Privacy Policy

This Privacy Policy explains what information Slayd LLC ("Slayd," "we") collects through the Slayd iOS app and the Slayd website at slayd.ai, how we use it, who receives it, and the choices you have. It also covers people who pay a Provider through Slayd without a Slayd account, people who used guest checkout on slayd.ai before it closed, businesses we researched or emailed to invite to Slayd, and people whose details a beauty or fitness professional enters into Slayd. By using Slayd, you agree to this Policy.

Throughout this Policy, Provider means a beauty or fitness professional, studio, or salon that offers services through Slayd, and Client means someone who books them.

01Information We Collect

Category	What that means
Account & profile	Name, username, email address, date of birth, bio, profile photo, account role, the city and ZIP code you type during sign-up, your interests, and Instagram / TikTok handles if you add them.
Phone number	If you verify a phone number at sign-up, the number and the time it was verified are stored on your account, and a separate record of each one-time verification keeps the number (Section 14). On the website, and for anyone who used guest checkout before it closed, we store the number you typed without verifying it. We also keep a private internal record linking a phone number to the accounts that claimed it, so one number cannot be used to open unlimited accounts. We use that record to notify a Slayd client account when a Provider invites it as a client using its number, and, when a Provider adds or restores a client record with a phone number or changes the number on one, to count whether it is the verified number of a Slayd client account; that count connects nothing and is shown to no Provider or client (Section 09). Separately, when an account uses a referral code, we record whether its phone number was verified and whether it matches the phone number on the code owner's account. The Provider you book, and for team bookings the business they work for, can see the verified number on your account so they can reach you about the appointment.
Provider & business details	Business name, business phone and email, exact street address and exact map coordinates, a business's ZIP code, services, prices, hours, deposit and cancellation settings, and your team roster. The street address, exact coordinates, ZIP code, business phone and business email are kept private; the rest is public. See Section 08.
Content you create	Photos and videos you capture or upload, post captions, comments, reviews and star ratings, and your profile bio. Reviews carry your display name.
Messages	Direct messages between you and another account, including any photos you attach.
Appointment texts	The recipient phone number, Provider or business, appointment reference and details included in the text, outgoing text content, replies, message references, delivery status and times. We also record permission for that sender and number: your optional choice in Slayd, its wording version and time, or the Provider's confirmation that they obtained your written permission and any evidence note or reference they supply. We record your current choice, its recorded time and opt-out information. See Sections 09 and 14.
Social connections & activity	Who you follow and who follows you, follow requests you send or receive, accounts you have blocked, posts and reveals you liked, shared or saved, the posts and reveals in your saved collections, and your in-app notification history.
Bookings & purchases	Appointments and classes, the service, price, date and time, notes you write for your Provider, notes your Provider writes about the appointment, deposits, prepaid packages, class passes and memberships. We also record changes to a booking's date and time, who made each change and, when a Provider moves a booking as agreed with you, the Provider's confirmation that you agreed. See Section 17.
Payment information	Handled by Stripe. We receive amounts, status and identifiers — never your full card number or security code. For a card payment to a Provider we also keep the card's brand, last four digits and funding type, and whether it was paid with Apple Pay or Google Pay; the Provider you paid can see the brand and last four digits. For a card kept on file with a Provider we also keep its expiry; for a card typed in by a Provider, its issuing country and Stripe's card fingerprint; and if a card is declined, its fingerprint and the decline reason — see Section 10. For Providers, we store the last four digits of the bank account Stripe pays out to.
Subscription records	For Providers: subscription status, renewal dates and the transaction identifiers Apple or Stripe gives us.
Referral & promo codes	Any account can get a personal referral code to share. If you enter someone's code when you join, we record whose code it was, the code, when you used it, whether you joined on iPhone, Android or the web, whether your account was a Client or a Provider at that moment, whether your phone number was verified, and whether it matches the code owner's; we also note on your account whose code you joined with. Afterwards we note the first booking you make that is confirmed — by the Provider, or automatically for a service that needs no approval — and the first booking you pay for in full through Slayd, with the amount. If the confirmed booking is later cancelled, declined or marked as a no-show, its note is withdrawn; if the paid booking is cancelled or any of it is refunded, its note is withdrawn and we keep the date that happened. If you are a Provider, we note the first fully paid booking you take from a client other than the code owner, its amount and the account of the client who paid. Slayd staff can also credit an account to a code by hand — for example when a code you entered did not register — or take a credit away, and record the reason. If a code you enter is refused, we keep a record of the attempt, the code, the reason and the message you were shown. If you share your code, we count the accounts that joined with it and keep a record of any referral payment we make to you: the amount, how it was paid and any note we add. When you redeem a Slayd promo code, we record that your account used it and when. A code redeemed in the app or on the website is also saved on your account with the free access it gave you. A Provider's promo code you use on a booking is saved on that booking, where the Provider can see it.
Location	The city and ZIP you type. Separately, with your permission, your device's precise location — used on your device only. See Section 05.
Contacts	With your permission, we read names and phone numbers from your address book on your device to suggest people to invite. We do not upload them. See Section 03.
Calendar	With your permission, we add your booked appointments to your device calendar. We write events; we do not read your existing ones.
Device & push identifiers	A device identifier (on iPhone, the vendor identifier iOS assigns; on the web and in the Android app, a random identifier we create and keep in that browser's storage), your push notification token, and the platform (iPhone, Android or web), stored against your account so we can notify the right device.
Crash & error diagnostics	Crash reports and handled-error records sent to Firebase Crashlytics. See Section 12.
Usage timestamps	Two timestamps on your account: when you were last active (updated at most once an hour) and when you last booked. We do not run an analytics SDK — see Section 12.
Forms & signatures	Answers to intake, consent and policy forms a Provider sends you, the name you type as a signature, and the fact and time you agreed. A Provider can build a form that asks for health information such as allergies or a date of birth.
Reports & support	If you report content or a person: your account ID, what you reported, the reason and your written description. If you contact us: your name, email, business name and message.
Slayd AI conversations	If you use Slayd AI, the optional assistant in the app: the questions you type, its answers and the buttons it offered, whether you asked from the Client or the Provider side, when you agreed to its terms and which version of them, and any support request it opened for you, which carries your name, email address and the conversation so far.
Waitlist & applications	Consumer waitlist: your email address, plus, when available, the country your request came from and the network it came from — a shortened form of your IP address that identifies a block of addresses rather than your device (see the IP address row). Business early-access application or Enterprise enquiry: business name, contact name, email, phone, how you prefer to be contacted (email, text or call), street address, city, state, ZIP, business type, services, team size, number of locations and staff, booking system, Instagram, website, notes, how you found Slayd (the campaign tag on the link you followed, or what you told us), the features you want and how ready you are if you gave them, and the same country and network.
Business prospect records	If you run a beauty or fitness business we found in public listings: the business name, its map-listing identifier, its address, phone numbers (including a mobile number and its carrier, where one was listed), website and Instagram or Facebook pages, the region and service category we filed it under, a business email address published in its listing or on its own website, the address of the page we found it on, whether the email address passed a basic format and mail-server check and whether a phone number appeared valid, and, where we had one, a contact's first name. If we emailed you: when and how many times we wrote, and whether the message bounced, was reported as spam, was unsubscribed from, or led to an early-access application. If you replied: the sender name and email address on the reply, its subject line and a short excerpt. See "If we researched or emailed your business" below.
IP address	Read to rate-limit sign-ups, bookings, payment-link pages and forms; for that purpose it is not stored in readable form — see Section 16. Two exceptions keep part or all of it: the waitlist and business application forms store the network part of your IP address (for an IPv4 address, the last of its four numbers removed; for IPv6, only the first three groups kept) and your country with your entry; and when a Provider, or someone on their team, types a client's card into the app, the IP address of that device (for an IPv6 address, the first half of it) is kept with that payment's fraud and audit record (Section 10). Our servers' request logs also record it, for 30 days (Section 16).
Provider business records	If you are a Provider: the book of business you keep in Slayd — your client list, invoices, receipts, expenses, refunds, retail inventory, payroll entries, booth-renter records, rent payments, open slots, daily deals and personal tasks. These are backed up to our servers. See Section 09.
Client-list connections	If a Provider's client record is connected to your Slayd client account: on that record, your account ID, how the connection was made (a booking, an invite or a card request, and, where your phone number or email address picked out the record, which one; or, for a few records connected by an earlier version of Slayd, your email address) and when. A record created from your account when you accept an invite or card request also holds your name (or, if your account has none, the name the Provider typed), your username and your verified phone number if you have one, with coded forms of that number and of your verified sign-in email address (Section 09). If you choose Remove me, or the Provider chooses Not the right person: the Provider, your account ID, which of those choices it was and when. On your account, a coded form of your verified sign-in email address, once we have counted the client records that hold it (Section 09). Some client records also carry an older mark, left by an earlier version of Slayd and no longer added, naming a Slayd account the record might belong to; the Provider's app does not show it. See Section 09.

Where we get your information

Most of what we hold, you gave us. Not all of it:

From you — what you type when you sign up, build a profile or storefront, book, pay, post, message, or fill in a form.
From your device, with your permission — camera, microphone, photo library, location, contacts and calendar, as described in Sections 02, 03 and 05.
From a Provider — a beauty or fitness professional can add you to their client list, bulk-import a client list from another booking system, or invite you as a client using your phone number, whether or not you have ever used Slayd. If you have a Slayd client account, a Provider's record of you can be connected to it when you book that Provider or accept their invite or card request. See "Connecting your account to a Provider's client list" in Section 09.
From a business you work for — if you are a staff member, contractor or booth renter, your employer or host may enter your details, pay and rent records.
From our payment and platform providers — Stripe tells us the status of a payment or payout, the last four digits of a payout account, and details of the card used for a payment (never its full number — see Section 10); Apple tells us the status of a subscription bought on iPhone; Google tells us that a phone number verified.
From other Slayd users — someone can name you in a review, a comment, a message or a safety report.
From public business listings and business websites — if you run a beauty or fitness business, we may have found it in public map listings and open map data (Google Maps, Overture Maps and OpenStreetMap) and taken its published contact details — address, phone numbers and email address — from that listing or its own website, to invite it to Slayd. See "If we researched or emailed your business" below.

Some things stay on your phone. Your saved looks, the photos in your beauty journal and your recent searches are stored on your device and are not uploaded to us. Your journal entries themselves — their titles, dates, categories, notes and check-ins, without the photos — are backed up to your Slayd account, where only you can read them, so they appear on the website and on a new phone; they are deleted with your account. Saving a look from someone's post also records on that post that you saved it (Section 07). If a Provider enters a tax identifier (EIN or SSN) in the Tax Center, it is stored in the iOS Keychain on that device and is never transmitted to us — see Section 10.

If we researched or emailed your business

We built a list of beauty and fitness businesses from public map listings and open map data, with the address, phone numbers and email address each one publishes in its listing or on its own website. In September 2026 we emailed some of those businesses to invite them to Slayd. Every email was sent through Twilio SendGrid, carried an unsubscribe link, and had open and click tracking switched off. If you replied, your reply reached our Gmail inbox, and we kept the sender name and address, the subject line and a short excerpt. That campaign has ended. Email support@slayd.ai and we will delete what we hold about your business, keeping only the email address, marked do-not-contact, so it is never sent outreach email again. An address that unsubscribed or reported our email as spam keeps its full record, permanently marked so that it is never emailed again; an address whose email bounced keeps its full record and is taken off the sending list.

02Permissions We Request

Camera — capture photos and videos for posts.
Microphone — record audio with the videos you capture.
Photo Library — choose photos and videos to post.
Photo Library (add) — save content back to your library when you download it.
Location (while using the app) — sort Providers by distance from you.
Contacts — suggest friends to invite.
Calendar (full access) — add your booked appointments to your calendar.
Face ID — confirm it is you before switching to a saved account. Face ID data never leaves your device and is never seen by us; iOS only tells the app pass or fail.
Notifications — send booking and account updates.

You can grant or revoke any of these in your device Settings at any time. Declining a permission disables the related feature; it does not block the rest of the app.

03Contacts, In Detail

There are two places Slayd touches your address book, and they behave differently.

Find friends. If you allow Contacts access, the app reads first name, last name and the first phone number for up to 200 contacts, to show you a list of people to invite. That list is held in memory on your device. We do not upload your contacts, and we do not build a social graph from them.
Invite by message. Elsewhere, the app opens Apple's own contact picker. That picker runs outside the app, needs no permission, and hands back only the people you tap. The invite is then sent from your phone, as a message from you. Slayd does not send it and never sees the recipient.

04Paying Without an Account

Booking an appointment on Slayd, in the app or on slayd.ai, needs a Slayd account. We no longer offer guest checkout — booking and paying on slayd.ai without signing up.

A small number of Providers can take a card payment, for an appointment they have recorded, from a client who has no Slayd account — either by sending a payment link or by entering the client's card themselves in the Slayd app. This does not create an account; the payment is recorded on the Provider's appointment. Card details go into Stripe's own card form, and Slayd never receives the full card number. On a payment link, an email address you type for a receipt goes to Stripe, which sends the receipt. When a Provider enters a card, we keep the card's brand, last four digits, funding type, issuing country and Stripe's fingerprint for it, to check for fraud; if a card is declined on either route, we keep its fingerprint for the same reason. Section 10 explains both routes and everything we keep.

If you used guest checkout before it closed

Paying as a guest created a Slayd account for you, unless your email address already had one. When the payment succeeded, we either added the appointment to the existing account for your email address or created a Slayd sign-in for it, with no password, and a profile holding your name, a generated username, your email address and the phone number you typed, which was not verified. If you do not want that account, email support@slayd.ai and we will delete it.

We also kept a record of each guest checkout: the name, email address, phone number and any notes you entered, with the Provider, service, price and time slot. It was written when you filled in the form, before you paid, so one exists even for a checkout you did not finish; an unfinished one is marked expired or cancelled, not deleted (see Section 14). Email us and we will delete it. Your email address was also passed to Stripe so Stripe could send the receipt.

05Location, In Detail

We use location two different ways, and only one of them involves our servers.

Your location as a Client

When you allow location access, the app requests your device's precise location — not a coarse or city-level fix — and, if iOS has restricted the app to approximate location, it may ask you to allow full accuracy once. We use that fix to sort Providers by distance and to fill in an address field, and we convert it to a street, city and ZIP using Apple's geocoding service, which means Apple receives those coordinates.

Your device location is not sent to Slayd's servers and we do not store it. It stays on your phone. The city and ZIP saved on your profile are the ones you typed at sign-up, not ones taken from your device.

When you type an address anywhere in the app, the characters you type are sent to Apple to generate autocomplete suggestions.

A Provider's business location

A Provider's business address and coordinates are a different matter entirely, because they are published. See Section 08.

06How We Use Information

To create and run your account and provide the app's features.
To take bookings, hold deposits, and connect Clients with Providers.
To connect a Provider's client record of you to your Slayd client account when you book them or accept their invite or card request; to send you a Provider's openings notices and their team's appointment requests; and to honour Remove me and the Provider's Not the right person (Section 09).
To measure how many of the people on Providers' client lists already have a Slayd client account, by counting how many client records hold a verified phone number or verified email address, without connecting anything or telling any Provider or client (Section 09).
To process payments and Provider payouts through Stripe and Apple.
To show you Providers near you and to power search and discovery.
To send booking confirmations, reminders and account notifications. Optional appointment texts have their own permission and delivery rules, described in Section 09; this does not mean every booking or reminder is sent by text.
To run referral and promo codes: to credit the person whose code was used, to decide by hand any payment we make to them, to spot one person being credited for their own sign-ups, and to apply promo codes.
To keep Slayd safe: rate-limiting, abuse prevention, reviewing reports, a keyword filter that runs over post captions, comments, messages, names, usernames, bios, reviews, and the business name and display name on a Provider's profile, whenever they are written or edited, and an automated image check (Google Cloud Vision SafeSearch) that runs over photos uploaded to posts and reveals, profile photos, business storefront photos, booking reference photos and message photos, and over the still frame uploaded with a video. Some of these checks act on content by themselves — see "Automated decisions" in Section 15.
To fix crashes and errors.
To meet legal, tax and accounting obligations.

We do not use your information to build advertising profiles, and we do not sell it.

Aggregated and de-identified data

We may produce aggregate statistics that describe the platform as a whole — how many bookings happened in a category, typical prices in a region — and use or publish them. Figures like those are not personal information: they do not identify you and cannot reasonably be linked back to you. Where we hold information in de-identified form we keep it that way: we do not attempt to re-identify it, and we require the same of anyone we give it to. None of this is a licence to sell your personal information, and we do not sell it.

07Who Receives What

The table below maps each category of information to why we handle it and who else sees it. "The public" means anyone on the internet, including people with no Slayd account.

Category	Purpose	Recipients
Account & profile	Run your account; sign-in; age gate; with your sign-in email address once it is verified, pick out a Provider's client record of you when you book them or accept their invite or card request, and count the client records that hold it (Section 09)	Google (Firebase Auth, Firestore). Your name, username, photo, bio and role: the public — see Section 08
Phone number	Verify sign-up; let a Provider reach you; limit duplicate accounts; tell you when a Provider invites you as a client; pick out a Provider's client record of you when you book them or accept their invite or card request, and count the client records that hold your number (Section 09); check referral codes for self-referral	Google (Firebase Auth sends the verification SMS; Firestore stores it). Your Provider and, for team bookings, the business they work for, for appointments you book
Provider & business details	Public storefront; booking; payouts	The public. Stripe, for payout onboarding
Posts, comments, reviews	Show your content in the app	Any signed-in Slayd user. Google (Firestore, Storage)
Direct messages	Deliver your messages	The other participant. Google (Firestore, Storage). A preview appears in the push notification — see Section 11
Bookings & purchases	Deliver the appointment; refunds; records	Your Provider and, for team bookings, the business they work for. Stripe. Twilio SendGrid, for confirmation email
Appointment texts & permission records	Send permitted appointment texts; apply replies to the correct time-change request; record your choice, delivery and opt-outs	Slayd and the authorized Provider or business for that appointment. Google (Firestore and Cloud Functions). Twilio Programmable Messaging and mobile carriers receive the phone numbers, text content and delivery information needed to carry the message; permission evidence may be provided to Twilio for compliance review. These records are not public or a list for other businesses' campaigns.
Payment information	Take payment; pay Providers	Stripe. Apple, for in-app subscription purchases. Google (Firestore, for amounts, status and the card details in Section 10). The Provider you paid, for the card's brand and last four digits, and for a card you keep on file with them
Referral & promo codes	Credit referrals; decide referral payments; detect self-referral; apply promo codes	Slayd staff. Google (Firestore). The code owner is told when an account joins with their code, and how many have, but not which accounts. Stripe, for a promo code used when subscribing by card on the website. The Provider, for their own promo code used on a booking with them
Device location (Client)	Sort Providers by distance; fill an address field	Apple (geocoding and address autocomplete). Not sent to Slayd
Contacts	Suggest people to invite	Nobody. Read on your device, not uploaded
Calendar	Put appointments in your calendar	Nobody. Written to your device
Device & push identifiers	Deliver notifications to the right device	Google (Firebase Cloud Messaging). Apple (APNs)
Device attestation	Confirm requests come from the real Slayd app or website	Apple (App Attest). Google (Firebase App Check, and reCAPTCHA Enterprise on slayd.ai — see Section 13)
Crash & error diagnostics	Find and fix defects	Google (Firebase Crashlytics)
Usage timestamps	Show whether an account is active; internal support	Google (Firestore). Slayd staff — see Section 17
Forms & signatures	Consent and intake records for your appointment	The Provider who sent the form. Google (Firestore, Storage)
Reports & support	Review safety reports; answer you	Slayd staff only. Google (Firestore)
Slayd AI conversations	Answer your questions about Slayd and your own account; open a support request when you ask for a person or Slayd AI cannot help	Anthropic, which runs the AI model behind Slayd AI — see "Our service providers" below. Slayd staff, for a support request it opens. Twilio SendGrid, which emails a support request to Slayd staff. Google (Firestore, Cloud Functions)
Waitlist & applications	Tell you when we launch near you; assess business applications; spot batches of fake sign-ups	Slayd staff. Google (Firestore). Discord, for business applications — see below
Business prospect records	Find and invite beauty and fitness businesses to Slayd; honour unsubscribes and bounces	Slayd staff only. Google (Firestore; Gmail, where replies arrive). Twilio SendGrid, which sent the emails and tells us when one bounced, was reported as spam or was unsubscribed from. Discord, where staff are alerted to replies and to applications that match the list
IP address	Rate limiting and abuse prevention; our servers' request logs	Google — Cloud Functions and Hosting receive it with every request. On slayd.ai your browser also sends it to Google (for fonts, the Firebase library and reCAPTCHA) and, on the main site and payment links, to Stripe — see Section 13. For rate limiting we keep only a hash — see Section 16. The waitlist and business application keep a shortened network prefix, and a card typed into the app keeps the IP address of the device used — see Sections 01 and 16
Social connections & activity	Build your feed and follower list; deliver in-app notifications; enforce blocks	Other Slayd users, where the action is visible to them — a follow, a like, a share or a comment carries your name. Your blocks and your saved collections are private to you; a record that you saved a post, which carries your account ID, can be read by other signed-in users. Google (Firestore)
Client records entered by a Provider	Provider's own book of business	That Provider and their team. Google (Firestore) — see Section 09
Provider business records	Back the Provider's book up so a lost or reinstalled phone does not destroy the salon's history; let Slayd support help the Provider	That Provider. Slayd support staff, for the appointment backup. Google (Firestore) — see Section 09
Client-list connections	Connect a Provider's client record to your account when you book them or accept their invite or card request; let that Provider's openings notices, and their business's team appointment requests, reach you; count the client records that hold a verified phone number or email address, to measure how many people on Providers' client lists have a Slayd client account; honour Remove me and the Provider's Not the right person	That Provider, once the record is connected: your account ID, and through it your public profile (Section 08), with how and when the connection was made and, where your phone number or email address picked out the record, which one, which tells them that the number or address on their record is the one verified on your account. Nothing else from your account, except a record created from your account when you accept their invite or card request (Section 09). For a team appointment request about you: the person who sends it and the team member asked, who see your account ID and username, even if that member does not have you on their own client list. Google (Firestore, Cloud Functions, Firebase Cloud Messaging) and Apple (push notifications) — see Section 09

Our service providers

Google — Firebase Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, App Check, Crashlytics, and Cloud Vision, which checks uploaded photos as described in Section 06. Google hosts essentially all of Slayd's data and sends the phone-verification SMS.
Stripe — card payments, Apple Pay, Provider payouts through Stripe Connect, and subscription billing on the card route. We give Stripe your name and email address when we create a customer record for you, and a Provider's email address when they onboard for payouts.
Apple — the App Store and in-app subscription purchases, push notification delivery, App Attest device checks, and the geocoding and address-autocomplete services described in Section 05.
Twilio Programmable Messaging — optional appointment texts, including permission confirmations and time-change requests and responses. Twilio and mobile carriers process the sending and receiving numbers, message content, message references and delivery information. This is separate from the phone-verification texts sent through Firebase and from the email service below.
Twilio SendGrid — transactional email such as booking confirmations and receipts, carrying your email address, name, the Provider and salon name, the service, the date and time, and any attached document. It also sent the September 2026 business invitation emails described in Section 01, with open and click tracking switched off, and tells us when one of them bounced, was reported as spam or was unsubscribed from.
Discord — when a business applies for early access or sends an Enterprise enquiry, a summary of the application is posted to a Discord channel our team uses to review applications: the business name, contact name, email address, city and state, team size, the booking system used today, how ready the business says it is, the services offered, the features asked for, the notes, the campaign link it arrived from, and whether the address was on our outreach list. The phone number, street address and ZIP code are not posted. When a business we emailed replies, the sender's name and email address, the subject line and a short excerpt are also posted there.
Anthropic — the AI model behind Slayd AI, the optional assistant in the app, which you use only after agreeing to it. When you ask Slayd AI something, Anthropic receives your message, the conversation so far, your name and which side of the app you are using, and, when your question needs them, details from your own account, appointments, payments and notification settings, such as your username, a service, a time, a price, a status or a fee. It does not receive phone numbers, email or street addresses, notes, photos, card details or account IDs from those records; anything else it sees is what you type yourself. Anthropic uses this to write the reply, does not use it to train its models, and keeps it only for a limited period under its own retention policy.

We also disclose information for legal reasons — to comply with law or to protect the rights, safety and security of Slayd and its users — and in connection with a merger, acquisition or sale of assets, subject to this Policy.

We do not use analytics, advertising or attribution services. See Section 12.

08What Is Public

Some of Slayd is deliberately open so people can find a Provider without signing up. Please read this section before you decide what to put on your profile.

Every profile is publicly readable. Your user ID, display name, username, profile photo, bio and account role can be retrieved by anyone on the internet who knows your username or user ID, with no Slayd account. This applies to Client accounts as well as Providers. Browsing the full member directory does require signing in.
Provider storefronts are public. Anyone on the internet who has a storefront's link or knows the Provider's username can read that storefront without an account, including business name, description, photos, services and prices, and the overall star rating and number of reviews. That includes services you limit to clients you choose: the app hides them from others, but anyone with your storefront link can read their details. Browsing or searching the full Provider directory, and reading the text of individual reviews, requires signing in — but any Slayd account can do it, so treat everything on your storefront as public.
Reviews carry your display name and are visible to anyone signed in. You cannot delete a review once you have left it; contact us if one needs to come down.
Posts and comments are visible to every signed-in Slayd account — not only to your followers.
The "private account" setting does not currently restrict who can read your posts. It changes how the app presents your profile, but the underlying data is readable as described above. We are stating this plainly rather than letting the label imply more than it does.
Photos and videos are served over long, unguessable links stored alongside the post. Anyone who obtains such a link may be able to open the file directly. Treat anything you upload as shareable.
Photo metadata. Still photos are rewritten before upload to remove embedded location and camera metadata, including any GPS tag. This applies to posts, profile photos, message photos, booking reference photos and business storefront photos alike. Videos are uploaded as-is, so any metadata already inside a video file you picked from your library is preserved — if a video was recorded at home with location tagging on, assume it still says so.

Providers: only your city and an approximate area are public. Your storefront shows your city and a map area of roughly one kilometre, used to sort Providers by distance. Your street address, exact map coordinates, a business's ZIP code, and your business phone and business email are kept private. A client sees your address, and your phone number if you allow calls, only once their booking is confirmed and any required payment has been settled. The owner and active members of a business you belong to can see that business's details. Until October 14, 2026, the exact street address, map coordinates, business phone, business email and a business's ZIP code were published on storefronts; they were removed from the public record on that date.

09Information Providers Enter About Other People

Providers keep a book of business in Slayd. That includes people who have never used Slayd — walk-ins, existing clients, and staff.

Client records. A Provider's client list is stored on our servers and includes each client's name, phone number, email address, visit count, no-show and cancellation counts, lifetime spend, last visit, whether they are blocked from booking, and free-text notes — including notes only that Provider can see. If the record has been connected to a Slayd client account, it also holds that account's ID and how and when it was connected (see "Connecting your account to a Provider's client list" below). Before-and-after photo galleries stay on the Provider's device and are not uploaded.
Imports and appointment backup. Providers can bulk-import a client list, and their appointment history, from another booking system. Imported appointments are copied to our servers with the client's name, the service, date, time, length and price, any notes, and any deposit the Provider records as already paid on the other system (and where it was paid); on the website this includes past appointments, marked as completed. Separately, the Provider app backs up every appointment in the Provider's own book — entered by hand or imported, past or upcoming — to our servers, with the client's name, phone number, email address and Slayd account ID, the service, date, time, length, price and status, the staff member, the Provider's notes, the client's visit count and reliability score (the share of their bookings they kept), and deposit, payment, discount, completion and cancellation details, so Slayd support can help that Provider. Appointments clients book through Slayd are stored with us as bookings in any case. These backup copies are deleted when the Provider deletes their account.
Client invites and claimed appointments. A Provider can invite you to be their client by typing your name and mobile number, and optionally an email address, and can attach appointments they recorded for you that have not been paid. We keep the name, any email address, the last four digits of the number, a coded form of the full number used to recognise it again, and the appointments attached. We check the number against our private phone record (Section 01); if it belongs to a Slayd client account, we may send that account a notification that the Provider wants to add them, unless either of them has blocked the other or the account chose Remove me for that Provider (see "Connecting your account to a Provider's client list" below). The Provider can share the link themselves. Where appointment texting is available and you have given the required permission, Slayd can send a link by text as described below. Nothing is added to the Provider's client list unless you accept. If you accept, the attached appointments move into your account — except any that has since been cancelled, declined, marked as a no-show, removed or linked to another account, or has a payment or deposit recorded or started on it — and, unless the Provider earlier chose Not the right person about your account and did not send this invite from one of their client records (see "Connecting your account to a Provider's client list" below), the Provider's client record of you is linked to your account: the record the invite was sent from is linked if it is still on their list and not linked to someone else; otherwise, unless a record of theirs is already linked to you, a record of theirs that holds your verified sign-in email address or your verified phone number, is still on their list and is not linked to someone else is linked, or, if there is none, a new one is created from your own account — your name (or, if your account has none, the name the Provider typed), your username and your verified phone number, with coded forms of that number and of your verified sign-in email address. You can then see what the Provider recorded on those appointments, including their notes, and the Provider is told you accepted, shown which account accepted, and told whether your verified phone number differs from the number they sent the invite to. Manually shared invite records are kept after an invite expires, is accepted or is declined, including when either account is deleted. Automated appointment-text invitations have separate expiry and account-deletion cleanup, described in Section 14.
Team records. Staff and contractor records include name, role, email, phone, home address, pay arrangement and permissions.
Business records. Invoices, receipts, expenses, refunds, retail inventory, payroll entries, booth-renter records, rent payments, open slots, daily deals, personal tasks and the labels you give your time off are backed up to our servers, so a lost or reinstalled phone does not destroy the salon's history. Two of these hold other people's details: payroll entries carry a staff member's name and pay, and booth-renter records carry a renter's name, an email address or phone number, and the rent they paid. Each of these collections is readable and writable only by the Provider whose book it is.
Forms. Intake, consent and policy forms are authored by the Provider. A Provider can create fields that ask for health information such as allergies, medical history or a date of birth. Answers, the typed signature name and the time of signing are stored, and are locked once signed.

For this information, the Provider decides what to collect and why, and Slayd handles it on the Provider's behalf to deliver Provider tools. The Provider is responsible for having the right to use it and for handling it lawfully. Connecting a Provider's record to a Slayd client account, and the counting described below, are different: Slayd decides how they work and is responsible for them.

If you are on a Provider's client list and want your details corrected or removed, ask that Provider first — they control the record. You may also email us and we will act on what we hold.

Connecting your account to a Provider's client list

A Provider's client record of you can be connected to your Slayd client account when you do one of two things:

You book them. Once a booking you made yourself through Slayd, signed in, is paid (or its deposit is), authorised on your card or covered by a package or pass, or straight away if it needs no payment, a record of theirs that holds your verified sign-in email address or your verified phone number, is still on their list and is not connected to anyone else is connected to your account, unless a record of theirs is already connected to you. A booking does not itself create a record, but the Provider's own app can add one from your bookings: opening you from an appointment adds a record of you to their list with the name and phone number on it, and editing your details or writing a note about you from their client list adds one with the name, phone number and email address from your bookings and your account ID.
You accept their invite or their request to keep a card on file (Section 10). For an invite, the record is chosen as described above. For a card request, unless a record of theirs is already connected to you, a record of theirs that holds your verified sign-in email address or your verified phone number, is still on their list and is not connected to anyone else is connected, or, if there is none, a new one is created from your own account in the same way as for an invite.

From August to early October 2026, an earlier version of Slayd also connected a record when it held the email address of a Slayd client account, and a few records are still connected that way. Nothing else connects a record. We do not send you a notice when a record is connected; the list described below shows every connection. While a Provider's Not the right person choice about your account stands (see below), a booking or a card request does not connect a record of theirs, and an invite does so only if the Provider sent it from one of their client records.

Counting. To measure how many of the people on Providers' client lists already have a Slayd client account, our servers count how many Providers' client records hold your verified phone number, if it is a +1 number (a US number, or a number from Canada or another place that shares that country code), or your verified sign-in email address, without connecting anything or telling any Provider or client: when you verify a number, when your account becomes a Client account, and once for each verified sign-in email address we find on your account (we look while you use Slayd). When a Provider adds, imports or restores a client record with a +1 or ten-digit phone number, or changes the number on one, we also check, using our private phone record (Section 01), whether that number is the verified number of a Slayd client account. We record only how many we found, in our servers' logs, not which records or accounts, and we keep a coded form of the email address on your account so that it is not counted again.

What a connection shares. The Provider's record of you then holds your Slayd account ID and how and when it was connected. Their app shows that you are on Slayd, with your current username and profile photo, and with your account ID they can read the rest of your public profile (Section 08). Where your phone number or email address picked out the record, the record also says which one, so a connection tells the Provider that the number or email address on their record is the one verified on your Slayd account. Like any Slayd account, they can also message you. Beyond that, and apart from a record created from your account when you accept their invite or card request (described above), a connection gives the Provider no email address or phone number they did not already have, none of your bookings with anyone else and nothing else from your account, and it copies no note, payment or photo in either direction. A connection also means:

Openings notices. When the Provider announces extra hours on a day, a notice goes to the Slayd inbox of up to 500 people, most recent first, who are connected to their client list or who have a booking with them through Slayd, other than a guest checkout, for a date in the last 12 months or still to come, whatever became of it, including one that was cancelled or declined and one the Provider recorded that moved into their account, leaving out deleted accounts and anyone who has blocked them or whom they have blocked. A push notification comes as well only if you have turned on Openings from your professionals in Settings, then Notifications (it is offered only while Bookings & cancellations is on, and has no effect while that is off), and at most three of those a week.
Team appointment requests. If you are connected to the client list of a business's owner, or of one of its team members, the owner, or a team member allowed to manage other people's appointments, can ask that team member (or, for the owner's list, any member of the team) to take you at a time. The person who sends the request and the team member asked can see your account ID and your username on it, even if that member does not have you on their own list, along with the service, the time and any note the sender adds; the request is kept after it ends, including after you delete your account. If the member accepts, you are asked to confirm, and nothing is booked or paid unless you book it yourself. A booking you made with that business, its owner or that member allows the same.
Deals for chosen clients. If the Provider offers a deal only to clients they pick from their list and picks the record connected to you, the deal applies to your bookings with them once their app has copied your account ID onto that record, which it does after the record is connected.

Appointments a Provider sends to your account. Once you have booked a Provider through Slayd yourself, or accepted their invite or card request, that Provider can put an appointment they recorded for you straight into your Slayd account, without asking you first. We tell you by notification and, if we have your email address, by email, and you can decline it with Not for me. After you decline one, while a Remove me or Not the right person note stands between you (see below), or if either of you has blocked the other, an appointment from them reaches you only as an invite you accept.

Seeing your connections. In the iPhone app, Settings, then Privacy, then Businesses that have you as a client lists the businesses whose client list is connected to your account, including one you have blocked or that has blocked you, with how and since when, and offers Remove me for each. You see which business it is, by its name or its Provider's name or username, but never the Provider's record of you, the name they typed, their notes or what they recorded about your visits. Remove me is not yet available on the website or in the Android app; if you use those, email support@slayd.ai and a member of our team will make the same choice for you.

Remove me ends the connection. We take your account ID, how and when it was connected, and any username of yours copied onto the record off every record of that Provider's that is connected to you, along with any older mark on their list, left by an earlier version of Slayd, suggesting that a record might be your account, and we keep a note of your choice. We do not message the Provider. While the note stands, that Provider's invites no longer reach your app, they cannot put an appointment straight into your account, and their texts about appointments in your Slayd account stop; a link they send you outside Slayd still works. Booking with them, or accepting their invite or card request, ends the note and can connect you again as described above. Remove me does not change your past or upcoming appointments, and it does not stop the openings notices you get because of a booking with them; blocking them does.

The Provider's Not the right person. A Provider who believes a connected record belongs to someone else can choose Not the right person on it. We take your account ID and how and when it was connected off that record; any username of yours copied onto the record can stay on it, because their app keeps the one it already had. We keep a note of that choice: the Provider, your account ID, that it was theirs and when. We do not message you. While the note stands, a booking you make with them, a card request of theirs you accept, or an invite of theirs you accept that they did not send from one of their client records does not connect any record of theirs to your account; the booking, card request or invite itself still goes ahead. They cannot put an appointment straight into your account, but their invites still reach your app. The note stays until you accept an invite the Provider sends from one of their client records, or until either account is deleted. You can also replace it with your own Remove me note for that Provider, but the business is listed under Businesses that have you as a client only while another record of theirs is still connected to you; otherwise email support@slayd.ai, as described above.

A connection also ends when the Provider removes or deletes the record, and a connection that an earlier version of Slayd made because a record held your email address ends when the Provider changes the email address on it; a connection made by a booking, an invite or a card request stays when the phone number or email address on the record changes. When a connection ends in one of these ways, we take your account ID, how and when it was connected, and any username of yours copied onto the record off it, except that a record the Provider has removed keeps any copy of your account ID or username it already held, so that their app still recognises you as someone they removed, until they delete that record or their account (Section 14). Deleting your account does the same on every Provider's record connected to it, except a record the Provider had removed, and deletes every Remove me and Not the right person note that names you (Section 14), though a Provider's app can still put your account ID and username back on a record, as described next.

Two things can still make a Provider's app show you as on Slayd after a connection ends. Bookings: a booking you made with a Provider through Slayd carries your account ID and stays in their history (Section 14), whatever happens to a connection, including after Remove me or Not the right person and after you delete your account, so their app can still show you as on Slayd and can put your account ID, and any username it showed for you, back on its record of you from those bookings. Older app versions: if the Provider's app is older than version 1.10 (376), it can put the username it last showed for you back on its record of you when a connection ends, and that username can stay there after they update.

Optional appointment texts

Where appointment texting is available, a Client can choose it in the iPhone app at the end of booking. The choice starts off, identifies the Provider or business and uses the Client's verified personal-account phone number. A Provider can also record that they already have a client's written permission, with an optional evidence note or reference. Entering a number, verifying it, booking or accepting an appointment link does not by itself give permission for appointment texts. Your choice is specific to the named sender and number, not every business on Slayd. You can book without agreeing to texts.

Slayd uses these records to send a permission confirmation, appointment confirmations and time-change requests and responses. It also checks that a reply applies to the correct appointment and current request. This program does not add a scheduled SMS reminder service. If texting is not set up for that sender, Slayd can save your choice without sending a text. Once texting is available, return to the choice, refresh it and save it on again to request the permission-confirmation text. Activating a sender does not automatically send texts for a pending choice. Appointment texts that rely on your in-app choice wait until the messaging provider confirms that the permission-confirmation text was delivered; accepting it for sending is not enough. The first appointment a Provider enters cannot trigger an automatic text unless the required permission already exists or the Provider records that they obtained it.

Turning appointment texts off in Slayd prevents appointment texts that rely on either permission route. Already-sent texts may still arrive. Reply STOP to stop texts from that sender, or HELP for assistance; you can also email support@slayd.ai. Turning the choice on in Slayd does not clear a STOP block. START can resume an existing documented permission record; it does not create initial permission or override a choice you turned off in Slayd.

We do not sell or rent mobile opt-in information or consent, share it with other businesses for their own messaging campaigns, or use your permission to enroll you in another business's messages. We disclose information to our messaging service providers only to operate and protect the program or meet compliance obligations, as described in Section 07. See Section 14 for retention and account deletion, and Section 15 for access to your records.

If you have never used Slayd

You may be reading this because a Provider added you to their book, imported you from another booking system, invited you as a client, or recorded you as a staff member or a booth renter; because you paid a Provider through Slayd without an account, or used guest checkout on slayd.ai before it closed; or because we researched or emailed your business. In that case we did not get your details from you, and you are entitled to know the same things anyone else is. The categories we hold about you are in Section 01; why we hold them and who else sees them is in Section 07; how long is in Section 14; your rights, and how to exercise them, are in Section 15. Where a Provider entered your details, the Provider decided what to collect and why; we hold it to run their tools. Email support@slayd.ai and we will tell you what we hold about you and, where the record is ours to change, act on it — or point you to the Provider where it is theirs.

09AConsumer Health Data

Slayd is a beauty and fitness product, and some of what passes through it is health information even though we never set out to collect any. Washington's My Health My Data Act and Nevada's SB 370 treat that kind of information specially, so it gets its own section and its own document.

There is a separate Consumer Health Data Privacy Policy. It says what health information reaches us, why, who sees it, how long we keep it, and how to have it deleted — and it is candid about the controls we have not built yet. Read it at slayd.ai/health-data.

In short, health information can reach Slayd three ways:

A Provider's intake or consent form. Providers write their own forms and we do not restrict the questions, so a form can ask about allergies, medical history, medication, pregnancy or a date of birth. Your answers go to that Provider.
The notes on a booking. In the iPhone app the notes box asks you for exactly this — the hint shown in the empty box suggests allergies — and what you write, in the app or on the website, goes to the Provider you booked.
A Provider's own notes about you, kept in their client record.

We do not sell health information, we do not use it for advertising, and we do not use it to infer anything about you for our own purposes. One thing you should know rather than discover: the Provider tools scan a client's notes for allergy and sensitivity wording and surface the matching sentences as a safety flag on that client's profile, so the Provider does not miss it. That happens inside the Provider's own book of business and is visible to them, not to other users.

If you would rather no health information reached us at all: leave the booking notes blank, and tell your Provider in person instead of on a form. If some has already been recorded, email support@slayd.ai and we will delete what is ours to delete and tell you what belongs to the Provider.

10Payments

Payments are processed by Stripe. Card details are entered into Stripe's own card form — in the app, on slayd.ai, or on a payment-link page — and go to Stripe. Slayd never receives or stores your full card number or security code. We receive and keep the amount, the status and identifiers that let us match a payment to a booking. For a card payment to a Provider we also keep what Stripe tells us about the card that paid: its brand, its last four digits, whether it is credit, debit or prepaid, and whether it was paid through Apple Pay or Google Pay. These details appear on the receipt and on the appointment, so the Provider you paid can see the card's brand and last four digits. A card kept on file with a Provider, or typed in by one, keeps more, as described below. Your payment information is also handled under Stripe's own privacy policy.

Provider subscriptions purchased on iPhone are billed by Apple. We store the subscription identifiers and status Apple sends us so we know your subscription is active.

A card kept on file with a Provider

You can agree to keep a card on file with a Provider so they can charge it later for services you receive — when you book, when a Provider asks you to, or from your own payment settings, and sometimes in person on the Provider's device. If you agree through a Provider's request, their client record of you is also connected to your account, or created from it (Section 09). If you agree, we store the card's brand, last four digits, expiry and funding type, and the Provider can see these details. We also keep a record of your consent: the exact wording you agreed to, when you agreed, how (on your own phone or in person) and which card it covers. We notify you whenever a card is kept on file for a Provider, however it was added. You can remove it at any time in the Slayd iPhone app (Settings > Payment Methods), or ask the Provider or Slayd support to remove it. Deleting your Slayd account deletes your saved cards at Stripe, so they can no longer be charged. The consent record is kept after the card is removed and after your account is deleted, because it is the proof that earlier charges were authorised.

Paying a Provider without a Slayd account

A small number of Providers can currently take a card payment, for an appointment they have recorded, from a client who has no Slayd account, in two ways:

Payment link. The Provider sends you a link to a payment page on slayd.ai — by text from their own phone, or by sharing or copying it. The page shows the business name, the amount and how it is made up, and you pay in Stripe's payment form, by card or, where your device offers it, Apple Pay or Google Pay. If you type an email address for a receipt, it goes to Stripe, which sends the receipt; we do not store it. We keep the amounts, the service and business name, the payment status, when the link was sent, when it expires, how many times it was opened and how many attempts were declined. If a card is declined, we keep Stripe's fingerprint for it (a code that lets us recognise the same card again without knowing its number) in that business's fraud record. A link stops working seven days after it was last sent, and never later than 30 days after it was first created or 30 days after the appointment. It also closes after repeated declines.
Card typed in by the Provider. The Provider, or someone on their team, types your card into Stripe's card form in the Slayd app; the number goes to Stripe, not to us. Before the card is charged, our servers read its brand, last four digits, funding type, issuing country and Stripe's fingerprint for the card from Stripe, and use them to refuse the Provider's own card, prepaid, wallet and foreign cards, and a card being used across several businesses. We keep those details, the results of Stripe's security-code, ZIP-code and fraud checks for a payment that goes through, the amounts and outcome, including any decline reason, the Provider's account and the account of whoever on their team typed the card in, the IP address of the device used, and the app version, as a fraud and audit record. We also keep a daily count of the cards each business has typed in, and a short list of the businesses each card has been used with this way. This is the one place our database keeps an IP address in readable form next to an account (for an IPv6 address, the first half of it); our servers' request logs also record the IP address of every request, for 30 days — see Section 16.

After repeated declined cards, either way of paying can be switched off for that business for a time.

Providers

Payouts run through Stripe Connect. Stripe collects your identity and bank details directly in its own hosted flow — we never see or store your bank credentials. We do store the last four digits of the account a payout landed in, so you can recognise it in your records.
Tax identifiers stay on your device. An EIN or SSN, legal business name and filing address entered in the Tax Center are stored in the iOS Keychain on that iPhone and are never transmitted to Slayd's servers. If you delete the app or lose the device, they are gone.

11Notifications and Device Identifiers

To deliver push notifications we store, against your account, a notification token, the platform it belongs to (iPhone, Android or a web browser) and an identifier for the device. On iPhone that identifier is the vendor identifier assigned by iOS, which is shared only with other apps from the same developer and resets when you delete all of our apps. In a web browser or the Android app it is a random identifier we create and keep in that browser's storage. A browser or the Android app registers a token only once notifications are allowed for Slayd there: when you tap to turn them on and allow them, or when you later sign in where they are already allowed (on the website, with Remember me selected), unless your account turned them off on that device.

Two things worth knowing:

On iPhone, a notification token is registered when the app launches, whether or not you allowed notification alerts. If you declined alerts you will not receive any, but the token still exists.
Notification text contains real content. A message notification carries the sender's name and roughly the first 100 to 120 characters of the message; a comment notification carries the commenter's name and a preview of the comment; booking notifications carry appointment details. That text passes through Google and Apple to reach your lock screen.

You can turn notifications off in your device Settings at any time, or, on the website and in the Android app, with Turn off on this device in Slayd's settings.

12Analytics, Tracking and Diagnostics

We do not track you across other companies' apps or websites. The app contains no advertising identifier, no App Tracking Transparency prompt, and no analytics, advertising or attribution SDK. We do not build advertising profiles and we run no third-party advertising or analytics trackers on slayd.ai. Some pages of slayd.ai do load a Google security check, reCAPTCHA Enterprise, and Stripe's payment library, both of which collect browser and device signals to detect fraud and abuse — see Section 13.

That is about tracking, not about record-keeping. The things you do in Slayd — the accounts you follow, the posts you like, share or save, the appointments you book — are recorded on your account, because they are the product; they are listed in Section 01 and mapped in Section 07. Beyond those account and activity records, the only diagnostic data we collect is:

Two usage timestamps on your account — when you were last active and when you last booked. We do not log screen views, taps or a browsing history.
Crash and error diagnostics through Firebase Crashlytics (Google). This records crashes, and certain handled failures — such as a payment or payout-setup step that errored, a payout-setup screen that was slow to load, or a report that could not be sent — together with the device model, the iOS and app versions, and a random identifier for that installation of the app. While you are signed in to the app, these reports carry your Slayd account ID, so we can tell which account a problem affected and find the reports behind a problem you tell us about. A handled failure is recorded with the error message the app received; when that message comes from Stripe, it can include Stripe's own reference numbers or other details Stripe chose to put in it, such as an email address. Other notes attached to a report refer to records by their ID, such as a booking or post ID; we do not otherwise deliberately put names, contact details or other personal information in them.
Server logs. Our servers' request logs record the IP address of every request and are kept for 30 days (Section 16). The logs for the sign-up, waitlist and contact endpoints deliberately record only the domain of an email address, never the address itself.

13Cookies and the Website

slayd.ai does not use advertising or analytics cookies, and does not run a consent banner because there is nothing to consent to on that front. Several things do happen when a page loads, before you interact with anything, and you should know about them:

Most pages load fonts from Google. The main site, shared post and booking links, client-invite links, payment links and the page that opens the links in our account emails also load the Firebase software library from Google. Google therefore receives your IP address and browser user-agent.
The main site and payment links load Stripe's payment library on every visit, including visits where you never pay. Stripe receives a request from your browser and uses it for fraud prevention.
The main site, shared post and booking links, client-invite links, payment links and the page that opens the links in our account emails (such as a password reset) also load Google reCAPTCHA Enterprise, which lets our servers check that requests come from the real site and not from a script. It runs in the background, without a checkbox or puzzle. Google receives your IP address, browser and device details and signals about how the page is used, and reCAPTCHA may store its own identifiers in your browser. Google's Privacy Policy and Terms of Service apply to it. The legal and help pages do not load it.

Signing in, or creating an account, keeps your session in your browser's storage so you stay signed in; when you sign in, you can untick Remember me to keep it only until you close the tab. Pages that load Stripe's payment library also get two Stripe fraud-prevention cookies (__stripe_mid and __stripe_sid), and pages that load the Firebase library keep a security token and a record of the days the site was used in your browser's storage. Slayd itself sets no cookies. Other things are kept in your browser's own storage when you use the feature concerned, including:

If you open someone's invite link, the invite code is kept in local storage for up to 30 days, so that if you create an account it can be recorded that they referred you.
If you open a client-invite link and then sign in or sign up, the link is remembered in local storage so you are brought back to it; it is ignored after two hours.
If you turn on notifications, a random identifier for this browser, and which Slayd account turned notifications on or off, are kept in local storage so the notification token can be removed when you turn notifications off or sign out.
If you set up a business on the website, your setup details (business name, contact details, address, photo, services, classes and hours) are kept in local storage on that browser until you sign out, even after you publish, so a reload does not lose them.
A payment-link page keeps the payment it is completing in session storage so it survives a bank verification redirect; closing the tab clears it.
If you start a booking before signing in and then sign in or create an account, the business, service, day and time you chose and any notes are kept in that tab's session storage, and used only if you sign in within 30 minutes; they are removed once used or when you close the tab. If you open Forgot password, the email address in that form is kept in that tab's session storage until you go back to sign in or close the tab.

Simply browsing slayd.ai does not create a Slayd account or assign you a Slayd account identifier.

14Data Retention and Deletion

We keep your information while your account is active and as needed to run the service, comply with legal and tax obligations, resolve disputes and enforce our agreements.

How long we keep each category

Where a period is not fixed, the criterion we apply is stated instead. Some of these say "indefinitely" — that is the truth about the system today, not an aspiration, and where we intend to change it we say so.

Category	How long
Account & profile, phone number, Provider & business details	While your account exists, and removed when you delete it, except for the following. A deletion record, kept indefinitely: your account ID, when it was deleted, and the IDs of any Stripe payout accounts you had and of any businesses removed with it, so later processes can tell a deleted account from a missing one; and, if a business you owned collected payment for its team, the affected team members' account IDs and appointment IDs and whether each client's prepayment was returned. It holds no name, email address or phone number. Your phone number, if you verified one: the private phone record described in Section 01 keeps the number indefinitely. It stays linked to your deleted account ID until that number is next entered at sign-up, verified by text or used to add a second account, and after that it stays with no account attached or with the new account. A separate record of each one-time phone verification keeps the full number with your account ID, indefinitely. A copy of any business you owned, kept indefinitely in an internal archive only Slayd staff can read: its name, address, map coordinates, hours and other storefront details, its team roster and each member's terms, the staff records kept under it, and its service menu. The archive does not include your client list, invoices, receipts, expenses, payroll entries, booth-renter records, payouts or forms. A business other people still work at is not removed when its owner deletes their account. It stays on Slayd, frozen and marked as having no owner; you are taken off its public team list, but its record still names your deleted account ID as its owner. Its name, address and posted opening hours stay visible — or, if it never posted any, hours taken from the remaining team's schedules — and its name and address stay reserved. Most of it is public — see Section 08. Once nobody with a Slayd account works there, it is removed automatically; the archived copy and its name and address reservations, which carry your account ID, are kept.
Posts, comments, reviews, and their photos and videos	Until you delete them, or until you delete your account. A copy of each review stays with the appointment it was about, and a deleted photo or video leaves an earlier copy in our file storage until we remove it — see "Backups" below.
Social connections & activity	Until you undo the action (unfollow, unlike, unsave) or delete your account, except that a record that you saved or shared someone else's post stays with that post. Notifications you caused in other people's inboxes are removed with your account.
Direct messages	Indefinitely. Messages cannot be deleted by either party and survive account deletion — see below.
Appointment texts	Contact records become eligible for automatic removal 90 days after the appointment; delivery and incoming-message records become eligible 90 days after their message record is created. Removal runs in bounded batches, so it may not happen at the exact expiry time. Automated text-invitation records and their private matching records also have expiry and deletion cleanup. Permission records, whose grants currently last up to one year, and minimal coded opt-out and reply-reference records can remain longer to honor your choices and prevent an old reply changing a newer appointment. Account deletion removes the relevant contact details, message bodies, delivery records and permission details that belong to you after current ownership checks. Minimal coded opt-out and retired reply-reference records can remain without the full phone number or message body. Deleting these text records does not delete another party's appointment history. Twilio and mobile carriers apply their own retention obligations to information they processed.
Bookings & purchases	Indefinitely. An appointment has two sides; deleting your account does not remove it from the other party's history.
Payment, payout and subscription records	For as long as tax, accounting, audit and chargeback-defence obligations require, which is several years and longer than your account.
Forms & signatures	While the Provider's record of you exists. A form is locked once signed, and your signed forms are deleted when you delete your account.
Slayd AI conversations	Each message is deleted automatically 90 days after it was sent, and all of them are deleted when you delete your account. The record that you agreed to Slayd AI's terms is kept until you delete your account. A support request Slayd AI opened is kept with our other support messages. Anthropic keeps its own copy only for the limited period its retention policy sets.
Provider business records and client records	While the Provider's account exists. They belong to that Provider's book of business, so deleting your account does not remove their record of you.
Client-list connections	A connection stays on the Provider's record until you choose Remove me, the Provider chooses Not the right person or removes or deletes the record, the Provider changes the email address on a record that an earlier version of Slayd connected by email, or your account or theirs is deleted. A Remove me note is kept until you book with that Provider or accept their invite or card request, or until either account is deleted. A Not the right person note is kept until you accept an invite that Provider sends from one of their client records, until your own Remove me note for that Provider replaces it, or until either account is deleted. A record the Provider has removed keeps any copy of your account ID or username it already held until the Provider deletes that record or their account, including after you delete your account. An older mark naming your account on a Provider's client record, left by an earlier version of Slayd, is removed when you choose Remove me for that Provider, or when a connection of that record to your account is ended by Not the right person, a changed email address or the deletion of your account; otherwise it stays until the Provider deletes that record or their account, including after you delete your account. The coded email address on your account is kept while your account exists. A Provider's app can also put your account ID and username back on its record of you after a connection ends (Section 09).
Guest checkouts that were never paid	Indefinitely, today. The record was written when you filled in the form, not when you paid, and nothing currently deletes an abandoned one; it is only marked expired or cancelled. If you started a guest checkout and walked away, email us and we will delete it. We intend to put an automatic limit on this.
Crash & error diagnostics	Held by Firebase Crashlytics under Google's own retention schedule, which we do not control. Reports made while you were signed in to the app carry your Slayd account ID.
IP address	Two hours, as a hash — see Section 16. Our servers' request logs: 30 days. The network part of your IP address and the country stored with a waitlist entry or business application are kept as long as that entry. The IP address kept with a card typed into the app stays with that payment's fraud and audit record, which nothing deletes today.
Device & push identifiers	While your account exists, or until the token is replaced.
Reports & support correspondence	Kept after your account is deleted, so a pattern of abuse cannot be erased by deleting an account.
Waitlist & business applications	Until we launch in your area and tell you, or until you ask us to remove you.
Referral & promo codes	Indefinitely, today. Nothing currently removes these records when either account is deleted — including your own referral code, the record of whose code you joined with and what we noted about it, any referral payment we recorded, and the promo codes you redeemed. A referral payment we made also stays in our accounting records. If you want yours removed, email us and we will review it.
Business prospect records	Indefinitely, today. Nothing deletes them automatically. Email us and we will delete your business's record, keeping only the email address, marked do-not-contact, so it is never sent outreach email again. An address that unsubscribed or reported our email as spam keeps its full record, permanently marked so that it is never emailed again; an address whose email bounced keeps its full record and is taken off the sending list.

Deleting your account

You can delete your account yourself — in the app under Settings, or on the website from your account page. Deletion runs on our servers shortly afterwards and removes:

your posts and their photos and videos, likes, comments and shares;
every comment and like you left anywhere;
notifications you caused in other people's inboxes;
your follows, in both directions;
the reviews you wrote, as shown on Providers' pages;
your username and business name reservations, except the name of a business other people still work at;
your signed forms;
your account ID on any Provider's client record connected to you, with how and when it was connected and any username of yours copied onto it, except on a record the Provider had removed, and any Remove me or Not the right person note that names you (a Provider's app can still put your account ID and username back on its record of you, as Section 09 explains);
your public profile and your uploaded files;
and, if you are a Provider, your storefront together with your client list, invoices, receipts, expenses and payroll records. A business other people still work at is not removed — see the table above.

Deleting also cancels the Slayd subscriptions and team seats you pay for by card. It does not cancel a subscription bought on iPhone, which Apple bills; cancel that in your iPhone's Settings first, or Apple will keep charging you. If a Provider deletes their account, we automatically refund clients for unused prepaid package credits and notify them.

What deletion does not remove

We would rather tell you this than let you discover it:

Appointment records. Bookings you were part of stay in the other party's history, including the names, the service, the price and the time. An appointment involves two people and neither can erase it from the other's records.
Reviews, on the appointment. A copy of each review you wrote is kept with the appointment it was about, with your account ID, and any signed-in user can still read it.
Direct messages. Conversations and the messages inside them are retained, including messages and photos you sent. Messages cannot be deleted, by you or by the recipient.
Payment and transaction records, which we keep for accounting, tax and dispute-resolution purposes.
Safety reports you filed, including your account ID and what you wrote.
Moderation records. Entries in our moderation review queue about your content are kept, including after a moderator rules. A flagged photo held for review is put back if a moderator approves it and deleted if they take it down; if you deleted the post before anyone ruled, the held photo stays until we remove it.
A Provider's own record of you. If a Provider added you to their client list, that record — name, phone, email and their notes — belongs to their book of business and is not removed when you delete your Slayd account. Ask the Provider directly. We do take your account ID, and how and when it was connected, off a record that is connected to you, unless the Provider had removed that record, though their app can put your account ID and username back from bookings you made with them (Section 09).
Packages and passes you sold, if you are a Provider, because they are the buyer's proof of purchase.
Referral and promo-code records. Whose referral code you joined with and what we noted about it — the account type you joined as, whether you used the app or the website, whether your phone number was verified and whether it matched the referrer's, and later activity such as your first booking or payment — who joined with your code, any referral payment we recorded, any attempt to use a code that was turned down, and the promo codes you redeemed.
A card you kept on file with a Provider. The record of your consent — the exact wording you agreed to, when, and the card's brand, last four digits and expiry — is kept as proof of what you agreed to, and so is the Provider's record of the card's brand, last four digits and expiry. The card itself is removed from Stripe when your account is deleted, so it can no longer be charged. If you remove the card in the app first, the Provider's record of it goes; the consent record does not.
Client invite links. If a Provider sent you a link to add you as their client or to hand you an appointment, we keep the record of that link: the name they typed, the last four digits of your phone number and a coded form of the full number, any email they entered, the appointments attached, and whether you accepted or declined it.
Comments taken down after reports, whether automatically or by our team. We keep a full copy of each in an internal archive in case the removal was a mistake, and that copy is not removed when you delete your account.
Saves and shares of other people's posts. A record that you saved or shared someone's post stays with that post.
A business you owned. We keep an internal archived copy of it — its business details, team roster and service menu, but none of your own book of business, such as your client list, invoices, receipts or payouts — so the business can be restored and its team's records are not lost. If other people still work there, the business itself and its name also stay on Slayd, without an owner, and you are taken off its team. The retention table above has the detail.

Deletion runs step by step and a step can fail. If you need confirmation that a specific piece of information is gone, email us and we will check rather than assume.

Backups. So that our database can be recovered after a failure, we can roll it back to any moment in the last seven days, and we also take backups: daily ones kept for seven days and weekly ones kept for fourteen weeks. A backup cannot be edited, so information that is deleted — whether you delete it or it expires on one of the schedules above — stays in any backup taken before the deletion until that backup expires, at most fourteen weeks later. Photos, videos and other files you upload are stored separately. When one is deleted, an earlier copy of it stays in our file storage, where only Slayd can reach it, and today nothing removes those copies automatically; email us and we will remove yours.

If you delete a single post, that post's photos and videos, comments and likes are removed too.

Guest bookings that were started but never paid for are currently retained. If you began a guest checkout and abandoned it and want those details removed, email us.

15Your Rights & Choices

Access & update — view and edit your profile in the app or on the website.
Delete your account — in the app under Settings, or on the website from your account page. See Section 14 for exactly what that removes.
Businesses that have you as a client — in the iPhone app, go to Settings, then Privacy, then Businesses that have you as a client to see the businesses whose client list is connected to your account, how and since when, and to choose Remove me for any of them. On the website and in the Android app, email support@slayd.ai and a member of our team will do it for you. See Section 09.
Openings notices — a push notification about a Provider's extra opening hours comes only if you turn on Openings from your professionals in Settings, then Notifications, with Bookings & cancellations on. Blocking a Provider also stops their openings notices in your inbox. See Section 09.
Get a copy of your data — in the iPhone app, go to Settings, then Download My Data. The app builds one file of records we hold about you — among them your account, profile and settings, who you follow, who follows you and who you have blocked, your posts, comments and reviews, your appointments, payments and consent forms, your notifications, your referral code and whose code you joined with, and the messages you sent — which you can save or share from your phone. It includes limited appointment-text and permission metadata associated with you, such as status, references and recorded times; it does not include other clients' contact details, message bodies, evidence notes or provider credentials. Large sets can be capped and the file identifies when this part is incomplete; email us if you need more. It does not yet include the posts you liked, shared or saved, referral payments or refused codes, promo codes you redeemed, or our private phone-number and phone-verification records; email us for those. It does not include your connections to Providers' client lists or your Remove me choices either; the iPhone app lists the connections under Settings, then Privacy, then Businesses that have you as a client. If the file is large, the app collects it from us over a private link that stops working within two hours, and we delete the file within a day; like any deleted file, an earlier copy stays in our file storage until we remove it (Section 14). Some things are left out because they are other people's information — the words of messages sent to you, a Provider's client records and business books, and the contact details of clients on appointments you took as a Provider — and the file lists what was left out and why. Records a Provider keeps about you as their client are not included; email us for them. On the website or in the Android app, or if your Slayd Pro subscription has ended or you need something the file does not cover, email support@slayd.ai from the address on your account and we will assemble it for you.
Permissions — control camera, microphone, photos, location, contacts, calendar, Face ID and notifications in your device Settings.
Marketing — every marketing email has an unsubscribe link. Booking confirmations and receipts are transactional and are not marketing.

If you are in the EU, UK or Switzerland

You have the right to access, correct, delete, restrict or object to our processing of your personal data, to data portability, and to complain to your local supervisory authority. Where we rely on consent — device location, contacts, calendar and notifications — you can withdraw it in your device Settings at any time, without affecting processing already carried out.

We rely on these legal bases: performance of a contract for your account, bookings and payments, including connecting a Provider's client record of you to your account when you book them or accept their invite or card request; consent for the device permissions above and for openings push notifications, which come only if you turn them on; legitimate interests for security, abuse prevention and fixing defects, for putting a Provider's openings notices in the Slayd inbox of people who have booked them or are connected to their client list and passing their team's appointment requests to those people, and for counting how many Providers' client records hold a verified phone number or email address, which tells us how many people on those lists already have a Slayd client account (Section 09); and legal obligation for tax and accounting records.

Health information. Where a Provider's intake form, or the notes you write for an appointment, contain information about your health, we handle it on the basis of your explicit consent, given when you choose to write it or to sign that form. You can decline: leave the notes blank, and tell your Provider in person rather than on a form. Section 09A and the Consumer Health Data Privacy Policy explain this in full.

Whether you have to give us this. The account and booking details we ask for are needed to enter into and perform our agreement with you — without them we cannot create an account or take a booking. Everything else, including device permissions, your bio, your social handles and the notes on a booking, is optional; declining costs you the related feature and nothing more.

Automated decisions. We do not build advertising profiles, and no account is banned, suspended or closed by automated means alone — that takes a person on our team. Some processing is automatic: the app orders your For You feed on your phone — newest days first, and within each day by what you like, follow and book, the interests you chose and how many likes a post has; reports count for more when they come from longer-standing accounts; and, to stop stolen cards being tested, card payments from an account are paused automatically for 24 hours after several of its cards, or repeated attempts, are declined within a day (7 days if its cards are declined as lost, stolen or fraudulent), and a business can stop taking card payments from new clients for 24 hours when cards from many different accounts are declined there. Some safety rules also act on content by themselves, before anyone at Slayd looks at it:

A comment containing a banned word is deleted.
A message containing a banned word has its text replaced with "[removed for community guidelines]"; the original text may still show in the inbox preview and in in-app alerts until the next message is sent.
A name, username or bio, or the business name or display name on a Provider's profile, that trips the keyword filter is cleared or replaced with a neutral one, as is a username that uses a reserved word or is too short.
A review that trips the keyword filter is taken down.
A post whose caption trips the keyword filter is hidden.
A photo the image check scores as likely nudity or violence is moved out of reach and taken off what it was attached to — a post, a profile, a booking or a message — and if it belongs to a post, the post is hidden. In a direct message, a photo scored as likely suggestive is treated the same way.
A post photo scored as very likely suggestive has its post hidden.
A post or reveal reported by enough different people is hidden. A comment reported by enough different people is removed.

Flagged photos, and posts hidden by the image check, the caption filter or reports, go to a person for review, who can restore them. If you think something of yours was removed by mistake, email support@slayd.ai. Rate limits turn away requests that arrive too fast, for up to an hour or a day, depending on the action, and the allergy-wording flag described in Section 09A only shows a Provider the matching sentences. The card checks on payments made without a Slayd account are described in Section 10.

Where your information goes. Our infrastructure providers (Google, Stripe, Apple, Twilio Programmable Messaging and Twilio SendGrid) are based in the United States, and your information is processed there. For transfers out of the EEA, the UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where the UK GDPR applies), which are part of our agreements with each of those providers.

If you are in California or another US state with a privacy law

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so. You may request access to, correction of, or deletion of your personal information, and you may ask what we have disclosed and to whom. We will not discriminate against you for exercising any of these rights.

The categories we collect, our purposes and the recipients are set out in Sections 01 and 07. Where we get each category is set out under "Where we get your information" in Section 01 — note that we receive information about you from Providers, from our payment providers and, for businesses, from public listings, not only from you. How long we keep each category is set out in Section 14.

Sensitive personal information. Some of what we collect is treated as sensitive under California and other state laws — your date of birth, your precise device location, and any health information a Provider's form or your booking notes contain. We use and disclose these only for the purposes state law permits without a right to limit: performing the service you asked for, security and abuse prevention, and keeping our systems working. We do not use them to infer characteristics about you, we do not sell or share them, and we do not use them for advertising. Because we do not use sensitive personal information for any other purpose, we do not offer a "Limit the Use of My Sensitive Personal Information" control — there is nothing for it to switch off. If that ever changes, this Policy changes with it and we will publish the control.

Washington and Nevada residents: consumer health data is covered separately — see Section 09A and the Consumer Health Data Privacy Policy.

How to make a request

Email support@slayd.ai from the address on your account. We may need to confirm it is you before we act. You may use an authorised agent. Note that where a Provider entered information about you, the Provider controls that record and we will direct you to them.

16Abuse Prevention

To stop automated sign-ups, spam bookings and form abuse, we count requests against the sender. Your IP address is read for this purpose and is not stored in readable form — we store a cryptographic hash of it together with a count and a timestamp, and the record expires after two hours. That record is used only for abuse prevention and is not linked to your account. Separately, the request logs of our servers record the IP address of every request; Google keeps them for 30 days.

We describe that hash as pseudonymised rather than anonymous, and we would rather be precise than flattering: a hash of something drawn from a small, known set of possible values is not beyond reversing, so we treat these records as personal data and protect them accordingly. Your IP address also reaches Google with every request you make to our servers, and reaches Google, and on some pages Stripe, when you load slayd.ai — see Sections 07 and 13.

Two exceptions. The waitlist and business application forms store the network part of your IP address (not the full address) and your country with your entry, so we can spot batches of fake sign-ups; they are kept as long as the entry is. When a Provider, or someone on their team, types a client's card into the Slayd app, the IP address of that device (for an IPv6 address, the first half of it) is stored in readable form, linked to their account, with that payment's fraud and audit record; nothing deletes these records today — see Sections 10 and 14.

The iOS app also uses Apple's App Attest so our servers can confirm a request came from a genuine, unmodified copy of the Slayd app. This produces a device attestation seen by Apple and Google; it does not identify you.

17Security and Internal Access

We use reasonable technical and organisational measures to protect your information: data is held in Google Cloud with per-record access rules, payment credentials never touch our systems, and secrets are held in a managed secret store. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Inside Slayd, an administrator console can look up an account and see the name, username, email address, phone number, date of birth, role, bio, city, ZIP, social handles, whether the account is banned or restricted, whether the email is verified, and the last sign-in, activity and booking times. This is used for support and safety work. Administrators can also ban, restrict or delete an account. Administrator access requires a separate privileged credential.

When a Provider moves your booking to a time they confirm you agreed with them outside Slayd, we keep a record of the move: the date and time before and after it, when it was made, the account that made it and whether that was the Provider, the business owner or front desk staff, whether it was made in the app or on the website, the booking's status and payment status at that moment, and the Provider's confirmation that you agreed. This record is kept by Slayd's servers, is not shown in the apps, and is used by Slayd support to resolve disputes. Our servers also use it to measure the cancellation notice, any late-cancellation fee, any no-show fee and any automatic refund from the later of the two start times, as Section 08 of the Terms of Service explains.

If you report content or a person, the report is anonymous to the person you reported — they are not told who reported them. It is not anonymous to us: your account ID is stored with the report so we can follow up and detect abuse of the reporting system.

18Children's Privacy

Slayd is not intended for anyone under 17. We ask for your date of birth when you sign up and we do not create accounts for people who tell us they are under 17. We do not knowingly collect information from children under 17. If you believe a child has provided us information, email support@slayd.ai and we will remove it.

19Changes to This Policy

We may update this Policy from time to time. We will revise the "Last updated" date and, where the change is significant, notify you in-app or by email. Continued use after changes take effect means you accept the updated Policy.

20Contact

Questions about your privacy, or a request under Section 15? Email support@slayd.ai.

The controller of the personal data described in this Policy is Slayd LLC, at 27101 N Dixboro Rd, South Lyon, MI 48178.