Shire (“we,” “us,” or “our”) operates the website myshire.co and the Shire platform (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our Service, whether as a service provider (“Provider”) or a client booking appointments (“Client”).
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.
1. Information We Collect
1.1 Information You Provide
- Provider account information:name, email address, password, business name, business URL (“slug”), phone number, location, bio, timezone, storefront copy (headline, intro, theme), services and pricing, scheduling settings, and any images you choose to upload.
- Client booking information: name, email address, US mobile phone number, selected service, appointment date and time, tip amount, and any notes. Clients must agree at checkout to receive appointment confirmations by email.
- Provider client records: when a Client books with a Provider, we store booking and contact information so the Provider can manage appointments, view client history, and run their business in the dashboard.
- Payment information: payment details are collected and processed directly by Stripe, Inc. We do not store credit card numbers on our servers. We receive limited transaction data such as payment amounts, Stripe transaction IDs, and payment status.
- Communications: when you contact us for support, we may retain the content of your correspondence.
1.2 Information Collected Automatically
- Log and usage data: IP address, browser type, operating system, referring URLs, pages viewed, and access timestamps. This data is collected by our hosting provider (Vercel) as part of standard web server operations.
- Cookies: we use essential cookies to maintain your login session and authentication state. We do not use advertising or third-party tracking cookies.
1.3 Information We Do Not Collect
We do not knowingly collect sensitive personal information such as race, religion, health data, or biometric data. We do not sell or share personal information for cross-context behavioral advertising. We do not use analytics or advertising trackers.
2. How We Use Your Information
We use personal information for the following purposes:
- Service delivery: creating and managing accounts, processing bookings, displaying provider storefronts, and facilitating payments.
- Communications: sending booking confirmation emails to Clients, and booking and cancellation emails to Providers.
- Platform operations: maintaining security, preventing fraud, enforcing our Terms of Service, and improving the Service.
- Legal compliance: complying with applicable laws, regulations, and legal processes.
3. How We Share Your Information
We do not sell your personal information. We share information only as follows:
- Between Providers and Clients: when a Client books an appointment, their name, email, and phone number are shared with the Provider to fulfill the appointment. Clients can see Provider business information displayed on storefronts.
- Stripe, Inc.: payment processing, merchant onboarding (Stripe Connect), payouts, and fraud prevention. Stripe processes payment data as an independent data controller under Stripe's Privacy Policy.
- Supabase, Inc.: database hosting and authentication services.
- Resend, Inc.: transactional email delivery (booking confirmations and provider booking and cancellation alerts).
- Twilio, Inc.: SMS delivery if we enable text reminders or alerts in the future. SMS is not currently sent.
- Cloudflare, Inc.: image storage (Cloudflare R2) if you upload images through the Service.
- Vercel, Inc.: website hosting and serverless function execution.
- Legal requirements: we may disclose information when required by law, regulation, legal process, or governmental request, or to protect rights, safety, or property.
4. SMS/Text Messaging
Booking confirmations and provider alerts are sent by email. We do not currently send SMS. If we enable texting later, we will collect consent at checkout and update this policy.
5. Data Retention
- Provider accounts: retained as long as your account is active. You may request deletion at any time.
- Client booking data: retained for a reasonable period to support appointment history, revenue reporting, and dispute resolution. Typically retained for up to 3 years after the last booking, or longer if required by law.
- Payment records: retained as required by tax, financial, and legal obligations (typically 7 years).
- Server logs: retained by our hosting provider per their standard retention policies.
6. Data Security
We implement reasonable technical and organizational measures to protect personal information, including:
- Encryption in transit (HTTPS/TLS) for all data transmission
- Passwords are hashed and never stored in plain text
- Payment data handled exclusively by PCI-DSS compliant Stripe
- Row-level security on database tables
- Environment-variable-based secrets management (never in client code)
No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
7. Your Rights
Depending on your jurisdiction (including under the CCPA/CPRA, GDPR, and similar laws), you may have the following rights:
- Access: request a copy of the personal information we hold about you.
- Correction: request correction of inaccurate information.
- Deletion: request deletion of your personal information, subject to legal retention requirements.
- Portability: request your data in a portable format.
- Opt-out of sale/sharing: we do not sell or share personal information for cross-context behavioral advertising, so there is no sale or sharing to opt out of.
- Non-discrimination: we will not discriminate against you for exercising your privacy rights.
To exercise any of these rights, contact us at the email address below. We will respond within 30 days (or sooner where required by law).
8. Children's Privacy
Provider accounts require you to be at least 18 years old. The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly.
9. International Data Transfers
The Service is hosted in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using the Service, you consent to such transfers.
10. Third-Party Links
Provider storefronts or other parts of the Service may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Your continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights:
Email: privacy@myshire.co
This policy is provided for informational purposes and does not constitute legal advice. We recommend consulting with a qualified attorney for legal compliance specific to your jurisdiction.