Subprocessors
This is the complete, current list of third-party services Chairwarden relies on to operate, and what each one has access to. It’s generated from what’s actually wired into the product, not a generic template. See our Privacy Policy for the fuller picture of how we handle data.
Supabase
Database, authentication, and file storage (profile photos).
Sees: All account, client, booking, and service data. This is the primary datastore, effectively everything.
Powers the optional "Sign in with Google" login, and (only if you separately connect it in Account settings) reads your Google Calendar's free/busy status to avoid double-booking against events outside Chairwarden.
Sees: Basic Google profile info (name, email) at sign-in. If Calendar sync is connected: free/busy time ranges only, never event titles or details.
Vercel
Application hosting and serverless functions.
Sees: Passes through all request data (nothing is stored by Vercel beyond standard infrastructure logs).
Resend
Sends transactional email: booking confirmations and email reminders.
Sees: Recipient email address, name, and appointment details included in the message.
Twilio
Sends SMS appointment reminders (Individual plan only, opt-in at booking, 500/mo included). Supports US and Canadian phone numbers; messages are purely transactional appointment reminders, never marketing.
Sees: Recipient phone number and the reminder message text.
Stripe
Processes client deposit payments via Stripe Connect. Funds go directly to the stylist's own Stripe account. Chairwarden never holds or touches this money.
Sees: Payment card details (handled entirely by Stripe; Chairwarden never stores full card numbers), billing name, deposit amount.
LemonSqueezy
Chairwarden's own subscription billing (the Individual plan's $29/mo or $23/mo). Acts as merchant of record.
Sees: Stylist's name, email, and payment details for their own subscription.
Google (Firebase Cloud Messaging)
Delivers push notifications to the Android app and is the transport Chairwarden's server uses to send them. Separate from the "Sign in with Google" and Calendar integrations above.
Sees: A device push token (an opaque identifier for one app install, not a person) and the notification text, which names the appointment time and service.
Apple (APNs)
Delivers push notifications to the iOS app. Apple's Push Notification service is the only way an iOS app can receive them.
Sees: A device push token (an opaque identifier for one app install, not a person) and the notification text, which names the appointment time and service.
PostHog
Product analytics: understanding how the app is used, in aggregate. Only runs if you accept analytics cookies.
Sees: Pages visited, general usage events, browser/device type. No client (customer) data is ever sent to PostHog.
Google Analytics
Website analytics: which pages people visit and where they arrive from, in aggregate. Runs only on the website, only if you accept analytics cookies, and never inside the mobile app. Advertising features and ad personalisation are switched off.
Sees: Pages visited, referring site, approximate location from IP, browser/device type. No client (customer) data and no account details are ever sent to Google Analytics.
Questions? Email hello@chairwarden.com.