Privacy Policy

Last updated: March 15, 2026

Introduction

Collection Natteural Inc. ("we", "us", or "our"), operating as SyncWell, is committed to protecting the privacy of our users. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our team management platform for beauty and salon businesses (the "Service").

By accessing or using SyncWell, you agree to this Privacy Policy. If you do not agree with the terms of this policy, please do not access the Service.

Information We Collect

We collect information in several ways depending on how you interact with our Service:

Account Information

When you register for an account, we collect your name, email address, and authentication credentials through our identity provider (Clerk). If you create an organization, we also collect your business name and preferred timezone.

Client Data

When business users add clients to the platform, the following client information may be collected: first and last name, email address, phone number, appointment notes, and intake form data. This data is entered by the business and is managed under their responsibility. All client personally identifiable information (names, email addresses, and phone numbers) is encrypted using AES-256-GCM before being stored in our database. No plaintext client PII is ever persisted at rest.

Appointment & Scheduling Data

We collect appointment details including date and time, service type, assigned staff member, appointment status, pricing information, staff notes, and any add-on services selected.

Employee & Team Data

For team management, we collect employee names, email addresses, employment status, availability schedules, working hours, commission rates, and payroll-related information including pay schedule frequency and deduction details.

Messaging Data

When using our messaging features (SMS via Twilio or WhatsApp via Meta), we collect message content, phone numbers (stored in hashed form where applicable), message delivery status, and conversation timestamps. Messaging is limited to appointment-related communication within defined time windows.

Payment & Billing Data

Payment processing is handled by Stripe. We store subscription status, plan details, and billing period information. We do not directly store your credit card numbers or full payment credentials. These are securely managed by Stripe.

Platform Integration Data

If you connect third-party scheduling platforms (Acuity Scheduling or Calendly), we store OAuth access tokens, refresh tokens, external account identifiers, and synchronization status to maintain your calendar integrations.

Usage & Log Data

We automatically collect certain information when you use the Service, including IP addresses, actions performed (audit logs), timestamps, and browser/device information used to access the platform.

How We Use Your Information

We use the information we collect for the following purposes:

To provide, operate, and maintain the SyncWell platform
To facilitate appointment scheduling, management, and calendar synchronization
To calculate employee commissions, deductions, and payroll summaries
To enable appointment-related messaging between staff and clients
To provide business analytics, reporting, and performance insights
To detect, prevent, and address security issues and enforce access controls
To respond to your inquiries and provide customer support
To comply with legal obligations and enforce our terms of service
To improve and personalize your experience with the Service

WhatsApp & Meta Platform Data

SyncWell integrates with the WhatsApp Business API provided by Meta Platforms, Inc. to enable appointment-related messaging between salon staff and their clients.

When using WhatsApp messaging through SyncWell:

Messages are used exclusively for appointment-related communication (confirmations, reminders, rescheduling, and follow-ups)
We do not use WhatsApp data for advertising, marketing profiling, or any purpose unrelated to the Service
We do not sell, license, or share WhatsApp message data with third parties for their own purposes
Message data is retained only as long as necessary for the appointment communication window and any applicable legal or business retention requirements
Messaging is restricted to defined time windows around appointments to protect client privacy
Our use of WhatsApp data complies with Meta Platform Terms, the WhatsApp Business Policy, and applicable data protection laws

We access only the minimum data necessary from the Meta/WhatsApp platform to provide the messaging functionality described above.

Third-Party Services

We use the following third-party service providers to operate SyncWell. Each provider has their own privacy policy governing the data they process:

Clerk:Authentication and user identity management
Stripe:Payment processing and subscription billing
Twilio:SMS messaging services
Meta Platforms (WhatsApp Business API):WhatsApp messaging services
Supabase:Database hosting and infrastructure
Acuity Scheduling:Calendar synchronization (when connected by user)
Calendly:Calendar synchronization (when connected by user)

Data Sharing & Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

With service providers who assist us in operating the platform (as listed above), bound by contractual obligations to protect your data
When required by law, regulation, legal process, or governmental request
To protect the rights, property, or safety of Collection Natteural Inc., our users, or the public
With your explicit consent or at your direction
In connection with a merger, acquisition, or sale of assets, with notice provided to affected users

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

Account data is retained until you delete your account or request deletion
Appointment and client records are retained for the duration of the business's active subscription plus a reasonable period for legal and audit purposes
Message data is retained in accordance with the messaging window policies and applicable record-keeping requirements
Audit logs are retained for security and compliance purposes
Payment records are retained as required by applicable tax and financial regulations

When data is no longer needed, it is securely deleted or anonymized.

Data Security

We implement appropriate technical and organizational measures to protect your information, including:

Row-Level Security (RLS) ensuring strict data isolation between organizations
AES-256-GCM field-level encryption of all client personally identifiable information (names, email addresses, and phone numbers) at rest. No plaintext PII is ever stored in the database. Lookups are performed via one-way HMAC-SHA256 hashes, ensuring data remains protected even in the event of unauthorized database access
Encryption of data in transit using TLS/SSL
Role-based access control (RBAC) with granular permission management
Hashing of sensitive identifiers such as phone numbers
Comprehensive audit logging of all significant actions
Secure authentication powered by industry-leading identity providers

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

Canada (PIPEDA)

Right to access your personal information held by us
Right to request correction of inaccurate information
Right to withdraw consent for certain data processing activities
Right to file a complaint with the Office of the Privacy Commissioner of Canada

European Economic Area (GDPR)

Right to access, rectify, or erase your personal data
Right to restrict or object to processing
Right to data portability
Right to withdraw consent at any time
Right to lodge a complaint with your local supervisory authority

California (CCPA/CPRA)

Right to know what personal information is collected, used, and shared
Right to request deletion of personal information
Right to opt out of the sale of personal information (we do not sell personal information)
Right to non-discrimination for exercising your privacy rights

To exercise any of these rights, please contact us at nattestyles@outlook.com. We will respond to your request within the timeframe required by applicable law.

Cookies & Tracking Technologies

SyncWell uses cookies and similar technologies for the following purposes:

Essential cookies: Required for authentication, session management, and security (managed by Clerk)
Preference cookies: To remember your settings such as theme preference and locale
Analytics: To understand how the Service is used and improve performance

You can control cookie preferences through your browser settings. Note that disabling essential cookies may prevent you from using certain features of the Service.

Children's Privacy

SyncWell is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us and we will take steps to delete such information.

International Data Transfers

SyncWell is operated from Canada. If you access the Service from outside Canada, your information may be transferred to, stored, and processed in Canada or other jurisdictions where our service providers operate. By using the Service, you consent to the transfer of your information to these jurisdictions, which may have different data protection laws than your country of residence.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Collection Natteural Inc.

Operating as SyncWell

Email: nattestyles@outlook.com