Privacy Policy

Rervva provides studio management software. For studio owners' account data we are the data controller. For the client records a studio stores in its workspace, the studio is the controller and we are the processor acting on its instructions.

Studio account data: name, email, phone, business name, booking-site slug, branding, services, staff, hours, subscription status.

Client data entered by a studio or submitted through its booking site: name, email, phone, appointment history, service preferences and notes, photos the studio uploads to a client's lookbook, loyalty points, orders and messages.

Payment data: handled by our payment provider. We store only non-sensitive references (amounts, status, last-four style identifiers returned by the provider). We never see or store full card numbers.

Technical data: log records, IP address, device/browser type, and in-app usage events needed to operate and secure the service.

To provide the service (bookings, reminders, payments, storefront), to prevent fraud and trial abuse, to provide support, to bill subscriptions, and to improve reliability and performance. We do not sell personal data and we do not use client data for advertising.

Studios may send appointment confirmations, reminders and marketing messages by email or SMS. Consent is collected by an unchecked checkbox on the studio's online booking page, which names the studio, states that message frequency varies, that message and data rates may apply, and explains STOP and HELP. Every marketing message includes an opt-out, opt-outs are honoured automatically, and quiet-hours rules defer messages outside permitted times.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are never shared with any third party, and phone numbers collected for SMS are used only to deliver the messages the client agreed to receive.

Payment processing — to take deposits, shop orders, gift cards and subscription payments. Cloud hosting and database — to store and serve your workspace. Email and SMS delivery — to send the notifications a studio configures. Each processor is bound by contract to use the data only to provide its service.

Data is encrypted in transit. Each studio's records are isolated at the database level with row-level security policies so one studio can never read another's data. Access to production systems is limited to personnel who need it. Uploaded photos are stored in tenant-scoped buckets.

We keep workspace data for as long as the account is active. After cancellation, data is retained for 30 days so you can export or reactivate, then scheduled for deletion. Records we must keep for tax, accounting or fraud-prevention reasons are retained for the legally required period.

You can access, correct, export or delete your data. Studio owners can export clients, appointments and orders to CSV at any time and can delete client records directly. If you are a client of a studio, contact that studio first; if you cannot reach them, email us and we will forward and assist.

Depending on where you live, you may also have the right to object to processing, restrict it, or complain to a supervisory authority.

We use only the cookies and local storage needed to keep you signed in, remember interface preferences (theme, layout, density) and keep a shopping bag between pages. No third-party advertising trackers.

On our public marketing pages we keep our own basic measurements — pages viewed, which buttons were clicked, how long a page was open, how far it was scrolled, repeated or unproductive clicking that suggests something is broken, the device, browser and operating system, and the referring site or campaign tag that brought you here. A random identifier is stored in your browser so repeat visits count as one person.

We also record your IP address and the approximate location (country, region, city) it indicates, so we can understand where interest comes from and detect abuse. The raw IP address is deleted after 30 days and only an irreversible hashed value is kept after that. We do not sell this data, we do not use third-party analytics or advertising services, and we do not build advertising profiles. If you create an account, we link that random identifier to your account once so we can see which page led to the signup.

Inside your studio account we record which screens are opened and which key actions are taken, together with your studio and user ID, so we can see which features help, where people get stuck, and what to fix next. We do not record keystrokes, form contents, client records or payment details in this measurement.

The service is not directed at children under 13, and we do not knowingly collect their data.

Material changes will be announced in-app and by email at least 14 days before taking effect. Privacy questions or requests: support@rervva.com.