At Stylacal, privacy is an architectural invariant, not an afterthought. We design our software to ensure client appointment details remain strictly isolated within the business context to which they belong.
1. Our Roles: Controller vs. Processor
Depending on how you interact with our platform, we operate in two distinct capacities under global privacy frameworks (GDPR, UK GDPR, and CCPA/CPRA):
- Stylacal as a Data Controller: For Workspace Owner account registration, login credentials (via Clerk), billing data, commercial transactions, and direct customer support communications.
- Stylacal as a Data Processor (Service Provider): When Workspace Owners and businesses collect end-customer appointment requests, intake form answers, customer notes, and scheduling details. In this capacity, the Workspace Owner acts as the Data Controller, and we process data solely on their documented instructions under our Data Processing Addendum.
2. Data We Collect & How We Use It
2.1 Account & Administrative Data
When you register for a Workspace, we collect your name, email address, password hash, and payment tokens. We do not store raw credit card numbers; payment tokens are managed directly through our PCI-DSS Level 1 compliant partner, Stripe.
2.2 Scheduling & Appointment Data
When clients book appointments with your business, we process client names, email addresses, phone numbers, appointment timestamps, and custom intake responses. This data is stored in our database strictly partitioned by Workspace ID and Business ID.
3. Calendar Integrations & OAuth Tokens
When you connect Google Calendar or Microsoft 365 Outlook to Stylacal:
- We authenticate using industry-standard OAuth 2.0 protocols.
- We never see, collect, or store your third-party account passwords.
- We store encrypted OAuth refresh tokens to read free/busy availability and insert confirmed calendar invites.
- You may revoke calendar access at any time directly through your Google or Microsoft account settings or within the Stylacal account hub.
4. Absolute AI Model Training Prohibition
5. Cross-Business Isolation & Conflict Masking
Stylacal enforces a strict architectural boundary between businesses:
- When staff members are assigned to multiple Business Profiles, conflicting obligations in Business A are displayed in Business B strictly as opaque, hatched
Unavailableblocks. - Neither the client’s name, service description, nor appointment notes are ever exposed across business lines.
- Customer Portal access is authenticated via one-time email passcodes (OTP), preventing link guessing and ensuring clients only access records for the specific business they booked with.
6. Data Retention & Deletion Lifecycle
We preserve operational data only for as long as necessary to provide the Services:
- Active Accounts: Appointment and customer records are retained while the Workspace remains active.
- Financial Records: In compliance with statutory tax and accounting obligations, transaction logs and invoice records are preserved for 7 years.
- Deletion Requests: When an account deletion request is verified, all personal data, appointment history, and OAuth tokens are permanently purged within 30 days.
7. Your Privacy Rights (GDPR & CCPA/CPRA)
Depending on your jurisdiction, you have the following rights:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Correct inaccurate or incomplete personal records.
- Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your data.
- Right to Data Portability: Export your appointment history and client directory in machine-readable JSON or CSV format.
To exercise any of these rights, contact our Data Protection Officer at privacy@stylacal.com.