Privacy

Spa Desk is a private workspace for invited spa staff. The current setup phase uses your Google email to control access and, with your consent, connects to Google Business Profile to check access to your store.

Google refresh credentials are encrypted before storage. Only authorized staff can use store connections. Review content and draft replies are encrypted in temporary storage and expire within 21 days. When a team member requests an AI draft, the review text, store instructions, previous draft, and supplied feedback are sent to the paid Google Gemini API. Reviewer names are not sent in the prompt. Review text is not included in database backups. Workflow events, approval records, content hashes, and cost totals are kept separately.

Application configuration and encrypted credentials are stored on Cloudflare. Google sign-in state expires after ten minutes and dashboard sessions expire after twelve hours; deleted database records may remain in provider backups for up to thirty days.

You can disconnect a store from the setup page or revoke access through your Google Account. To request deletion of this workspace’s data, contact the spa administrator at manager.stepsoul@gmail.com.