Privacy Policy

Toasted (“we,” “our,” or “us”) operates the Toasted Tanz iOS application and the toastedtanz.com website. This Privacy Policy describes how we collect, use, and protect information when you use our services.

Artist accounts: Name, email address, phone number, business name, profile photo, Stripe Connect account data (processed by Stripe).

Client data (collected on behalf of artists): First name, last name, phone number, email address (optional), appointment history, payment method tokens (stored by Stripe, never on our servers).

SMS data: Message content sent through the Toasted platform, phone numbers, SMS consent records.

Usage data: App usage, device type, crash reports, and optional website analytics when a visitor allows analytics.

• To operate and provide the Toasted platform
• To facilitate appointment booking and client communication
• To process payments through Stripe
• To send SMS messages through Twilio on behalf of artists (only with client SMS consent on file)
• To send transactional notifications (booking confirmations, reminders)
• To improve and maintain the service

Supabase: database and authentication infrastructure. Data stored in Supabase’s US-based servers. See supabase.com/privacy.

Stripe: payment processing. Payment card data is handled entirely by Stripe and never stored on Toasted servers. See stripe.com/privacy.

Twilio: SMS delivery. Phone numbers and message content are transmitted through Twilio to deliver SMS messages. See twilio.com/legal/privacy.

Apple: iOS platform and optional Sign in with Apple authentication. See apple.com/legal/privacy.

Google Analytics: optional website measurement, loaded only after a visitor selects “Allow analytics.” We use it to understand page views, scrolling, outbound links, downloads, successful waitlist signups, and privacy-safe feature-board search categories. Toasted does not send names, email addresses, phone numbers, payment information, or raw feature-board search text to Google Analytics. See policies.google.com/privacy.

Meta (Facebook) Pixel: optional advertising measurement, loaded only after a visitor selects “Allow analytics.” We use it to measure page views and waitlist signups that result from our Facebook and Instagram ads. Toasted does not send names, email addresses, phone numbers, or payment information to Meta. See facebook.com/privacy/policy.

Google Analytics and the Meta (Facebook) Pixel are disabled by default. If you allow analytics, they may store a first-party identifier in your browser so visits can be measured across sessions. If you decline, neither script is loaded.

You can change your choice at any time by selecting “Analytics Choices” in the website footer. Your choice is stored in your browser and is not connected to an artist or client profile.

Artist booking pages at subdomains such as artistname.toastedtanz.com also collect privacy-minimized, first-party engagement events so the artist can understand visits, booking-funnel progress, service and product interest, completed bookings and purchases, messages, gallery activity, directions, and social-link activity. These events use a random identifier that exists only while the page is open. Toasted does not use a cookie or persistent browser identifier for this measurement.

Booking-page analytics do not include client names, phone numbers, email addresses, message content, payment details, IP addresses, complete web addresses, or full device identifiers. We retain individual booking-page events for 90 days to calculate funnels and retain daily artist-level totals while the artist account remains active. Both are deleted with the artist account.

Clients must provide explicit SMS consent before any SMS messages are sent. Consent is recorded with a timestamp. Clients may opt out at any time by replying STOP to any message. Standard message and data rates may apply.

Artist account data is retained while your account is active.

If you cancel your subscription, your account data is retained for 45 days after your final billing period ends, and is then permanently deleted, except for the limited aggregated statistics and SMS consent records described below. Before deletion, we send two reminder emails to the address on file, one 14 days before deletion and another 7 days before deletion, so you have time to export anything you need.

Client data is retained as long as the artist account is active, and is deleted along with the artist account.

You may also request deletion of your data at any time by contacting us at support@toastedtanz.com.

Artists can delete their account and all associated data instantly from Settings inside the Toasted Tanz app. This action is permanent and cannot be undone. When you delete your account, your subscription is canceled immediately and your data is removed from our systems, except for the limited aggregated statistics and SMS consent records described below.

After your account is deleted, Toasted Tanz LLC retains only aggregated, non-identifying usage statistics, such as counts and totals. This aggregated data contains no names, contact details, photos, or account identifiers, and cannot be used to identify you or your clients.

To comply with telemarketing laws such as the Telephone Consumer Protection Act (TCPA), records of text-message consent (the phone number, the consent timestamp, the consent text, the IP address recorded at the time of consent, and any opt-out date and reason) are retained for 4 years after account deletion, and are then deleted. These records are kept solely for legal compliance and are not used for any other purpose.

When a client books through an artist’s booking page, they review and sign the artist’s spray tan service agreement by typing their name. We store a snapshot of the agreement text they agreed to, the typed name, the signing timestamp, and the IP address recorded at that time. Artists can view these records in their client profiles. After an artist account is deleted, these snapshots are retained for 4 years solely for defense of legal claims, and are then deleted.

If you are a client of an artist who uses Toasted Tanz, you may request deletion of your personal information by emailing support@toastedtanz.com.

Before deleting your account, artists may request an export of their business records by emailing support@toastedtanz.com.

We use industry-standard security practices including encrypted connections (TLS), row-level security on our database, and access controls. Payment data is handled entirely by Stripe and is never stored on our infrastructure.

Toasted is not directed at children under 13. We do not knowingly collect personal information from children under 13.

You may request access to, correction of, or deletion of your personal data at any time. Contact us at support@toastedtanz.com.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy at this URL and updating the “Last updated” date.

Questions about this policy? Email us at support@toastedtanz.com.