Privacy Policy

Lash Tech is the operating system a lash studio uses to run its business. This policy explains what we collect, why, and the choices you have over your data.

What we collect

Account details you give us (your email and studio name), the business records you create in the product (appointments, clients, lash maps, and payments), and technical data needed to keep the service secure, such as the IP address and device behind a sign in or a consent.

How we use it

To provide the product, process payments, keep your account secure, and meet our legal obligations. We do not sell your data. Your clients and their records belong to your studio, not to us.

Text messages (SMS)

If you give a studio your mobile number and opt in on its booking page, Lash Tech sends you appointment text messages on that studio's behalf: confirmations, reminders, aftercare instructions, and rebooking reminders. Message frequency varies with your appointments. Message and data rates may apply. Reply STOP at any time to stop the texts, or reply HELP for help.

We do not sell your mobile number, and we do not share it with third parties or affiliates for their own marketing or promotional purposes. Your number is used only to deliver the messages you asked for, through our messaging provider (Twilio), and to honor your opt-out.

Third parties we work with

We share only what a task needs with the services that run the product: Supabase (database and sign in), Square (payments), Twilio (text messages), Resend (email), Vapi (the voice receptionist), Google and Apple (sign in and calendar), Instagram (the messages you connect), and PostHog and Sentry (product analytics and error monitoring). Each is bound to protect your data to the same standard set out here and to use it only to provide its part of the service.

AI features and your data

Some features use AI models run by third parties, through OpenRouter, which routes to providers such as Google and OpenAI, and Vapi for the voice receptionist, to draft messages, answer questions and summarize your day. Where a feature sends personal data to one of these providers, it does so only with your consent, which you can review and withdraw from your consent settings. The data is processed under terms that prohibit using it to train their own models or for advertising.

Photos

Lash maps can include photos of the eyes and lashes you are working on, added to a client record. They are stored as part of that record, used only to show you that history, and never used for advertising or to train AI. They are removed when you delete the client or your account, subject to the retention note below.

Your rights

You can export everything we hold about you, and you can delete your account, both self-serve from your account data page. When you delete, we null your personal data and disable your account, while keeping the records the law requires us to retain (consents, audit history, and payment records) for their retention period.

Consent

You can review everything you have agreed to, and the version you accepted, from your consent settings.

Contact

Questions about your data go to our help page at lashtech.app/help.