• Authentication: We send one-time passcodes (OTPs) on demand through Twilio Verify when a Sable account user submits a phone number. These messages are separate from the A2P campaign described below.
• Appointment and Customer Care: With your consent, we send appointment confirmations, reminders, booking updates, payment links, and direct replies from businesses using Sable.
• Marketing: With your separate, explicit opt-in consent, the business you are booking with may send promotions and special offers through Sable.

Consent: Client appointment, customer-care, payment-link, and marketing SMS messages are sent only after the recipient actively checks the corresponding optional, unchecked checkbox on a Sable public booking form. Authentication codes are sent separately through Twilio Verify.

Opt-Out: You can opt out of SMS messages at any time by replying STOP to any message. After opting out, you will receive a single confirmation message and no further regular Sable SMS from that sending number. One-time authentication codes sent on demand through Twilio Verify are managed separately. Reply HELP for assistance.

Message and data rates may apply. Message frequency varies depending on your usage and preferences.

No Third-Party Marketing: Mobile phone numbers and SMS opt-in consent records are never sold or shared with third parties or affiliates for their marketing or promotional purposes. Text messaging originator opt-in data is shared only with service providers acting on our behalf (such as Twilio) solely to deliver the messages you have consented to receive.

4. Google Calendar Integration

Sable offers an optional integration that puts your Sable appointments and time blocks on your Google Calendar. If you choose to connect your Google account, here is exactly what happens with your Google user data:

• What we access: With your permission, granted through Google's consent screen, Sable receives access limited to creating a dedicated calendar in your Google account and managing events on that calendar only (the calendar.app.created scope). Sable cannot see, change, or delete your other calendars or their events.
• How we use it: Solely to keep the Sable calendar in your Google account up to date with your Sable schedule. We do not use Google user data for advertising, and we do not make decisions about you based on it.
• What we store: We store the connection credentials Google issues to Sable, encrypted at rest, along with the identifiers of the events we created so we can keep them current. We do not read or store the contents of your personal Google calendars.
• Sharing: Google user data is never sold, never shared with third parties, and never used for marketing. No human at Sable reads it except with your explicit permission for support, for security purposes, or where required by law.
• Disconnecting: You can disconnect at any time from Settings → Integrations in Sable (choosing whether to keep or remove the Sable calendar), or by revoking Sable's access at myaccount.google.com/permissions. Disconnecting deletes the stored credentials.

Sable's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Intelligent features

To produce Jules's answers, drafts, voice responses, marketing copy, review-reply suggestions and product scans, we send the content needed for that request to trusted outside AI services. They process it only to return results to us, and our agreements with them do not allow them to use it to train their models.

6. Data Sharing

We do not sell your personal information or share it for cross-context behavioral advertising, as California and other state laws define those terms, and we have not done so in the past 12 months. We share data only in the following circumstances:

• Service Providers: We share information with trusted third-party vendors who help us operate Sable, including Stripe (payments and identity verification), Twilio (texting and verification codes), Resend (email), Railway, Cloudflare and Amazon Web Services (hosting and storage), Sentry (error monitoring), PostHog (product analytics), Better Auth (sign-in security), Google and Mapbox (maps and address search), Plain (customer support), and trusted outside AI services (intelligent features). These vendors are contractually obligated to protect your data and may use it only to provide their services to us.
• Stylists and Salons: If you book an appointment through a salon's Sable booking page, your booking information is shared with that stylist or salon.
• Connected apps you authorize: When you connect an external service such as Claude, ChatGPT or Muse, we share the workspace information covered by your selected permissions and current Sable role. This may include client and stylist names, appointment and service details, availability, prices, or revenue totals. The connector does not share client contact details, private notes, form responses, formulas, photos, messages, or card details. Booking and rescheduling proposals require separate approval in Sable. Disconnecting blocks future access and invalidates pending proposals, but does not erase data already received by the connected service. That service handles its copies under its own privacy policy. Sable keeps connection and approval records for security and booking history under the retention practices below; proposal records are removed when the workspace is deleted.
• Legal Requirements: We may disclose information if required by law, subpoena, or other legal process, or if we believe disclosure is necessary to protect our rights or the safety of others.
• Business Transfers: If Sable is acquired or merges with another entity, your information may be transferred as part of that transaction, subject to the same privacy protections.

7. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS), encrypted storage for sensitive fields, hashed passwords, and access controls that keep each business's records separate from every other business's. Access to production systems is restricted to authorized personnel.

No system is completely secure. While we take reasonable precautions, we cannot guarantee the absolute security of your data. If you believe your account has been compromised, contact us immediately at support@sable.salon.

8. Cookies and analytics choices

We use cookies that keep you signed in and remember your settings, and analytics cookies. On sable.salon you can allow or decline analytics in the cookie notice, and change your choice at any time from "cookie settings" at the bottom of the page. We treat a Global Privacy Control signal from your browser as a decline on sable.salon, and cookie settings show when that signal has been honored. Product analytics in the Sable app and the iOS app are part of using them and can't be turned off. Our Cookie Policy lists every cookie we use.

9. Data Retention

We retain your account information and associated data for as long as your account is active or as needed to provide services. If you close your account, we remove your login, phone number and email. When a salon or stylist business closes its account, its business and client records are kept for 12 months, so the owner can come back with everything intact or ask us for an export, and then deleted. The owner can ask us to delete them sooner. Copies in our backups are removed as those backups expire. Payment and tax records are kept for 7 years, as the law requires, and records of consent to texts or a saved card are kept as long as we need them to show that consent was given. App session recordings are deleted within 90 days. We may keep de-identified, aggregated information that can't be linked back to any person or business.

Client records belong to the stylist or salon that keeps them, and Sable processes them on its behalf. While the account is open, the owner decides how long to keep them and can export them at any time.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request an export of your data in a machine-readable format.
• Opt-Out of Marketing: Unsubscribe from marketing emails or SMS at any time via the unsubscribe link or by replying STOP.
• Opt-Out of Analytics on sable.salon: Decline analytics in the cookie notice or cookie settings on sable.salon. Product analytics in the Sable app and the iOS app are part of using them.

To exercise any of these rights, email us at support@sable.salon. We will respond within 30 days. We will verify your request before acting on it, you may use an authorized agent, and you may appeal a decision by replying to our response. We will not treat you differently for using these rights. If you're a salon's client, we'll pass your request to the salon that holds your records and help it respond.

11. Children

Sable accounts are for people 18 and older, and Sable is not directed to children. Salons may keep records about clients under 18 that a parent or guardian provides. We do not knowingly collect information directly from children under 13. If you believe a child has given us information, contact us and we will delete it.

12. Where your information is kept

Sable is operated from the United States, and your information is stored and processed in the United States.

13. Changes to this policy

When we update this policy, we change the effective date above. For material changes, we notify you by email or in the app and ask you to review the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us:

• Sable Systems LLC
• 5900 Balcones Drive, Ste 100, Austin, TX 78731
• support@sable.salon