Privacy for shops

Last updated October 13, 2026

Here’s what we keep, why we keep it, and how to delete it.

This page is for owners and staff at a business that runs on Thrivari. That could be a barbershop, a salon, a studio, or any business that takes appointments. It covers the dashboard, the booking site we run under your name, and anything you connect to them. Booked an appointment at a shop? This page is for you instead. Questions? Email hello@thrivari.com.

What we keep about your shop

• Your business name, address, and hours.
• Your services and prices.
• The people on your team.
• The owner’s contact details.
• The settings you choose.

Everyone signs in to the dashboard with their own phone number. We text a code that works once and expires in 5 minutes. We keep only a scrambled copy of it, so nobody can read it back. That includes us.

What we keep for your shop

About your guests, we keep:

• Their names, phone numbers, and email addresses.
• The family members they book for.
• Birthdays, when the shop adds them, so a child’s haircut and price fit their age.
• Every appointment, past and future, with the staff member and the service.
• Notes your team writes.
• Memberships and credit.
• Payment records that come over from Square.
• The texts and emails Thrivari has sent them.

How we use it

This is your data, not ours. We use it only to:

• Run your dashboard and booking site.
• Send the appointment texts and emails you’ve turned on.
• Show you your reports.
• See which screens and buttons your team uses, so we can make the dashboard faster and easier. This never includes what anyone types.

Staff see what their role allows, and you set the roles. We don’t read your data for any reason of our own.

What we never do

Sell your data, share it for ads, or use it to train software.

When you connect Square

Only the owner can connect Square. You tap Connect, then say yes on Square’s own sign-in page. We ask Square for read access to your:

• Bookings, guests, and team members.
• Payments, refunds, and orders.
• Services and business profile.

We don’t ask for permission to change anything in your Square account, and we can’t.

We read your history once. After that, Square tells us about each new booking, change, or payment as it happens. We also check in once an hour in case anything was missed.

Square gives us a key to your account. We encrypt it with a separate key that lives outside the database.

Tap Disconnect on the Connections page, and we delete the key right away. Square stops sending us anything. The bookings and payments that already came over stay, because they’re your books. They stay until you ask us to delete them.

When a staff member connects Google Calendar

Each staff member connects their own calendar. They tap Connect beside their name, then say yes on Google’s sign-in page. We ask Google for one permission: to see the calendar, read-only.

We use it for one thing. Every 15 minutes, we ask Google which times in the next 60 days are busy. We keep only those start and end times. Each refresh replaces the last one.

We never receive, store, or show:

• What an event is called.
• Who’s in it.
• Where it is.
• What it says.

Your booking site shows those times as unavailable for that person. Nobody sees why, not even the owner.

We encrypt the connection key the same way as Square’s. The staff member or the owner can tap Disconnect anytime. That deletes the key and the busy times right away. Nobody else ever gets anything we read from the calendar, and we use it for nothing else.

Thrivari’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Payments and cards

Thrivari never sees or stores a card number. When guests save a card, Square holds it. We keep only a reference that Square will honor for your shop alone. In-person payments go through your own Square account, under its terms.

Who can see it

Each of these does one job for you, and gets only what that job needs.

• Cloudflare runs the service and stores the data, in the United States.
• Telnyx sends the texts and sign-in codes.
• Square handles payments, plus the connection above if you use it.
• Google runs the calendar connection above if a staff member uses it. Google Workspace also carries our email.

No ad networks, no analytics companies, and no data brokers. We share information with anyone else only if the law requires it. When we’re allowed to, we’ll tell you.

More on sign-in codes and appointment texts is in Text messages.

What your booking site sees

Like any website, your booking site sees a few basics:

• Roughly where a visitor is, from their connection.
• What kind of device they use.
• How they found you.

It records what people tap, so you can see where they stop partway through booking. A small random ID in the browser keeps a guest signed in. No third-party cookies and no trackers. We never store IP addresses.

How long we keep it

As long as you use Thrivari. If you leave, we keep it for 90 days in case you come back. Then we delete it. The one exception is payment records, which tax rules make us keep for 7 years.

Get a copy or delete it

Anytime, you can ask us for:

• A copy of everything, in a file you can open elsewhere.
• Deletion of your whole shop, or of any one guest.

Email hello@thrivari.com, and we’ll take care of it within 30 days. If a guest asks to see or delete their record, you can pass that on to us too.

How we keep it safe

• Everything is encrypted, both in transit and at rest.
• Connection keys are encrypted again under a separate key.
• PINs are scrambled.
• Each staff member sees only what their role allows.

If we ever learn your data was exposed, we’ll tell you within 72 hours of finding out. We’ll say what happened and what we’re doing about it.

Where it lives

In the United States, on Cloudflare’s network. If you’re outside the United States, using Thrivari means your data comes here.

Children

Children show up only as family members on a parent’s or guardian’s account, with a first name and the service. We never collect anything from a child directly.

Changes

We’ll update the date at the top when this changes. If a change affects data you’ve already given us, we’ll email the owner first.