Security and privacy
What we hold, and what we never touch
Your clients trust you with their details, and you are trusting us with them in turn. This page says exactly what that means, in terms you can check.
We never see a card number
Card details are entered directly with Stripe and exchanged for a token. They do not pass through our server and are never stored by us. The same is true of the bank details a business enters for payouts: that form is hosted by Stripe, on Stripe’s pages.
Payment routing and release are recorded
The primary payment flow holds partial or full booking payments on the platform’s Stripe balance until an eligible release to the business. An alternative configuration routes funds at booking. Refunds and reversals depend on the original flow and the booking policy. This description does not represent a regulated escrow or trust service.
Private access is checked on the server
Private server routes verify identity and applicable owner, staff or admin permissions. Selected business and admin operations also require approved sign-in sessions. Public marketplace reads remain public. App Check enforcement depends on the service and environment configuration; it is not a guarantee that every request comes from an attested app.
Error reports are stripped before they leave
Crash and error reports are scrubbed for authorisation headers, session tokens, secrets and anything card-shaped before being sent. Automated redaction targets known sensitive patterns; it does not guarantee every piece of personal information is removed. Avoid including unnecessary sensitive information in diagnostics or support reports.
Rate limits on anything that costs money or sends mail
Payment, email and login endpoints are individually rate limited, to reduce automated abuse. Production shared counters require Redis and fail closed when unavailable; rate limits do not guarantee that abuse is impossible.
You can take your data, and you can leave
Export your data or delete your account from inside the app, without emailing anybody to ask. Deletion removes or de-identifies supported profile data, subject to financial, security and legal retention and provider cleanup limits. Cancel subscriptions separately with the billing provider. Completed bookings and billing records may need retention; not everything vanishes.
Who else processes your data
Every third party that touches personal data on our behalf, what they do, and what they can see. If this list changes, this page changes with it.
| Service | What it does | What it can see | Where |
|---|---|---|---|
| Stripe | Booking payments, optional card tips, web subscription billing and business payouts | Customer name and email, booking and tip amounts, web subscription and invoice details, and payout and identity details entered on Stripe’s pages | United States, with EU and Canadian processing under Stripe’s own terms |
| Google Cloud / Firebase | Accounts and sign-in, the database, file storage, and app attestation | Account details, business profiles, services, bookings, intake forms and answers, reminder preferences, reviews and uploaded images | Regional Google Cloud data centers |
| Cloudflare Stream | Hosting and delivering uploaded business and request video clips | Uploaded clips, content identifiers, playback metrics and technical delivery information such as IP address and device type | Global edge network |
| Resend | Booking confirmations, reminders, and account emails | Email address and the contents of the message, such as appointment details | United States |
| Sentry | Error monitoring, so faults are found before they are reported | Error diagnostics and related request context. Known authorisation, token, secret and card-shaped fields are redacted; this is not a guarantee that all personal information is removed | United States |
| Railway | Hosting the application server | Data in transit through the server, and application logs | United States |
| Google Maps Platform | Maps, address suggestions and geocoding where configured | Address search text, lookup coordinates when requested, selected place information and technical request data | Google infrastructure under its Maps terms and privacy policy |
| Twilio (when SMS is enabled) | Optional telephone verification and transactional SMS reminders | Telephone numbers, verification and delivery information, message content and opt-out signals | Provider infrastructure; processing may occur outside Canada |
| Redis infrastructure | Short-lived public caches and shared abuse-prevention counters | Cached public responses and hashed rate-limit identities with expiring counters | Configured hosting environment |
| Apple and Google | Native Starter, Grow and Pro subscription billing | The purchase record. Payment details stay with the app store and are never sent to us | Global |
Reporting something
If you think you have found a security problem, email security@burgundyblend.com. Tell us what you found and how to reproduce it. We will confirm we received it, and we will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it before publishing.