Security

Effective October 26, 2026

This page explains how Booktender keeps each shop’s information to the right people, how the AI phone agent is kept in check, and which service providers handle information for us.

Who can see what

Each shop’s data stays with that shop. Row-level security in the database checks every read and write against the person’s shop and role, on every table that holds a shop’s data. The database enforces it, so hiding a screen is never the only lock.
Roles limit what people see. Owners see everything in their shop, including billing and pay. Managers run their locations. The front desk books for everyone and checks clients in and out, with no reports or pay. Barbers see their own calendar and clients.
Shop screens. A front-desk computer or tablet can run as a shop screen, signed in as its own account rather than as the owner. The database gives it limited rights: the location’s calendar, bookings, check-in and checkout, but no money totals, pay, settings, team, billing or client exports.
Support access only when an owner grants it. To run the service, our staff can see a shop’s account details: its locations, team and subscription. They never see its clients’ contact details or call transcripts unless an owner opens support access, for between 1 hour and 7 days. The owner can close it early, and every action our staff take on a shop is logged.
An audit trail. Changes are recorded with who made them and when, in an append-only audit trail: entries can’t be changed or deleted.

The AI phone agent’s guardrails

It never acts on caller ID alone. Caller ID can be faked, so the agent uses the number only to ask, by first name, whether it’s a returning client. To read out, move or cancel a booking, the caller must also give the booking reference or the date of their last visit, with three tries per call.
It writes only after a clear yes. Before the agent books, moves or cancels anything, our software, not the AI, checks that the caller has answered since the change was put to them.
Each action happens once. Every booking action is tied to its own request, so a repeated request can’t book, move or cancel twice.
Times and prices come from the shop’s calendar and menu. The agent can hold only a time the booking system offered, and it quotes only the shop’s own prices.
It stays in its shop. Each call is bound to one location. The AI can’t choose another shop or location, and it never sees database IDs.
No audio is stored. Booktender saves no recordings of calls.

Payments

Shops’ subscriptions are billed through Stripe. Owners enter card details on Stripe’s own pages, and Stripe holds them: card details never touch our servers. We accept billing updates from Stripe only when their signature checks out. Booktender doesn’t process clients’ card payments; shops take those on their own terminals.

Texts and emails

Every text names the shop and honours STOP. Opt-outs are kept in a log that can only be added to, so a STOP is never lost. The logs of our message sender hide phone numbers and email addresses.

Service providers

These service providers handle information for Booktender.

Provider	What we use it for	Information it handles	Where
Supabase	Database, sign-in, file storage and background jobs	Everything a shop keeps in Booktender: accounts, the team, schedules, clients, bookings, sales, texts, call records and client photos	Region chosen at launch; listed here before any shop's data is stored
OpenAI	The AI phone agent's voice model, transcription of what callers say, and call summaries	The caller's voice while a call runs, what both sides say, and the shop details the agent needs to answer (menu, hours, open times, the caller's bookings)	United States
Telnyx	Shop phone numbers, calls and texts, when shop lines go live	Phone numbers, calls as they pass through the phone network, and the words of texts sent and received	Region chosen at launch; listed here before any shop's data is stored
Resend	Email delivery, and the list of people who signed up for Booktender news	Email addresses and the emails sent, such as booking confirmations, reminders and Booktender news	Region chosen at launch; listed here before any shop's data is stored
Stripe	Subscription billing and invoices for shops	The owner's billing details and payment card (held by Stripe), the shop's plan and its invoices	Region chosen at launch; listed here before any shop's data is stored
Hosting provider	Runs the website and the call service that connects the AI phone agent to the shop's calendar	Requests to the website and, while a call runs, what both sides say and the agent's booking requests	Region chosen at launch; listed here before any shop's data is stored

Where data is stored

OpenAI processes calls in the United States. For every other provider, the region is chosen at launch and listed above before any shop’s data is stored. Information processed outside Canada may be accessible to that country’s courts, law enforcement and national security authorities; our Privacy Policy explains more.

What we don’t do

We don’t sell personal information.
We don’t use shops’ data to train AI models. OpenAI explains how it handles data sent to its API in its API data controls guide.
We don’t put analytics, advertising pixels or other trackers on this website.
We don’t send marketing texts or emails to shops’ clients.
We don’t identify callers by their voice.

If something goes wrong

If personal information is lost, or accessed or disclosed without authorization, we’ll tell the affected shops promptly so they can tell their clients, and we’ll report it to the Office of the Information and Privacy Commissioner of Alberta when the law requires.

Reporting a vulnerability

If you find a security problem in Booktender, email us at hello@booktender.app with what you found and how to reproduce it. Please don’t access, change or delete more data than you need to show the problem, don’t disrupt the service, and give us time to fix it before telling anyone else. We reply to every report.