Privacy Policy

We handle two kinds of data, and our responsibilities are not the same for each. Read this section before any other; the rest of the policy depends on it.

Account Data is information about the business using Wellth and the people who sign in to it — name, email address, business details, billing records, and how the service is used. For Account Data we are the controller. We decide why it is held, and the rights described in section 11 are exercised against us.

Client Data is information about your customers that you send us — the people who booked appointments with your business. For Client Data we are a processor, and a service provider as that term is used in the California Consumer Privacy Act. You decide what is collected, on what legal basis, and what your customers are told. We act on your instructions and for no other purpose.

This is not a disclaimer of responsibility; it is an accurate description of who can actually answer a given question. We cannot tell one of your customers why their appointment was recorded, whether they consented, or ask you to delete them on their behalf — only you hold that relationship. If one of your customers contacts us directly, we will tell them to contact you and forward the request to you without undue delay.

• Sign-in details — email address and name. We do not use passwords: you sign in with a one-time code sent to your address, or through Google or Facebook. There is no password for us to store, lose or leak.
• Business details — business name, website, timezone, currency, booking platform, and the figures you enter during setup. Held to configure the service and to produce your reporting.
• Connection credentials — refresh tokens for the advertising accounts you connect, held encrypted in a dedicated secret store, never in the application database, and never sent to your browser. They exist so we can deliver conversions on your behalf without asking you to sign in again.
• Billing records — subscription status and identifiers issued by Stripe. Card details are collected by Stripe directly and never reach our systems.
• Operational records — a log of each conversion we attempted to deliver, its outcome, and timing. These contain event identifiers and delivery status, not the underlying personal data.
• Usage analytics — which pages of our own website and application you visit, which setup steps you complete, and whether a subscription started, measured with Google Analytics. Events carry our internal account identifier, never your name or email address.

We rely on the performance of our contract with you as the basis for holding Account Data, and on our legitimate interest in securing and improving the service for operational records and usage analytics. We do not sell Account Data.

We may use your sign-in email address to tell you about Wellth itself — for example, to remind you of a setup you have not finished — and to show you Wellth's own advertisements on Meta and Google, which match a hashed form of the address against their users. We never use Client Data for this, and never for anyone's advertising but our own. To opt out of either, email privacy@trywellth.co.

You send us appointment records, either by upload or through a connection to your booking platform. A record may contain a customer's first and last name, email address, phone number, the time and value of an appointment, whether it was their first visit, and — unless you turn it off — the name of the service booked.

Some booking platforms export more than that. Where your export includes a customer's postal address, date of birth or gender, those are sent to the advertising platforms you selected as additional matching signals, hashed in the same way. They are used for nothing else: not to build a profile, not to segment an audience, and not to infer anything about the person. We include them because the advertising platforms match a conversion to a person more accurately with them than without, and a conversion that fails to match is one you paid for and cannot see.

We also send a customer reference derived from their own identifiers and your account — a value that is stable for one person at your business and deliberately different for the same person at another business we serve. Nothing we send allows one advertiser's customers to be recognised in another's.

If you would rather not send the additional fields, remove those columns from the export before uploading it. The service works without them; it matches less well.

Before a conversion leaves our systems, email addresses and phone numbers are normalised and replaced with a SHA-256 hash, as are the name, address, date of birth and gender fields where the destination accepts them hashed. The destination advertising platform receives the hash, not the address. We do this because the platform does not need the original value in order to match a conversion, and a hash limits what an interception or a misconfiguration could expose.

We process Client Data only to provide the service: to match a booking to an advertising click, to deliver the resulting conversion to the destinations you chose, and to produce your reporting. We do not use it to build profiles, we do not enrich it with data from other sources, we do not combine it with data from other customers, and we do not disclose it to anyone except the sub-processors in section 5 and the destinations you selected.

For the purposes of the California Consumer Privacy Act, we do not sell or share Client Data, we do not retain, use or disclose it outside the direct business purpose of performing the service, and we will notify you if we can no longer meet those obligations.

Wellth is built for spas, salons and clinics, and some of what those businesses record may reveal something about a person's health. This is the part of the service where your obligations are heaviest, and we want to be unambiguous about them.

Do not send us special category or sensitive personal data — data revealing health, medical conditions, treatments, diagnoses, biometric or genetic information, or anything else given elevated protection under applicable law. The service is not designed to receive it, and we do not hold ourselves out as capable of handling it lawfully.

Because a service name can itself reveal a condition, the service includes a control that strips service names from every conversion before dispatch. It is enabled by default for medical and clinical business types and can be switched on for any account. Whether to use it is your decision and your responsibility; you know what your service names say about your customers.

We are not a HIPAA business associate, we do not offer a business associate agreement, and nothing in this policy should be read as a representation that the service is suitable for protected health information. If you are a covered entity, do not send us protected health information.

The service cannot work without sending data to other companies. These are all of them, named, with what each receives. We remain responsible to you for their handling of Client Data and impose written terms on each.

We will give you notice before adding a sub-processor that handles Client Data, so that you have the opportunity to object. Meta and Google act as independent controllers of the conversion data you direct us to send them; what they do with it afterwards is governed by their own terms and their agreements with you, not by this policy.

The tag you install on your own website stores advertising click identifiers — gclid, fbclid and ttclid — in a first-party cookie, so that a booking taken days later on a different platform can be matched back to the advertisement that produced it. The tag does not read page content, form values or URLs beyond those parameters, and it does not track visitors across sites it is not installed on.

The tag runs on your website, under your domain, on visitors you brought there. Providing cookie notice and obtaining consent where consent is required is therefore your responsibility, not ours — we have no relationship with your visitors and no way to reach them. Where consent is required and not obtained, do not install the tag.

Our own website and application set a signed session cookie that keeps you signed in, which is strictly necessary to operate the service. They also set Google Analytics cookies (_ga and _ga_*) that tell repeat visits apart, so we can see where people stop during setup. You can block these in your browser or with Google's opt-out add-on without affecting the service.

An increasing share of software is operated by autonomous agents rather than by people at keyboards. That changes some assumptions this kind of document has historically made, so this section states the rules explicitly rather than leaving them to be inferred.

7.1 Anything done with your credentials is your action

Actions taken through your account, API token or connected credentials are attributed to you, whether performed by a person, a script, or an autonomous agent acting on your instructions. This includes uploading data, configuring destinations, creating advertising infrastructure, and incurring charges. If you authorise an agent to act for you, you authorise what it does. We cannot distinguish an agent you intended from one that misread its instructions, and we do not attempt to.

Where you use agents, we strongly recommend issuing them their own credentials with the narrowest access that works, so that revoking one does not require changing yours.

7.2 Do not upload content designed to manipulate automated systems

You warrant that data you submit does not contain instructions, markup or crafted text intended to influence the behaviour of an automated system that processes it — commonly called prompt injection — or to cause the service to act outside its intended function. Files arriving from booking platforms are treated as untrusted input and their contents are never executed as instructions, but you remain responsible for what you send us. We may reject, quarantine or stop processing any submission that appears crafted rather than exported, and we may suspend an account that repeatedly sends such content.

7.3 We do not train models on your data

We do not use Client Data to train, fine-tune or evaluate machine learning models, and we do not permit our sub-processors to do so with data we send them for processing. We do not use Account Data to train models that would be made available to anyone else. Aggregate operational statistics that cannot be attributed to any business or individual — total conversions delivered, error rates — may be used to improve the service.

7.4 You may not use the service to train or extract

You may not use the service, its outputs, its interface or its documentation to train a machine learning model, to build a competing product, or to systematically extract data by automated means beyond the documented interfaces. We expressly reserve all rights in respect of text and data mining, including the reservation permitted under Article 4(3) of Directive (EU) 2019/790, and this reservation applies whether encountered by a person or an automated crawler.

7.5 Automated processing, and what it does not decide

The service makes automated determinations in the ordinary course: whether a booking matches an advertising click, which events to send, how to value a conversion. These decisions concern advertising measurement. They do not evaluate, score, rank or profile individuals, and they produce no legal effect and no similarly significant effect on any person. Nothing in the service is designed to make or support a decision about an individual's access to credit, employment, housing, insurance, healthcare or any other consequential outcome, and it must not be used for those purposes.

7.6 Reporting is measurement, not fact

Figures we report are derived from data supplied by you and by advertising platforms that restate their own numbers over time. Advertising platforms attribute the same booking to themselves simultaneously; totals will disagree with each other and with your books. Our reporting is provided to inform your judgement and is not a representation of accuracy, an audited figure, or a basis for a decision you would not otherwise be willing to make.

7.7 An agent cannot consent for a person

Where the law requires consent from an individual, that consent must come from the individual. Acceptance by an automated agent, an assistant acting for a business, or any party other than the data subject does not create a lawful basis for processing their data, and submitting data on that footing is a breach of your obligations under section 8.

By sending us Client Data you warrant, on a continuing basis, that:

• you have a lawful basis for the processing you instruct us to perform, including disclosure to the advertising platforms you selected;
• you have given your customers whatever notice the law requires, and obtained whatever consent the law requires, including for the advertising use of their data;
• you have the right to install the website tag on the sites where you install it, and have addressed cookie consent where it applies;
• the data you send contains no special category or sensitive personal data, as described in section 4;
• you comply with the policies of each advertising platform you connect, including their rules on restricted categories and on the data that may be sent through their business tools;
• the data you send is an export from your systems and not content crafted to manipulate ours, as described in section 7.2.

Your advertising content, targeting and claims are entirely your own. We have no visibility of them and no ability to correct them.

We hold credentials for your advertising accounts, which makes us a worthwhile target, and we describe our measures plainly rather than in reassuring generalities.

• We hold no passwords at all. Sign-in codes are stored only as SHA-256 hashes, expire in ten minutes, and are destroyed on first use or after five wrong attempts.
• Advertising credentials are held in an encrypted secret store, separate from the application database, and are never transmitted to a browser.
• Customer identifiers are hashed before a conversion is dispatched, so the destination and any intermediary receive a hash rather than an address.
• Every conversion is signed, and each account's conversions are delivered to a container belonging only to that account.
• Signing out everywhere is immediate: sessions are bound to a per-account value we can rotate, and rotating it ends every existing session at once.
• All traffic is served over TLS.

We hold no third-party security certification at present and do not claim one. If you require one as a condition of purchase, tell us before you subscribe.

If you believe you have found a vulnerability, write to security@trywellth.co. We will not pursue legal action against good-faith research that respects the privacy of others and does not degrade the service.

Where we are required to notify a personal data breach, we will notify you without undue delay after becoming aware of one affecting your Client Data, with the information you need to meet your own notification duties. Notifying the individuals affected is your decision and your obligation, because only you can reach them.

Client Data is retained while your subscription is active, because reporting compares periods and a deleted history is a broken comparison. On termination we delete Client Data within 30 days, except where we are required to retain it by law.

Account Data is retained while your account exists and for as long afterwards as we need it for tax, accounting and dispute purposes. Operational delivery logs, which contain event identifiers rather than personal data, are retained for 24 months.

You may ask us to delete Client Data at any time, including a specific individual, and we will do so within 30 days. We cannot delete data that has already been delivered to an advertising platform — that platform holds it as an independent controller, and the request must be made to them.

If you hold an account with us, you may ask us to give you a copy of your Account Data, correct it, delete it, or restrict what we do with it. Write to privacy@trywellth.co. We will respond within the period the applicable law allows and will not charge you for a first request or treat you differently for making one.

If you are an individual who booked an appointment with a business that uses Wellth, your rights are exercised against that business, not against us. We do not hold the relationship, cannot verify your identity, and cannot tell you what you were told when you booked. Contact the business directly. If you contact us, we will pass your request to them and tell you that we have.

Depending on where you live you may also have the right to complain to a data protection authority, and to withdraw a consent you gave — though where consent was given to a business using Wellth, it is withdrawn with them.

We and all of our sub-processors operate in the United States, and data you send us is processed there. If you are in the United Kingdom, the European Economic Area or Switzerland, transferring personal data to us involves an international transfer, and our data processing agreement includes the Standard Contractual Clauses and the UK Addendum as the mechanism for it. Ask us for the agreement before you subscribe if you need to review it first.

The service is for businesses and is not directed at children. Do not send us data about anyone under 16. If we learn that we hold such data, we will delete it and tell you.

We will update this policy when the service changes. When a change materially reduces your rights or materially expands what we do with data, we will tell account holders by email at least 30 days before it takes effect, and the version and date at the top of this page will change. Continuing to use the service after that date is acceptance of the revised policy. We will keep previous versions available on request.

JJC Creative LLC, trading as Wellth
110 Channel St #629, San Francisco, CA 94158, United States
privacy@trywellth.co

This policy is governed by the law of California, United States, without prejudice to any mandatory protections available to you where you live.

Warranties, limitations of liability and indemnities are not here — they belong in commercial terms, and a liability cap inside a privacy notice is often unenforceable. They are in the Terms of Service. Our processor obligations, security measures and sub-processor list in full are in the Data Processing Agreement.