The two roles we play
For groomers — the businesses who pay for GroomSpark — we are the controller of the account data you give us directly.
For pet parents — the people who book appointments on a groomer's site — we are a processor acting on that groomer's instructions. The grooming business decides what to collect and why; we store and transmit it on their behalf. If you are a pet parent asking to see or delete your data, contact the grooming business you booked with first. If you cannot reach them, write to us and we will route it.
Each grooming business has its own separate copy of a customer record. Booking with two groomers on GroomSpark creates two independent records, and neither business can see the other's.
What we collect
From groomers
- Name, email address, and password (stored only as a hash), or a Google account identifier if you sign in with Google.
- Business name, address, phone number, hours, services and prices, staff members, and photos you upload.
- Billing identifiers from Stripe. We never see or store your card number.
- If you enable text messaging, the business details required for carrier registration.
From pet parents
- Name, email address, phone number, and — where the groomer offers mobile or in-home service — a service address.
- Pet details: name, breed, size, coat type, temperament notes, allergies, vaccination expiry and any uploaded vaccination document, and photos taken at appointments where the groomer has your permission.
- Booking history, appointment notes, and grooming instructions.
- A record of your consent to receive text messages, including the timestamp, how consent was given, and the IP address it came from. We keep this because the law requires us to be able to prove it.
- Messages you exchange with the grooming business through GroomSpark.
Automatically
- Standard web server logs — IP address, browser user agent, page requested, timestamp — held by our hosting provider for 90 days.
- Error reports when something breaks, which can include the page you were on and your IP address.
We do not buy personal data about pet parents, and we do not sell or rent personal data to anyone.
Why we use it
- To run the booking system: showing availability, taking bookings, sending confirmations and reminders.
- To take payment and issue refunds through Stripe.
- To send the transactional email and text messages a booking requires, and marketing messages only where consent was given.
- To keep accounts secure — rate limiting, fraud prevention, and audit logging of sign-ins and administrative actions.
- To meet tax, accounting, and telecoms record-keeping obligations.
Who else processes it
We use the following service providers. Each one only receives what it needs to do its job, and none of them are permitted to use the data for their own purposes.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database, file storage, sign-in | All stored account, customer, pet, and booking data |
| Vercel | Hosting | Requests in transit; access logs for 90 days |
| Stripe | Payments and subscription billing | Card details entered directly with Stripe, name, email, amounts |
| Twilio | Text messaging and phone numbers | Phone numbers and message content |
| Resend | Transactional email | Email addresses and message content |
| Optional “Sign in with Google” for groomers | Your name and email address, only if you choose it | |
| Sentry | Error reporting | Technical error context, including IP address |
| Upstash | Rate limiting | IP addresses, as short-lived counters |
| Cloudflare | Bot protection on the booking form | A challenge token; no booking content |
| Geocodio | Turning a service address into coordinates for mobile grooming | The service address only |
| Anthropic | Drafting website copy for a groomer's site | Business details only — never pet parent data |
| Plausible | Visitor counts on groomspark.com | Anonymous, cookieless page views |
Beyond these, we disclose personal data only when the law compels it, or if GroomSpark is ever acquired — in which case the acquirer inherits this policy and you would be told before anything changed.
Cookies
We use a small number of cookies, all of them necessary for the site to work. We run no advertising cookies and no cross-site trackers.
- Session cookie — keeps you signed in.
- Booking progress — remembers your place in a booking for two hours so a refresh does not lose it.
- Selected business — remembers which grooming business you were managing, if you administer more than one.
- Referral code — if you arrived from a discount link, remembers the code for 30 days so it applies at checkout.
Analytics
On groomspark.com we count page views with Plausible, which is cookieless and collects no personal data.
On groomers' own sites — the pages pet parents actually visit to book — we run no analytics at all. No advertising pixels, no session recording, no third-party trackers of any kind.
Text messages and email
Appointment confirmations and reminders are sent because you booked an appointment. Marketing messages are sent only where consent was recorded.
Reply STOP to any text to be unsubscribed immediately; reply HELP for contact details. Each grooming business has its own phone number, and opting out of one never affects another. Marketing emails carry an unsubscribe link. Message and data rates may apply.
How long we keep things
| Data | Kept for | Why |
|---|---|---|
| Customer contact details | Until erasure is requested, or 7 years after the last booking | Tax and refund windows require a real customer on each transaction |
| Pet profiles | Alongside the customer record | Only meaningful in context of their owner |
| Bookings and payment records | 7 years | Tax retention on business records |
| Proof of text-message consent | As long as the customer record exists; erased on request | Required while we are still permitted to text the number |
| Messages in the business inbox | 2 years | Conversation history, but not indefinitely |
| Sign-in and audit events | 2 years | Security investigations |
| Marketing consent and send history | 3 years | State laws vary on how long proof must be held |
| Web server access logs | 90 days | Operational troubleshooting |
Your rights, and exactly what erasure does
You can ask for a copy of your data, ask us to correct it, or ask us to erase it. Pet parents should ask the grooming business they booked with; groomers should write to us directly.
We would rather describe erasure precisely than promise more than the system delivers. When a request is carried out:
- Name, phone number, address, and notes are overwritten. The email address is replaced with a permanently unreachable placeholder. The link to any sign-in account is broken, and the stored proof of text-message consent is cleared.
- Past bookings and payment records are kept. We cannot delete them without destroying tax records we are required to hold. They survive without identifying information attached — the appointment remains, the person does not.
- Stripe keeps its own copy of payment records under its own retention rules, which we cannot override. Contact Stripe directly if you need those removed.
- Encrypted database backups still contain the earlier data until they expire, which takes about a week.
- Server logs age out on their own 90-day schedule rather than being purged individually.
Depending on where you live you may also have the right to object to certain processing, to complain to a data protection regulator, or — in California — to know what has been collected and to opt out of its sale. We do not sell personal data, so there is nothing to opt out of.
Children
GroomSpark is for businesses and their adult customers. We do not knowingly collect data from anyone under 13. If you believe a child has given us information, write to us and we will remove it.
Where data is held
Our infrastructure runs in the United States. Using GroomSpark from elsewhere means your data is transferred to and processed in the US.
Security
Every grooming business's data is isolated at the database layer, card details never touch our servers, and messaging is opt-in and revocable. The specifics are on our security page. No system is perfectly secure, and we do not claim otherwise.
Changes
If we change this policy we will update the date at the top. Material changes affecting groomers will also be emailed before they take effect.
Contact
Privacy questions and data requests: privacy@groomspark.com. Security reports: security@groomspark.com. Anything else: hello@groomspark.com.