Skip to content
Studio operating system
Start your trial
A sunlit professional workspace with a laptop, notebook and ceramic cup on an oak desk

Booksui

Privacy Policy

How Booksui collects, uses, stores, and protects your data — and the choices and export rights you have as a customer.

Last updated: October 7, 2026

1. Information We Collect

We collect information that you provide directly to us:

  • Account information: name, email address, and password when you create an account
  • Business data: client contacts, project details, invoices, proposals, contracts, and the photos, video and other files you upload
  • Payment information: billing details processed securely through Stripe (we do not store credit card numbers)
  • Usage data: how you interact with the Service, including pages visited and features used

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Process transactions and send related notifications
  • Send you technical notices, updates, and support messages
  • Respond to your requests and inquiries
  • Monitor and analyze trends and usage

3. Data Sharing

We do not sell your personal information. We may share information with:

  • Service providers: the third parties that operate parts of the Service on our behalf. Today these are Supabase (database, authentication and file storage), Vercel (hosting), Stripe (payments and subscriptions), Cloudflare R2 (storage for the photos, video and files you deliver), Resend (transactional email) and our AI provider — Anthropic (Claude), or xAI (Grok) if configured — for the AI-assisted features described below. Each processes only what its function requires, and none of them is permitted to use your data for its own purposes.
  • Artificial intelligence: where you use a feature that is described in the product as AI-assisted — the studio assistant, business research, lead scoring or drafting help — the text involved is sent to our AI provider, Anthropic (Claude), or xAI (Grok) if configured, to generate the response. Client photographs are sent only when you use gallery photo descriptions, and then only a small preview of each photograph. Nothing sent is used to train the provider’s models. When xAI is the provider, it keeps requests for up to 30 days to investigate abuse and then deletes them. Every AI feature is optional and none runs unless you start it.
  • Legal requirements: when required by law or to protect our rights
  • Business transfers: in connection with a merger, acquisition, or sale of assets

4. Data Security

We implement industry-standard security measures including encryption in transit (TLS) and at rest, row-level security policies, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Upon account deletion, we will delete your data within 30 days, except where retention is required by law.

6. Your Rights

You have the right to:

  • Access and export your data at any time
  • Correct inaccurate information in your account
  • Delete your account and associated data
  • Opt out of non-essential communications

7. Third-Party Services

The Service may integrate with third-party services (e.g., Stripe, email providers). These services have their own privacy policies, and we encourage you to review them.

Accounts you connect

A studio can choose to connect other accounts it uses. Each is off until you connect it, and each can be disconnected from Integrations at any time — disconnecting asks the provider to end Booksui’s access and deletes the access tokens we held. Access tokens are stored encrypted and are never sent to your browser.

  • Google Calendar (scope calendar.events): we create, update and delete the events for bookings made in Booksui on your primary calendar, and read changes to those events so a move made in Google reaches Booksui. We do not read your other events’ contents for any other purpose.
  • Google Drive (scope drive.file): we only see files Booksui itself creates in your Drive — backups of deliveries you choose to back up. When your client saves a delivery to their own Drive, we use their permission once to copy the files and keep nothing.
  • QuickBooks Online and Xero: we send your contacts, invoices, payments and expenses to the company or organization you choose, and read its chart of accounts to pick the accounts to post to.
  • Facebook Page and Instagram: we receive the direct messages sent to the Page and its linked Instagram professional account, and send the replies you write in Booksui.
  • Text messages and WhatsApp are sent and received through Twilio.

Booksui’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data received from connected accounts is used only to provide these features to you; it is not sold, not used for advertising, and not used to train AI models.

Deleting connected-account data. Disconnect the account under Integrations, or remove Booksui from the provider’s own settings (Google Account permissions, the QuickBooks or Xero connected apps list, or Facebook’s Business Integrations) — we stop using it and delete the tokens we held. To have everything deleted, delete your Booksui account or write to the address below.

8. Children

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification.

10. Contact

For privacy-related questions, contact us at hi@booksui.com.