Stillwater Day Spa ("we", "us") is a day spa that also runs in-home spa parties. This policy explains how we handle personal information collected through this website and our booking system, in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
What we collect
- When you book: your name, email address and mobile number; the service, date and time; how many people; whether it's at the spa or at your home (and your address for in-home parties); the time you need to be finished by; and the add-ons you choose.
- About you and your health: the occasion, your skin type, health notes (pregnancy, blood pressure, surgery, allergies), pressure preferences, and anything else you choose to write. Health notes are health information: we ask for them only so your treatment is safe for you, and you don't have to give them.
- When you pay: for Interac e-Transfers, Interac sends us the sender's name, the amount, your message and a reference number. Card payments are handled entirely by Stripe on its own secure page; we receive the amount, the name on the payment and a payment reference. We never see or store your bank or full card details.
- Your account and points: if you use My account, your bookings, packages and loyalty points are linked to your email address. If you choose to sign in with Google or Facebook, they tell us your name and email address and nothing else.
- When you email or message us (including on WhatsApp): whatever you choose to include.
Why we use it
- To book, confirm, remind you of, change or cancel your appointment, and to plan who comes, where and when.
- To match your deposit or balance to your booking and tell you when it arrives.
- To plan your treatment safely, for example around a condition you've told us about.
- To keep your package visits and loyalty points up to date.
- To keep business and tax records.
We only send messages about your bookings, packages and points, and occasionally a note to rebook or to ask how it went. We don't send marketing, and we never sell or rent your information.
Who sees it
The studio owner sees everything. Our therapists, aestheticians and host see the bookings they're working on — your name, the time, the place, and your health and skin notes — but not payment details.
Who helps us
We use a few trusted services to run bookings. They process information on our behalf and only for these purposes:
- Google (Google Calendar and Gmail): stores your appointment and sends our emails.
- Netlify: hosts this website and runs the booking system.
- Twilio: sends our text messages.
- Stripe: processes card payments.
- WhatsApp (Meta): only if you choose to message us there.
These providers may store information on servers outside Canada, including in the United States, where it may be accessible to authorities under local law.
Cookies and this website
This website doesn't use advertising or tracking cookies. While you sign in to My account, your browser keeps a short-lived sign-in check in session storage, which is cleared when you close the tab. The fonts come from Google Fonts and the maps from OpenStreetMap; like any website, those services receive your device's internet address when they load.
How long we keep it
We keep booking details for as long as we need them for your appointments, packages and points and for our business records (generally up to two years, longer where tax law requires), then delete them.
Your choices
- You can ask to see, correct or delete the information we hold about you, or withdraw your consent, by emailing us. Deleting your details may mean we can't keep an upcoming booking, and unused points are lost.
- Reply STOP to any text to stop text messages.
Keeping it safe
Your booking details are only visible to the studio and the team member working with you, and the accounts that hold them are protected with strong passwords and two-step verification.
Contact
Questions or requests: info@solidsitestudio.com. If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.