Legal
Privacy Policy
Last updated September 24, 2026.
What we collect
When you book an appointment through J Studio's website, we collect the name, phone number, and email address you provide, along with the service and appointment time you select. If you use the contact form, we collect whatever you include in that message. We don't collect payment information — deposits and payments, where taken, are handled in person or through a separate payment processor, not stored by this site.
How we use it
Your booking details are used to schedule, confirm, and remind you about your appointment, and to contact you if a booking needs to change. We don't sell your information or use it for advertising, and we don't share it with anyone beyond the service providers below.
Google user data
J Studio's admin area can connect to one Google account — the studio's own — so confirmed bookings appear on the studio's Google Calendar. Customers never sign in with Google, and no customer's Google account is ever accessed.
Data accessed. The connection uses the Google Calendar API's calendar.events.owned scope. We store an OAuth refresh token for the studio account, and the ID of each calendar event the site creates. The site only creates, updates, and deletes the events it made for bookings — it does not read, list, download, or store any other events, calendars, contacts, or other Google account data.
Data use. This access is used only to keep the studio's calendar in sync with the booking system: an event is added when a booking is confirmed, updated when it is rescheduled, and removed when it is cancelled. Google user data is not used for advertising, profiling, credit or lending decisions, or to develop, improve, or train AI or machine-learning models.
Data sharing. We don't sell, transfer, or share Google user data with anyone. The refresh token and event IDs are held only in our own database (hosted by Neon, see below) as needed to run this feature.
Data protection. All traffic to this site and to Google's APIs is encrypted in transit (HTTPS/TLS), and the database is encrypted at rest. The refresh token is used only by the site's server, is never sent to a browser, and is excluded from database backups. The admin area is limited to a single studio account behind password-protected sign-in.
Retention and deletion. The refresh token is kept only while the calendar is connected. Choosing “Disconnect” in the admin area revokes access with Google and deletes the stored token immediately; access can also be revoked at any time from myaccount.google.com/permissions. Event IDs are kept with the booking they belong to and are deleted when that booking is deleted. Events the site created stay on the studio's calendar, under the studio's own control, after disconnecting.
Limited Use. J Studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Where it's stored
Booking data is stored in a Postgres database hosted by Neon. Emails (booking confirmations, reminders, and responses to contact form messages) are sent through Resend. Both process data solely on our behalf, as service providers, and don't use it for their own purposes.
Analytics
We use Vercel Analytics and Speed Insights to understand how the site is used and how quickly pages load. These are privacy-friendly, cookie-free tools that don't track you individually or across other websites.
Your choices
You can ask us to see, correct, or delete the information we hold about you at any time by contacting us below. If you cancel or never complete a booking, we keep only what's needed for scheduling and studio records.
Contact
Questions about this policy or your data — reach us at jstudio.glam@gmail.com or 416-902-8998.