Privacy Policy

This Privacy Policy explains how Michael Salisbury LLC, an Illinois limited liability company (“we”) collects, uses, and shares information when you use Studio Calendar (the “Service”). We aim to collect only what we need to run the Service.

We collect:

• Account information — your email address, and a display name if you provide one. We use email-based sign-in, so your email is your primary identifier.
• Content you create — spaces, bookings, booking notes, operating hours, member hour limits, invitations, and similar data you enter to use the Service.
• Information about members and guests you add — if you invite members or record bookings for guests, you provide their names and (for invitations) email addresses. You are responsible for having the right to share that information with us.
• Imported calendar data — if you use the import feature, the booking data from the file or calendar URL you provide.
• Subscription and billing data — if you subscribe to a paid plan, our payment processor (Stripe) collects your payment details directly on its own pages; we do not receive or store your card number. We store only limited billing identifiers from Stripe (such as customer and subscription identifiers, plan, status, and renewal date) and send Stripe your email and display name to create your billing account. Stripe also processes your billing address or location to calculate applicable sales tax.
• Basic technical and usage data — standard server and delivery logs generated by our hosting and email providers (for example, timestamps and error logs), and privacy-respecting first-party analytics (Vercel Analytics and Speed Insights) that measure aggregate page performance and usage. We do not run third-party advertising trackers, and we do not sell your personal information or use it for behavioral ad profiling.

We use the information to:

• provide, maintain, and improve the Service;
• authenticate you and send sign-in links and one-time codes;
• send Service-related email such as booking reminders and invitations;
• prevent abuse, debug problems, and keep the Service secure; and
• comply with legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

We use a small number of third-party providers (“subprocessors”) to run the Service. They process data only to provide their service to us:

• Vercel — Application hosting and content delivery.
• Supabase — Managed PostgreSQL database hosting.
• Resend — Transactional email delivery (sign-in links, reminders, invitations).
• Cloudflare — DNS and domain-level network services.
• Stripe — Payment processing and subscription billing.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users or the Service. If the Service is ever transferred to another operator, account data may transfer with it; we would give notice first.

We keep your information for as long as your account is active or as needed to provide the Service. When a space is deleted, its bookings, memberships, invitations, and related records are removed. Some records may persist for a limited time in backups or logs before being overwritten. You can request deletion of your account data by contacting us.

Depending on where you live, you may have rights over your personal information — such as the right to access, correct, export, or delete it, or to object to certain processing. To make a request, email us at [email protected]. We will respond as required by applicable law. Because we authenticate by email, we may need to verify control of your email address before acting on a request.

The Service is operated using infrastructure that may process and store data in countries other than where you live, including the United States. Data-protection laws in those countries may differ from those in your own. By using the Service, you understand your information may be processed in those locations.

We take reasonable measures to protect your information — for example, sign-in links and codes are time-limited and rate-limited, and sensitive tokens are stored hashed rather than in plain text. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

The Service is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will revise the “last updated” date above and, for material changes, take reasonable steps to notify you.

Questions or requests about your privacy? Email [email protected].