Privacy Policy

Effective November 13, 2026

This policy explains what personal information Regulars Desk LLC (“Regulars Desk”, “we”, “us”) collects through regularsdesk.com and the Regulars Desk app at app.regularsdesk.com, how we use it, who we share it with, and the choices you have.

Who this policy covers

Visitors and enquirers: people who visit regularsdesk.com, request a demo or invitation, or email us.
Businesses and their staff: the salons, spas, studios and other businesses that hold a Regulars Desk account (“Businesses”), and the owners and team members who sign in (“Staff”).
Clients of Businesses: people who book, pay, check in, fill in forms or receive messages through a Business’s Regulars Desk booking pages or front desk (“Clients”).

Our role: each Business controls its Clients’ data

When a Business uses Regulars Desk, the Business decides what Client information to collect and how to use it. We process that information only on the Business’s behalf and under its instructions. In legal terms, the Business is the “controller” (or “business”) and we are its “processor” (or “service provider”).

That means:

The Business’s own privacy notice governs how it uses its Clients’ information.
Each Business is responsible for giving its Clients any notices the law requires and for getting any consents it needs, including consent to receive text messages and marketing emails, and consent to collect health-related or other sensitive information on intake forms.
If you are a Client, please send questions or requests about your information to the Business you booked with. If you contact us instead, we will pass your request to that Business within five business days and help it respond.

For information we collect for our own purposes (our website, enquiries, Business and Staff accounts, and subscription billing), we are the controller and this policy applies directly.

Information we collect

From visitors and enquirers

Contact form: your name and email, and, if you choose, your business name, phone number, type of business, team size, the software you use now, and any message. We use these only to reply to you and we do not add you to a mailing list.
Emails you send to info@regularsdesk.com.
Bot checks: public forms use a bot check run by Cloudflare, which receives signals from your browser to tell people from automated traffic.
Server logs: our web server keeps no log of the pages you request. The service’s own logs record events such as sign-ins, errors and security checks. They can include your IP address and browser type, never passwords, sign-in codes or secure links, and they are kept for 30 days.
Cookies: regularsdesk.com sets no analytics or advertising cookies. app.regularsdesk.com uses only the cookies needed to keep you signed in: a sign-in session and, on a shared front-desk device, a device and PIN session. They cannot be read by scripts and are sent only to that site.

From Businesses and Staff

Account details: names, email addresses, phone numbers and roles of the owner and team, and sign-in details. Every Staff account uses a password and an authenticator app.
Business details: business name, locations, services, prices, hours, booking pages, website and custom domain, and the business details needed to verify a texting number with phone carriers.
Subscription billing: the owner’s name, email and billing details. Card details are entered on Stripe’s pages and never reach our servers.
Activity records: an activity log of changes to bookings, money, settings and the team, with who made each change and when.
Support: what you tell us when you ask for help.

Client information we process for Businesses

Contact details such as name, email address and phone number.
Appointments, classes, waitlist entries, check-ins and visit history.
Sales, deposits, cards on file, gift cards, packages and credits, memberships, promotion codes and retail purchases. Card payments run on the Business’s own Stripe account; card numbers go to Stripe and never to us.
Intake forms and waivers, including e-signatures. These may include health-related answers, allergy notes and client photos, which we treat as sensitive: they are encrypted at rest, shown only to Staff the Business allows, and every view is logged.
Copies of the emails and texts the Business sends through Regulars Desk.

Regulars Desk is not a HIPAA product and does not sign business associate agreements. It is not for clinical or medical-spa use, and Businesses should not use it to store protected health information.

How we use information

To provide, run, maintain and support Regulars Desk.
To send emails and texts on a Business’s behalf, as the Business sets them up.
To bill subscriptions and manage accounts.
To send Businesses and Staff service messages about their account, billing, security and changes to the service.
To keep the service secure, including bot checks, rate limits on sign-in and other sensitive actions, and keeping each Business’s data separate.
To answer enquiries and support requests.
To comply with the law and enforce our Terms of Service.
To run and improve the service, using what Businesses tell us and counts that identify no one, such as the numbers of bookings, messages and errors. We do not use Client information for product analytics.

No advertising, analytics, session-recording, error-reporting or AI service receives Business or Client data. We do not sell personal information, we do not share it for targeted advertising, and we do not use Client information to market Regulars Desk.

Sub-processors. We use these providers to run the service. The current list is at regularsdesk.com/subprocessors, and we tell Businesses at least 30 days before we add or replace one.

Provider	What it does	Data it receives
Amazon Web Services, Inc.	Runs the service and stores its data	All data at rest, with sensitive client details encrypted
Twilio Inc.	Text messages, for a Business that has text messaging turned on	Phone numbers and message content; business details for carrier verification
Resend, Inc.	Email delivery	Email addresses and message content
Cloudflare, Inc.	Custom domains, bot checks and DNS	Traffic to custom domains; browser signals on pages with a bot check
Stripe, Inc.	Billing for Regulars Desk subscriptions	Business owner name, email and billing details; card details entered on Stripe’s pages
Cloudflare, Inc. (R2 storage)	Keeps encrypted copies of backups off-site	Encrypted backups only

Services a Business contracts with directly. A Business’s client payments run on its own Stripe account under its own agreement with Stripe. If a Business links its Google review page, the Client follows that link after a visit; we send Google nothing.

Within a Business. Client information is visible to the Business and to the Staff it authorizes.

Legal and safety. We may disclose information if the law requires it, to respond to valid legal process, or to protect the rights, property or safety of our users, the public or us.

Business transfers. If Regulars Desk LLC is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, subject to this policy.

Payments

Client payments go straight to the Business’s own Stripe account. Regulars Desk takes 0% of them, and the Business pays Stripe’s fees directly. Card entry, online and on card readers, is hosted by Stripe, so card numbers go to Stripe and never to us. Stripe’s own privacy policy and its agreement with the Business apply to that processing. Our own subscription billing also runs through Stripe.

Emails and text messages

Businesses use Regulars Desk to send booking confirmations, reminders and, if they choose, marketing campaigns. Emails carry the Business’s name. Where text messaging is turned on for a Business, texts come from the Business’s own verified number. We deliver them through Resend (email) and Twilio (texts).

The Business is responsible for having its Clients’ consent before sending texts or marketing emails, and for following texting and email laws and carrier rules.
Clients can stop texts by replying STOP, and can unsubscribe from marketing emails with the link in the email or their mail app’s unsubscribe button. An opt-out applies to that Business only.
We do not share Clients’ mobile numbers or text-message opt-in data with third parties for their own marketing.

How long we keep information

Business and Client data: for as long as the Business’s account is open. Owners can export their data at any time, in every billing state, including if they stop paying, and for 90 days after closing the account.
After closure: once the 90-day export window ends, we delete or return Business and Client data at the Business’s direction, within 30 days of its request, unless the law requires us to keep it. Encrypted backups are replaced on a rolling basis, normally within 14 days, so deleted data leaves them as they are replaced.
Enquiries: contact form requests are deleted 12 months after you send them. Emails you send us are kept for as long as we need them to deal with your enquiry and for our records, normally no longer than three years.
Logs and sign-in records: server logs for 30 days; sign-in sessions for 90 days after they end; used sign-in codes and links for 30 days.
Sent messages: the content of an email or text sent through the service is removed after 30 days. A record that it was sent stays, so a duplicate is not sent and delivery problems can be traced.
Activity records: the activity log of a Business’s account is kept for as long as the account exists, as financial and security evidence.
Billing records: for as long as tax and accounting law requires, normally seven years.

We may keep information longer where the law requires it or to resolve a dispute.

Security

Each Business’s records are separated in the database with row-level security, and automated tests check that no Business can read another’s data.
Card numbers never reach our servers.
Every Staff account uses two-step sign-in, and sensitive actions such as large refunds, exports and team changes ask for the second step again.
Health-related form answers, allergy notes and client photos are encrypted at rest, access-limited and every view is logged.
Backups are encrypted and restores are rehearsed.
Our staff cannot sign in as a Business or its team; when we help with an account, the action is recorded with a reason.
Public forms have bot checks, and sign-in and other sensitive actions are rate limited.

No system is perfectly secure. We do not hold SOC 2 or other independent certifications today. If a breach affects your information, we will notify affected Businesses without undue delay, and within 72 hours of confirming it, and others as the law requires. To report a security problem, email info@regularsdesk.com.

Your privacy rights

Depending on where you live, you may have the right to:

know what personal information we hold about you and get a copy in a portable format;
correct inaccurate information;
delete your information;
opt out of the sale of personal information, targeted advertising and certain profiling;
not be treated differently for using these rights.

These rights come from state laws such as the California Consumer Privacy Act (as amended by the CPRA) and the Colorado Privacy Act, and similar laws in other states. Each law applies only to companies that meet its thresholds. We honor these requests from everyone whose information we control, wherever you live.

How to make a request. Email info@regularsdesk.com with your request. We will verify your identity before acting, and we will respond within 45 days. You may use an authorized agent where the law permits.

Appeals. If we decline your request, you can appeal by replying to our decision. If we deny your appeal, you may contact your state Attorney General.

Clients of Businesses. Send requests to the Business you booked with. We will help that Business respond.

Browser opt-out signals. We do not sell personal information or share it for targeted advertising, so there is nothing for a Global Privacy Control signal to turn off: every visitor is already treated as opted out.

Children

Regulars Desk is made for businesses and is not directed to children. We do not knowingly collect personal information from children under 13 for our own purposes. A Business may keep records for Clients who are minors, for example when a parent books for a child; the Business is responsible for getting a parent’s or guardian’s consent where required. Staff account holders must be at least 18.

Where information is stored

Regulars Desk is run from the United States and is intended for businesses in the United States. Information is stored in the United States, on Amazon Web Services in Ohio. Encrypted backup copies are also kept with Cloudflare.

Changes to this policy

We may update this policy. We will post the new version here with a new effective date. If we make a material change, we will tell Businesses by email or in the app at least 30 days before it takes effect.

Contact us

Regulars Desk LLC, Colorado, United States. Email info@regularsdesk.com.