Privacy Policy

Last updated: October 16, 2026

Aesthatech ("we", "us", "our") is a business management platform for independent beauty and wellness professionals. This Privacy Policy explains what personal data we collect, how we use it, and your rights over it.

We do not sell your personal data to third parties. Ever.

1. What We Collect

Account information

Name, email address, and authentication data collected via Clerk when you create an account.

Business data

Client records (names, contact details, service notes, visit history), services, products, and content preferences that you enter into Aesthatech.

Usage data

Feature usage counts, daily generation limits, and scheduled content, used to operate and improve the product.

Billing data

Subscription and payment information processed by Stripe. We never store raw card numbers.

2. How AI Features Work

Aesthatech's AI features (Smart Actions, Smart Insights, Content Planner) are powered by Anthropic's Claude API.

Client names, email addresses, and phone numbers are pseudonymized before transmission. Each client is replaced with an opaque token (e.g. a1b2c3d4) derived from their internal ID. Real contact details are restored server-side after the AI responds and are never sent to Anthropic.
Before client notes and visit history are sent, health details (medical conditions, medications, pregnancy, allergies) and contact details (emails, phone numbers, addresses, other people's names) are removed automatically. What remains is linked only to an anonymous token. AI suggestions are for running a beauty business and are not medical advice.
Anthropic does not train its models on API inputs. Per Anthropic's standard API terms, inputs and outputs are retained for up to 30 days for safety and operational purposes, then deleted.
You will be asked to acknowledge this data processing the first time you use an AI feature. You may withdraw consent at any time by contacting us (see Section 7).

3. Third-Party Processors

Processor	Purpose	Data involved
Supabase	Database & storage	All business and client data
Clerk	Authentication	Name, email, login sessions
Stripe	Billing	Subscription and payment info
Anthropic	AI generation (Claude API)	Anonymized business context (no names, contact details or health information)
Vercel	Hosting	All data passes through while the app runs
PostHog	Product analytics	Pages visited and feature use, linked to a random ID and your account ID (never client data)
Sentry	Error reporting	Technical details of errors

Business data, teams and health information

Your clients' information: when you store your clients' details in Aesthatech, you decide what is collected and why, and we process it on your behalf to run the Service. If you are a client of a business that uses Aesthatech, please contact that business about your information.
Teams: everyone on a business's team can see that business's clients, services, products and notes. Owners choose who is on the team.
Health information: Aesthatech is not a medical record system and is not HIPAA-compliant. Please don't store medical records, diagnoses or medication lists. Health details in notes are removed before anything is sent to our AI provider.
Children: the Service is for businesses and is not directed to anyone under 18.

4. Your Rights

Right to Access / Portability

Download a copy of all your data at any time: Download my data

Right to Erasure

You may request permanent deletion of your account and all associated data. This is available on your Profile page (Your data > Delete account) or via our API endpoint DELETE /api/gdpr/delete-account. Deletion is irreversible. If you founded a business that has other team members, deleting your account also deletes the business and removes them, so we ask you to confirm that first; team members deleting their own account only remove themselves.

Right to Correction

Update any of your personal data directly within the Aesthatech dashboard, or contact us.

Right to Withdraw AI Consent

You may withdraw consent to AI data processing at any time by contacting us. This will disable AI features for your account.

5. Data Retention

Your data is retained for as long as your account is active.
On account deletion, all data is permanently removed from our databases.
Anthropic retains pseudonymized API inputs for up to 30 days per their standard terms.
Stripe retains billing records as required by financial regulations (typically 7 years).

6. Cookies

We use session cookies set by Clerk for sign-in. Your browser's local storage holds AI results between page loads and a random identifier our product analytics (PostHog) uses to count visits and feature use. We don't use advertising cookies, and we don't sell or share data for advertising.

7. Contact

For any privacy-related requests or questions, email hello@aesthatech.com.

California Residents (CCPA)

Aesthatech does not sell or share personal information as defined by the California Consumer Privacy Act. California residents have the right to know, delete, and opt out of the sale of personal information. To exercise these rights, contact us at the address above.