Privacy policy.

This explains what we hold about you, what we hold about your clients, and the difference between the two — because they are not the same, and the distinction is the whole point.

01 Two kinds of information, two different roles

Read this section first. Everything else follows from it.

Our own database holds no client records. There is no contacts table in it, no appointments table, no conversations or messages table. Your clients’ names, phone numbers, bookings and message history live in the GoHighLevel account provisioned for you when you subscribed, not in ours.

What our system does hold is your account, your subscription, and a link saying which GoHighLevel account is yours. It reads figures from that account to draw your dashboard, and it does not copy them back.

That is a design decision, not a description of the current state. Our own automated tests fail if a table for client data is ever added, precisely so this page cannot quietly stop being true.

02 What we collect about you

When you sign up and set up your account:

• Your name and email address.
• Your phone number and business name.
• Your time zone, captured from your browser so that appointment times are right.
• The date and time you accepted our terms, and separately, whether you opted in to marketing email. The two are recorded separately on purpose: agreeing to terms is not agreeing to marketing.
• Which page, campaign or referring site brought you to us.
• The business details you enter on the setup form — your booking link, your deposit amount, your social handles, your cancellation policy link, your monthly goals. These are passed into your GoHighLevel account so your automations can use them.

When you sign in: a password verifier (never the password itself), a session identifier, and the time of your last sign-in.

When you use the service: a record of significant actions, with the IP address they came from, kept so that we can investigate an account problem or a security incident.

When you pay: the plan you chose, its status, its renewal date, and identifiers issued by our payment processor. We never see or store your card number. It goes directly to the processor.

When you write to us: whatever you put in the email.

03 What we do not collect

• Card numbers, security codes or bank details.
• Your clients’ contact records, appointments or conversations — see section 01.
• Advertising or tracking cookies. Our website sets no analytics or advertising trackers, and there is nothing here for a third party to follow you with.
• Anything from anyone under 18. The service is sold to businesses; if we learn we hold a child’s information, we delete it.

04 Why we hold it

• To run the service. Create your account, provision your GoHighLevel location, sign you in, show your dashboard.
• To bill you and to keep the records a payment processor and a tax authority expect.
• To support you. Answer your questions, diagnose a fault.
• To keep the platform secure — detect misuse, investigate a suspicious sign-in.
• To improve the product, by looking at which features are used and where people get stuck.
• To send you marketing, but only if you ticked the box, and only until you tell us to stop.

We do not use your information for anything else without asking you first.

05 Who else touches it

We do not sell your personal information, and we do not share it for advertising. We do rely on a small number of companies to run the service. Each is named here, each is bound by contract, and each sees only what it needs.

If you connect your own Instagram or Facebook page to the system, Meta receives what is needed to make that connection work. That is your choice to make, and you can disconnect it.

We may also disclose information where the law requires it, to enforce our terms, or to a buyer if the business is sold — in which case this policy continues to apply until you are told otherwise.

06 Where it is held, and for how long

Our systems are hosted in the United States. If you use the service from outside the United States, your information is transferred there.

• Your account and business details: for as long as your account is open.
• Billing records: up to seven years after your last payment, because tax and accounting rules require it.
• Sign-in sessions: until they expire or you sign out.
• Activity records: up to twelve months.
• Notifications from GoHighLevel: we log that one arrived, but we discard its contents once it has been handled. A message body is kept only when processing it failed, so the fault can be diagnosed — and it is cleared when it is fixed. The purpose is that a diagnosis never requires keeping your clients’ details.

What happens to your data when you cancel is set out on our Refund & cancellation page.

07 How it is protected

• Everything travels over an encrypted connection.
• Passwords are stored as a salted hash. Nobody at BeautyRaena can read your password, and we cannot tell you what it is — only reset it.
• The database enforces access rules of its own, so one account cannot reach another’s rows even if the application is wrong.
• Access to production systems is limited to the people who need it.

No system is perfectly secure. If a breach affects your information, we will tell you and the relevant authorities within the time the law allows.

08 Cookies

The dashboard sets one cookie: the one that keeps you signed in. It is necessary for the service to work, and it is removed when you sign out. There are no advertising or analytics cookies on this website.

---

Your rights

What you can ask us to do

09 Everyone

Whoever you are and wherever you are, you may ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong — most of it you can edit yourself in Settings.
• Delete your account and the information attached to it, except the billing records we are required to keep.
• Stop sending you marketing. Every marketing email has an unsubscribe link, and stopping it does not affect the emails we must send about your account and your billing.

Write to [email protected] from your account address. We reply within 30 days, usually far sooner, and we do not charge for it. We may need to confirm it is really you before we act.

10 California, and states with similar laws

If you are a California resident, the CCPA as amended by the CPRA gives you the rights above, plus the right to know what categories we collect and disclose, and the right not to be treated worse for exercising any of them. We will never refuse service, change your price or downgrade your plan because you made a request.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the past twelve months.

You may use an authorised agent, who will need written proof that they act for you. Residents of Virginia, Colorado, Connecticut, Utah, Texas and other states with comparable laws have equivalent rights, and the same address reaches us.

11 If you are one of our customers’ clients

You may have reached this page because a salon or studio sent you a message using our software. Your information is held in their account, and they decide what happens to it, not us.

To be removed, to correct a detail, or to stop receiving messages, reply STOP to any text or contact the business directly — they can action it immediately. If you cannot reach them, write to us and we will pass your request on and support them in honouring it.

12 Changes to this policy

We update this page as the product and the law change, and the date at the top always shows the current version. If a change materially affects how we use your information, we email you before it takes effect.

13 How to reach us

{{ LEGAL_ENTITY }}
{{ LEGAL_ADDRESS }}
[email protected]

See also our Terms of Service and our Refund & cancellation page.