Privacy Policy

1. What data we collect

We collect the following classes of data, only as needed to operate the service. We do not collect anything in this list speculatively.

1.1 Account data

Owner name, email address, phone number, business name, business type, business address, time zone.

1.2 Authentication data

Password (stored only as a salted hash via Supabase Auth — we never see plaintext), Supabase session tokens, OAuth refresh and access tokens for Square and any other connected booking platform (encrypted at rest), and a short-lived Chrome extension pairing token held in chrome.storage.local.

1.3 Booking and client data

For each appointment synced from your connected platform: client name, client phone number, client email address (where the platform exposes it), appointment start and end time, service name, service duration, service price, staff assignment, booking status (confirmed, cancelled, completed, no-show), and cancellation or reschedule events.

1.4 Communication data

Outbound SMS we send on your behalf via Twilio (recipient phone, sender phone, message body, status, timestamp), inbound SMS replies from your clients, and the resulting conversation thread.

1.5 Payment and billing data

Stripe customer ID, subscription tier and status, invoice history (date, amount, status). Card number, CVV and expiry are entered directly into Stripe’s checkout — vivyd never receives or stores them.

1.6 Calendar data via Chrome extension on Fresha

When the vivyd Chrome extension is paired and an authenticated Fresha tab is open, we read your Fresha calendar to capture appointments, customer details, service catalogue, staff roster, working hours, and cancellation events. The extension only activates on tabs whose URL matches https://*.fresha.com/*. It does not read any data from any other website.

1.7 Usage and diagnostic data

Page views, button clicks within the dashboard, error logs, system performance metrics, action events (e.g. cancellation_detected, sms_sent) with minimal payload context. No payload ever contains card data, plaintext passwords, or browsing history.

1.8 Device data

Browser type, operating system, and IP address — captured incidentally in standard HTTPS request logs by our hosting provider. Used only for security, abuse prevention and debugging.

2. How we use it

Each data class is used only for the purpose listed beside it. We do not use any of this data for advertising or third-party profiling.

• Calendar and booking data → detect cancellations in real time, fill the freed slot by cascading SMS offers to scored existing clients, optimise schedules by proposing booking moves to consolidate gaps, predict no-shows from booking history signals, and auto-rebook cancelled clients for the following week.
• Customer phone numbers → routed via Twilio to deliver booking recovery, confirmation, reschedule and auto-rebook SMS. We only message customers already on your active client list who have implicitly opted in via your standard booking terms. Every SMS carries a clear sender identifier and respects opt-out keywords (STOP, UNSUBSCRIBE).
• Customer email addresses → held for forward compatibility (future opt-in email reminders, only with explicit owner sign-off). Not currently used for outbound mail.
• Account data → authenticate you, surface the right business in the dashboard, populate billing receipts and onboarding email.
• Payment data → processed by Stripe for subscription billing; we use the Stripe customer ID to reconcile payments against your plan and send receipts.
• Communication data → power the SMS conversation pipeline (offer slot, receive YES, write back to your calendar), debug delivery failures, and tune our internal cascade-ranking models.
• Inbound SMS contents → sent to Anthropic to parse customer intent and draft replies. No payment data and no unrelated communications are sent.
• Usage and diagnostic data → diagnose bugs, monitor system health, measure feature performance, improve service quality.
• Authentication tokens → keep you signed in and pair the Chrome extension to the right business.
• Device data → security, rate-limiting, abuse prevention.

3. Subprocessors

vivyd uses the following third-party subprocessors. Each receives only the minimum data required for the function listed. We do not authorise any of them to use vivyd customer data for any other purpose.

We will update this list before adding any new subprocessor that handles personal data. Material additions are announced under section 9.

4. How we share data

Each share scenario maps to exactly one subprocessor named in section 3:

• To deliver SMS → Twilio.
• To bill subscriptions → Stripe.
• To parse inbound SMS and draft replies → Anthropic (inbound message and minimal context only).
• To deliver transactional email → Twilio SendGrid.
• To host the application and database → Vercel (Sydney) and Supabase (Sydney).
• To read or write to your booking platform → Square (if connected) or Fresha (if connected).
• To run vivyd staff support and privacy inboxes → Google Workspace.

We do not:

• Sell user data to advertisers, data brokers, or anyone else.
• Share data with marketing partners.
• Permit any subprocessor to use vivyd data to train general-purpose AI models or for any purpose beyond the function in section 3.

We may disclose data when legally compelled — for example, in response to a valid subpoena, court order, or lawful regulator request. Where we are permitted to do so, we will notify the affected account before disclosing.

5. Data retention

• Account data — held while your account is active, deleted within 30 days of account deletion.
• SMS message logs — 12 months from send date, then deleted.
• Booking and client data — while your account is active, then deleted or aggregated within 12 months of account deletion.
• Payment and billing records — 7 years, retained to satisfy Australian Corporations Act and ATO record-keeping requirements.
• Debug and diagnostic events — 30 days, then deleted.
• Usage analytics — aggregated and de-identified, retained indefinitely for product analytics.
• OAuth and authentication tokens — deleted immediately when you disconnect the integration or delete the account.

6. Your rights

Under the Australian Privacy Principles (APPs), the EU GDPR (where applicable), and the California CCPA (where applicable), you have the right to:

• Access your data — email privacy@vivyd.ai.
• Correct your data — edit in the dashboard, or email privacy@vivyd.ai.
• Delete your data — use the in-app account-delete control, or email privacy@vivyd.ai.
• Export your data — request a portable copy (CSV or JSON) at privacy@vivyd.ai.
• Withdraw consent at any time — disconnect integrations, disable SMS, or close the account. Email privacy@vivyd.ai if you need help.
• Object to a particular use — email privacy@vivyd.ai.
• Complain — Australian customers may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. EU customers may complain to their local supervisory authority. California customers may complain to the California Privacy Protection Agency.

We respond to verified rights requests within 30 days.

7. Children’s data

vivyd is sold to businesses, not to children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has provided personal data to vivyd, email privacy@vivyd.ai and we will delete it immediately.

8. Security

• All data is encrypted in transit over TLS 1.2 or higher.
• All data is encrypted at rest in Supabase using AES-256.
• OAuth tokens and other secrets are stored in a separate encrypted column.
• Database access is gated by row-level security and a service-role boundary; only server-side code with the service role can read across organisations.
• Production access by vivyd staff is logged and limited to the founder and any authorised contractors under written confidentiality.
• We carry out a security review of permissions, secrets and dependencies at least annually, and after any material architectural change.
• If we ever experience a data breach that meets the threshold under the Australian Notifiable Data Breaches scheme, we will notify affected users and the OAIC as required by law.

9. Changes to this policy

We will notify users of material changes — including the addition of any new subprocessor that handles personal data — by email and an in-product banner at least 30 days before the change takes effect. The “last updated” date at the top of this page tracks the most recent revision. Older versions are kept on request.

Effective version: 2026-05-13. Last reviewed for Chrome Web Store compliance: 13 May 2026.

10. Chrome extension specific disclosures

Required by Chrome Web Store policy and listed here in plain language:

• The vivyd Chrome extension reads Fresha calendar data only on fresha.com tabs you have open. It does not read browsing data outside Fresha.
• Calendar data captured by the extension is sent to vivyd.ai servers (Sydney) over HTTPS only.
• The extension does not collect form data, passwords, or financial data from any page. It does not read tab URLs outside *.fresha.com and vivyd.ai.
• The extension does not inject ads, affiliate links, tracking pixels, or third-party analytics into Fresha or any other site.
• The extension uses chrome.storage.local only to store a vivyd pairing token, the connected business identifier, and a short cache of last-synced booking timestamps. No third-party personal data is written to chrome.storage.
• You can disable or remove the extension at any time via chrome://extensions. Disabling it stops new calendar reads immediately. To delete data already synced to vivyd, use the account deletion right described in section 6.
• The extension’s declared host permissions are https://*.fresha.com/* (to read your calendar) and https://vivyd.ai/* (to send the data to your vivyd account). No other origins are contacted.
• Data captured by the extension is never sold, transferred for advertising, or used to train any general-purpose AI model — consistent with the Chrome Web Store Limited Use requirements.
• vivyd is an independent product. We are not affiliated with, endorsed by, or sponsored by Fresha.com Ltd. “Fresha” is a trademark of Fresha.com Ltd.

11. Contact

Privacy questions, data access or deletion requests, complaints, anything else: email privacy@vivyd.ai. A real human reads that inbox during Australian business hours.