Privacy Policy

We collect three categories of data: (a) Account data: your name, email, phone number, business name, and profile photo, provided during signup or in settings; (b) Studio data you create: clients, bookings, contracts, payments, packages, and any files or photos you upload; (c) Technical data: IP address, browser, device, and usage events, collected automatically to keep the service secure and reliable. When you request access, we also save which link brought you to our site: the campaign tags in that link (such as utm_source) and the domain of the website you came from, so we can tell which channels bring requests. We do not save the full address of that website, and we record this only with a request you choose to submit.

If you choose to connect your Google account, Lnsly integrates with Google Calendar so that bookings you create in Lnsly appear on your calendar. This section discloses exactly what Google user data Lnsly accesses, how we use it, whether we share it, how we protect it, and how long we keep it.

What Google user data we access

With your explicit consent, Lnsly accesses (a) the list of calendars in your Google account (calendar names and IDs) so you can choose which one to sync to, and (b) permission to create, update, and delete calendar events on the single calendar you select. Lnsly also receives a Google OAuth access token and refresh token that authorize these actions. We do NOT read, import, or store the contents of events you or others create outside Lnsly.

How we use Google user data

We use this data solely to provide the calendar-sync feature you enabled: reading your calendar list so you can pick a target calendar, and creating, updating, or deleting events that mirror your Lnsly bookings and sessions. We do NOT use Google user data for advertising, we do NOT sell it, and we do NOT use it to develop, improve, or train generalized artificial-intelligence or machine-learning models.

Whom we share, transfer, or disclose Google user data to

We do NOT share, transfer, or disclose your Google user data to any third party for their own purposes. The Google OAuth token is stored only in our database provider (Supabase) and processed on our hosting provider (Vercel), which act strictly as our service providers to run this feature on our behalf and are bound by their own data-protection terms. Lnsly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect Google user data

We treat Google OAuth tokens as sensitive data. They are transmitted only over encrypted TLS/HTTPS connections, stored server-side, protected by row-level access controls and service-role-restricted access, and never exposed to the browser or to other customers. Access to the underlying secrets follows least-privilege practices.

How long we retain Google user data and how to delete it

We retain your Google OAuth token while the relevant calendar connection stays enabled. Disconnecting the studio calendar from Settings removes its stored token and selected-calendar ID and stops further synchronization through that connection. Events already created in that studio calendar remain under your control. Disconnecting a team member’s personal calendar attempts to remove the assigned-work events Lnsly created before deleting the stored connection. If that cleanup fails, some events may remain in Google Calendar. You can also revoke access from your Google Account permissions page at myaccount.google.com/permissions. While a calendar remains connected, deleting a corresponding booking removes its Lnsly-created event. Deleting your Lnsly account removes its stored Google connections.

We use your data to operate the service (let you log in, store your bookings, send transactional emails), to keep the service secure (detect abuse, prevent fraud), and to improve the product (anonymous usage analytics). We do not sell your data.

We use service providers to operate Lnsly: Supabase for database and authentication, Vercel for hosting, Resend for transactional email, Cloudflare R2 for photo and file storage, and Sentry for error monitoring. Depending on the features enabled, we also use Akedly to deliver verification codes, Upstash for rate limiting, Cloudflare Turnstile for bot protection, and Google for Calendar synchronization and usage analytics. Each receives the data needed for its function and is governed by its applicable data-protection terms. If a studio adds its own Google Analytics ID to its galleries, gallery usage events are also sent to that studio’s Analytics property. For advertising measurement, we send OpenAI the time and a random reference for a successfully saved access request, plus an ad-click reference when available. We do not send your name, email, phone number, IP address, or form answers through this integration. This conversion integration keeps its browser copy of the click reference only in the current page session, without adding advertising cookies, and honors Global Privacy Control and Do Not Track signals. Events are opted out of future user-level personalization.

We keep your account data while your account is active. If you delete your account, we delete personal data within 30 days, except records we must retain for legal, accounting, or fraud-prevention reasons. Backups are purged within 90 days.

You can review and update the account information available in Settings. Owners can export the supported studio records. For access, correction, export or deletion requests beyond those controls, email info@lnsly.com. You can also disconnect supported integrations. EU/UK users have additional rights under GDPR; we honour those on request.

We use industry-standard practices: encrypted database connections, hashed passwords, row-level access controls, and least-privilege secrets management. No system is perfectly secure; if a breach affects you, we will notify you promptly as required by law.

Lnsly is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy. Material changes will be announced by email or in-app at least 14 days before they take effect.

Questions or requests: email info@lnsly.com. We aim to respond within 7 days.