Your studio, your clients, your call.

Data ownership and portability

The records you create — your classes, bookings, clients, payments, and notes — are yours. You grant Betterstill only the permissions needed to store that content and run the service for you, such as displaying it back to you and sending the messages you configure.

• Export your client, booking, and payment records from the studio dashboard.
• Use the audited client data-request flow to export or erase an individual client’s personal data on their behalf.
• Cancel any time; your data stays exportable while your account is active.

Studio separation and authorization

Each studio works inside its own protected workspace. Access checks are applied by both the application and the database, so one studio cannot access another studio’s client, booking, or revenue records.

Beneath the application, each studio’s rows are isolated at the database layer using row-level security with a transaction-local tenant context that fails closed if it is missing. The runtime database role is never able to silently disable that isolation.

Payment handling

Card details are handled by Stripe directly; Betterstill does not store your clients’ card numbers. Each client payment is created as a destination charge and settles to your connected Stripe account — Betterstill adds no transaction fee of its own, and standard Stripe processing fees apply. Stripe processes payment data under its own terms and privacy policy.

Encryption

Network traffic to Betterstill is encrypted in transit (HTTPS/TLS). Passwords are not used for staff sign-in — the staff front door is magic-link, so there is no password database to compromise. Sensitive actions (sign-in, data export, payment configuration) happen over authenticated, authorized sessions.

Account and staff access

Each staff member has their own login. Permissions are assigned per staff member for what they can see and do, so a front-desk role does not have the same access as an owner. Every sensitive action — refunds, overrides, exports — is recorded in an append-only audit trail.

Backups and recovery

The database is backed up on a regular schedule by the platform’s managed Postgres provider. Backups are operational — they exist to recover from infrastructure failure — and are not a substitute for studio-level data export. Use the export tools to keep a durable copy of your data.

Monitoring and incident response

The service is monitored for availability and abuse. If an incident affects studio data or availability, the team will assess scope, work to contain it, and notify affected studios where notice is appropriate. Suspected incidents can be reported to security@betterstill.co.

Data retention and deletion

Soft-deleted client notes are kept for 30 days before they become eligible for permanent deletion, unless a legal hold applies. Client erasure removes the client’s identifying personal data while keeping de-identified transactional, financial, and audit records that must be retained.

Subprocessors

Betterstill relies on a small set of service providers to run:

• A managed Postgres provider for the primary database.
• Stripe for payment processing.
• An email provider for the reminders and confirmations you configure.
• Object storage for media uploads (file attachments your studio chooses to store).

Each subprocessor handles data under its own terms; Betterstill shares only what is necessary to deliver the service. Text-message reminders are not shipped today — only email — so no SMS subprocessor is listed here. This list is updated when transports change.

Security contact

Security questions or suspected incidents can be reported to security@betterstill.co. For privacy questions, see our privacy summary; for service terms, see our terms of service.