Privacy Policy

Toasted Tanz LLC (“Toasted,” “we,” “our,” or “us”) operates the Toasted Tanz iOS application, artist booking pages on toastedtanz.com subdomains, and related websites (collectively, the “Services”). This Privacy Policy describes how we collect, use, share, and protect information.

In this policy, Artists (or “Users”) are people who create Toasted accounts to run their spray tan business. Clients are people who book with or receive services from an Artist. We act as a controller for Artist account and platform data, and as a processor / service provider for Client data Artists collect through the Services (see our Data Processing Addendum).

Artist accounts: Name, email, phone, studio name, location/timezone, profile photo, social handles, subscription and billing identifiers, Stripe Connect account status (processed by Stripe), and settings you configure in the app.

Client data (on behalf of Artists): Name, phone number, optional email, appointment history, notes, photos the Artist uploads, payment method tokens (stored by Stripe, never as raw card numbers on Toasted servers), SMS and email message content sent through the platform, SMS consent records, and signed service-agreement snapshots.

Calendar Sync (opt-in): If an Artist enables Apple Calendar and/or Google Calendar Sync, we process calendar identifiers, OAuth tokens (Google refresh/access tokens encrypted on our servers), sync preferences, and mapping of Toasted appointments or schedule items to external calendar event IDs so we can create, update, or remove those exported events. Event titles may include Client first names and service names the Artist already stores in Toasted.

Device features (Artist-initiated): Camera (card scan via Stripe), contacts (one contact when adding a Client), photos the Artist selects, location for in-person payments, microphone for on-device dictation of notes, and push notification device tokens.

Automatically collected: Approximate device/browser type, app version, diagnostic error codes (PostHog), and—on toastedtanz.com after analytics consent—page and campaign measurement (Google Analytics / Meta Pixel). Booking pages use privacy-minimized first-party funnel events without Client PII (see Website Analytics below).

• Provide, operate, secure, and improve the Services
• Facilitate booking, CRM, inventory, payments, and Artist–Client communications
• Process Artist subscriptions and Client charges via Stripe
• Send SMS via Twilio and email via Resend only as configured and permitted (consent-gated for studio SMS)
• Export schedule data to Apple or Google Calendar when the Artist opts in
• Send transactional notifications (booking confirmations, reminders, billing)
• Detect fraud, abuse, and outages; comply with law
• Respond to support and account requests

We do not sell personal information. We do not share mobile phone numbers or SMS content with third parties for those parties’ own marketing or promotional purposes.

Calendar Sync is optional and off until an Artist turns it on in Settings. Apple Calendar export runs on the Artist’s device using Apple EventKit. Google Calendar export uses Google’s OAuth and Calendar APIs; tokens are stored encrypted and used only to list writable calendars the Artist chooses and to upsert or delete Toasted-exported events.

Toasted’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Calendar data for advertising, credit scoring, or selling to data brokers. Artists may disconnect Google at any time in Settings (and may also revoke access in their Google Account). Turning a sync filter off or disconnecting removes Toasted-managed export events where our systems can still reach the calendar.

Future “show other calendars in Toasted” (import) features, if enabled, would use calendar read access only for calendars the Artist selects, to display busy blocks—not for marketing.

Supabase — database, auth, storage (US). Privacy.

Stripe — payments and Connect. Privacy.

Twilio — SMS and phone numbers. Privacy.

Resend — transactional and marketing email we send. Privacy.

Vercel — web hosting. Privacy.

Apple — iOS, APNs, EventKit when Calendar Sync is on. Privacy.

Google — optional Analytics (consent), and Google Calendar API when the Artist connects Google. Privacy.

Meta — optional Pixel after analytics consent. Privacy.

PostHog — error monitoring (no marketing profiles / no session replay). Privacy.

Google Analytics and the Meta Pixel are off until a visitor allows analytics on toastedtanz.com. Decline means those scripts do not load. Change your choice via “Analytics Choices” in the footer.

Artist booking pages collect privacy-minimized funnel events (random in-memory session id; no Client names, phones, emails, messages, payments, IPs, or full URLs). Raw events are kept about 90 days; daily rollups while the Artist account is active—then deleted with the account.

Camera, Photos, Contacts, Location, Microphone, and Notifications are used only when the Artist initiates the related action. We do not scan the address book or photo library in the background.

Studio SMS to Clients requires documented consent (or applicable invite / YES flows). Clients may reply STOP to opt out. Message and data rates may apply. See SMS Consent for how consent is collected on booking. Artists are responsible for lawful use of messaging tools.

We share information with subprocessors listed above to operate the Services, when required by law, to protect rights and safety, or with an Artist’s direction (for example exporting events to their Google Calendar). We do not sell personal information.

Artist data is retained while the account is active.

After subscription cancellation, data is generally retained 45 days past the final paid period, then purged, except aggregated non-identifying stats and SMS consent / service-agreement archives retained up to 4 years for legal defense (TCPA and related). Instant in-app account deletion removes data immediately subject to those legal archives. Artists may request export before deletion via support@toastedtanz.com.

We use TLS in transit, access controls, and row-level security so Artists cannot read other Artists’ data. No method of transmission is perfectly secure.

Artist accounts are for people 16 or older. The Services are not directed at children under 13, and we do not knowingly collect personal information from children under 13.

If you are a California resident, you may request to know, access, correct, or delete personal information we hold about you, and to opt out of “sale” or “sharing” of personal information as those terms are defined under California law. Toasted does not sell personal information and does not share it for cross-context behavioral advertising as those terms are commonly understood. Submit requests to support@toastedtanz.com. We will not discriminate against you for exercising these rights. Clients of Artists should contact the Artist first; we will assist the Artist as processor.

We and our providers primarily process data in the United States. If you access the Services from elsewhere, you understand information may be transferred to the U.S.

If you are a Client of an Artist using Toasted, contact that Artist for most privacy requests. You may also email support@toastedtanz.com and we will help route the request.

We may update this Policy. The “Last updated” date will change when we do. Material changes may also be communicated in-app or by email where appropriate. Continued use after an update means you accept the revised Policy.

Toasted Tanz LLC
30 N Gould St Ste R
Sheridan, WY 82801
Email: support@toastedtanz.com · Billing: billing@toastedtanz.com · Privacy: hello@toastedtanz.com