Privacy policy

Last updated October 17, 2026

SteadyChair is booking software for barbershops, made and run by Small Cove Media ("we"). This policy covers people who book with a shop on SteadyChair, and the shops, owners and barbers who use it. Questions go to hello@smallcovemedia.com.

What we collect when you book

• Your name, mobile number and, if you give it, your email, so the shop knows who is coming and can reach you about the booking.
• The booking itself: the shop, barber, service, time, price, and whether you came in.
• If you type your number or email and leave without booking, what you were booking and how to reach you, so the shop can send you one reminder to finish it.
• How you arrived: the link or ad that brought you to the booking page, your device type and browser, and a one-way hash of your IP address (never the address itself).
• If you accept cookies on the booking page, which steps of the booking page you reached and a recording of how you moved through it: where you tapped and scrolled, on what kind of device. Anything you type, such as your name, phone number or email, is blanked out of the recording before it leaves your device, and card details are never visible to it. If you choose only essential cookies, none of this is recorded.
• If you pay online, your payment is handled by Stripe, or by Square when the shop takes payments on its own Square account. We never see or store your full card number. A card saved to hold a booking is kept by Stripe or on the shop's Square account, never by us.

How it is used

• To make and manage your booking, and to send the confirmations and reminders you would expect by text or email. Marketing texts are only sent if you agreed to them. If you start a booking and leave without finishing it, the shop may send you one reminder to finish it: by text only if you ticked the box for that, otherwise by email. Every marketing message tells you how to stop.
• So the shop can run its business: its calendar, its client list and its own reports.
• To tell the shop which of its advertising brought you in. When a shop advertises on Facebook or Instagram, a record that a booking happened, with your phone number and email in hashed form, may be sent to that shop's own Meta account so its ads can be measured. It is never sent to any other business's account.

We do not sell personal information, and we do not use it to advertise anything of our own to you.

Who we share it with

• The shop you booked with, which is responsible for its own client relationship.
• Service providers who run parts of SteadyChair for us, under contract and only for that purpose: hosting (Vercel), our database (Neon), card payments (Stripe, or the shop's own Square account), text messages (Sendblue, or GoHighLevel when a shop texts from its own GoHighLevel number), email (Resend), booking page recordings for visitors who accept cookies (PostHog), Windsor.ai, which reads the accounts a shop chooses to connect through it, and, for shops that advertise, Meta.
• Anyone the law requires us to.

Accounts a shop or barber connects

A shop can connect its Facebook Page, Instagram account and Meta ad account, its Google Business Profile, its Google Ads account, and its Square account. A barber can connect their own Google Calendar. Connecting is always started by that person, on Facebook's, Google's or Square's own screen, and can be undone at any time with Disconnect in SteadyChair or from the Facebook, Google or Square account itself.

• Google Calendar: we read the times of the barber's events so nobody books them when they are busy, and we write each of their SteadyChair bookings into that calendar. We do not store the titles or details of their own events, only that the time is taken.
• Google Business Profile: we read which listing is the shop's, its star rating and review count, and its review link.
• Google Ads and Meta ads: we read how much was spent and how the ads performed, to show Small Cove Media which ads brought in booked clients.
• Square: we read the shop's Square locations and each card sale at the shop's location (the amount, the tip, the time, and the Square customer, card and team member on it) to put each sale on the booking it paid for. A Square customer's phone number or email is read to find which client it was and is not stored. When the shop's booking page takes a deposit or holds a card through Square, the card is saved on the shop's own Square account. Disconnect, in SteadyChair or in Square, deletes everything we read from Square.
• Facebook Page and Instagram: we read the Page and Instagram account names and follower count, and receive the leads people submit through that Page's lead forms, which are added to the shop's client list.

A shop can also connect accounts through Windsor.ai, a data service SteadyChair uses for this: Meta ads and lead forms, Google Ads, TikTok ads, Instagram, its Facebook Page, TikTok, Google Business Profile, Google Analytics, Google Search Console, and Square. The owner signs in on that platform's own screen through Windsor.ai and approves access. We read daily totals only: how many people saw, clicked, called, followed or bought, and, for ads, what was spent and how many leads came in. We do not read anyone's private messages, and we do not store the names or contact details of people who filled in a lead form through this route. Disconnect in SteadyChair removes the account from Windsor.ai and deletes those totals from SteadyChair.

The access passes Google, Meta and Square give us are encrypted before they are stored and are never shown to anyone. SteadyChair's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google, Meta or Square is used only to provide these features to the shop that connected it, is never sold, and is never used to train AI models or for advertising of our own.

How long we keep it

Booking and client records are kept for as long as the shop uses SteadyChair, because they are the shop's business records, and are deleted when the shop asks or leaves. A disconnected account's access is deleted at once. Records of what we billed a shop are kept as long as the law requires.

Your choices

• Reply STOP to any text to stop texts; use the unsubscribe link in any email.
• Ask the shop, or us at hello@smallcovemedia.com, to see, correct or delete what is held about you. Depending on where you live (for example California), you may have further rights, and we will honour them.
• To remove SteadyChair's access to your Facebook, see data deletion.

Security

Everything travels over HTTPS. Access passes are encrypted at rest, passwords are stored as one-way hashes, and each shop can only ever see its own clients.

Changes

If this policy changes in a way that matters, the date at the top changes and shops are told.

See also the terms of service.