Privacy Policy
Last updated: October 11, 2026
1. What we collect
This policy covers Skintilo, provided by Yurii Gusar, doing business as Skintilo.
| What | Examples | Where it comes from |
|---|---|---|
| Studio account | Owner and team names, emails, phone, studio name and address, logins | The studio, at signup and in Settings |
| Billing | Billing address, last 4 digits of the card, invoices | Stripe. We never see full card numbers |
| Studio client data | Client names, contact details, appointments, consults, quotes, form answers (which may include health details), photos, notes, deposits | The studio, and clients filling in the studio's forms |
| Website and booking visitors | What a visitor types into a booking or consult form | Visitors to the studio's pages |
| Technical | IP address, browser, pages used, error logs, login cookies | Automatically, when anyone uses Skintilo |
If a studio connects its own accounts (a Meta pixel, Square or Stripe for payments, or a Google or Microsoft calendar and mailbox), data also flows between Skintilo and that service under the studio's own account with them. For a connected mailbox, Skintilo stores copies of emails with the studio's clients so they show in the client's history. If a studio forwards its email to Skintilo, emails from its clients are kept in that client's history, and every other email is deleted the moment it arrives without being stored.
2. How we use it
We use the information to run Skintilo and nothing else:
- provide the studio's account, booking pages, forms, reminders and website
- send emails the studio has set up, on the studio's behalf
- bill the studio and calculate sales tax
- send the owner account emails: receipts, trial and payment notices, important changes
- give support, fix problems and keep the service secure
We do not sell personal information. We do not use studio or client data for advertising, and we do not use it to train AI models.
3. Who we share it with
Only the service providers that run Skintilo, and only what each one needs:
| Provider | What they do | What they receive |
|---|---|---|
| Laravel Cloud | Hosting, database, file storage | All Skintilo data, stored on their servers |
| Cloudflare (through Laravel Cloud) | Delivers pages securely, stores files | Page requests, IP addresses, uploaded files |
| Postmark | Sends and receives email | Recipient address and email content |
| Stripe | Subscription billing and sales tax | Owner's name, email, billing address, card |
| Sentry | Reports errors so we can fix them | Technical details of the error, the page, and the ID of the signed-in user |
| Daily | Runs Skintilo Video calls | The names of people on the call and the live audio and video |
| Anthropic | Writes draft website text | Studio name, service names (no prices), team names and bios, the owner's interview answers, and up to 8 public gallery photos as small copies. Never client records |
Skintilo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We also share information if the law requires it, or with a buyer if Skintilo is ever sold, under this same policy. We would tell studios first.
4. Studio client data: our role
For information about a studio's clients, the studio is in charge and Skintilo works for the studio. The studio decides what it collects, why, and how long to keep it. We store and process it only on the studio's instructions.
If you are a client of a studio and want to see, correct or delete your information, contact the studio directly. If you contact us, we will pass your request to the studio. Each studio's own privacy policy covers how it uses your information.
5. How long we keep it
- Deleting a client: when a studio deletes a client, their record, appointments, notes, photos, consent forms and files are deleted right away. There is no recovery window. Payment records are kept for accounting, no longer linked to the client. A note that staff typed on a payment stays as written. Copies of emails sent to them, and synced emails tied to them, are deleted too.
- After the subscription ends: all of the studio's data is deleted on day 97 (see section 5 of the Terms).
- Backups: database and file backups are kept for up to 7 days, so deleted data can remain there for up to 7 days before it is overwritten.
- Billing records: invoices and payment records are kept as long as tax law requires.
6. Security
Every studio's data is kept separate from every other studio's. All connections use HTTPS. Passwords are stored only as secure hashes, and connected accounts (Square, Google, Microsoft) are stored encrypted. Uploaded files, including photos and consent forms, are encrypted at rest. Only Skintilo's founder has access to the hosting account and the database.
No system is perfectly secure. If a breach affects a studio's data, we will tell the owner without undue delay and as the law requires.
7. Your choices and contact
- Studio owners can see, correct and export their studio's data in Skintilo, and can ask us to delete it early at team@skintilo.com.
- Team members can ask the owner, or us, to correct or remove their details.
- Emails: account and billing emails to the owner are part of the service. Any marketing email from Skintilo has an unsubscribe link.
- Changes: we will email owners before any important change to this policy.
Questions: team@skintilo.com