Privacy Policy

1. Who we are

HotSeat (“HotSeat”, “we”, “our”, or “us”) is the platform available at hotseatbooking.ca and its industry subdomains, operated by HOTSEAT BOOKING INC., 475 Ellerslie Ave North York ON M2R 1C3 Canada (Ontario, Canada). We provide appointment booking and business management software for service businesses across North America.

We are the “business” responsible for personal information handled through the platform. Our Privacy Officer can be reached at info@hotseatbooking.ca for any access, correction, or privacy request.

2. Information we collect

Business accounts (shop owners): When you sign up, we collect your name, email address, business name, business type, phone number, and physical address. We store this information to create and manage your HotSeat account and booking page.

Promotions: If an Owner claims a promotion, such as the student offer described in section 14 of our Terms of Service, we keep the school and program they enter and the date they agreed to the promotion's terms, for our own records. We do not use the school and program to verify anyone, and only HotSeat staff can see it.

Customer data: When a customer books an appointment through your HotSeat booking page, we collect their name, email address, and phone number. The email address is required so we can send the booking confirmation, the appointment reminder, and the links the customer uses to cancel or reschedule; a shop entering a walk-in or phone booking on its own dashboard may record a customer without one. We do not require customers to create accounts — booking is available as a guest. This data is stored at the location level and is accessible only to the shop that collected it.

Intake answers: A shop can ask you a few questions in connection with your appointment — for example what you would like done, or a preference it should know before you arrive. We store your answers alongside that appointment so the shop can prepare for your visit. The shop writes its own questions; our Terms of Service (section 4) prohibit shops from asking for health, medical, or other sensitive personal information through these questions.

Signature evidence: Where a shop's questions include a consent statement you agree to and sign, we also record the IP address and browser user agent you submitted it from, as evidence of that agreement. We record these two details only for a set of questions that contains a consent statement — never for ordinary questions.

Usage data: We collect standard server logs including IP addresses, browser type, pages visited, and timestamps to operate and improve the service.

3. How we use your information

• To create and manage your HotSeat account and business profile
• To enable appointment booking and send email confirmations and reminders, plus SMS reminders where a customer has opted in
• To display your booking page to your customers
• To send transactional emails related to your account
• To run a promotion an Owner has claimed, and to keep our own record of it
• To share a shop's published content on our own social media accounts, only where its Owner agreed to that under a promotion (section 4)
• To improve the platform through aggregate, anonymised analytics

4. Data sharing

We do not sell your personal information. Apart from the sharing an Owner agrees to under a promotion (described at the end of this section), we share data only with the following categories of service providers, strictly to operate the platform:

• Supabase — database and authentication infrastructure (shop accounts, customer records, and appointments)
• Resend — transactional email delivery (names, email addresses, and appointment details)
• Twilio — text-message delivery for shops that turn on SMS reminders (customer phone numbers and appointment details)
• Vercel — application hosting, plus usage analytics once you consent to them (server logs, IP addresses, and page-view telemetry)
• Google — Google Places address autocomplete, which runs in your browser and contacts Google directly (the address text you type and your IP address)
• Stripe — subscription billing and payment processing for shop owners (billing contact details, card and payment information, and subscription status — Stripe, not HotSeat, stores and processes card numbers directly)

All sub-processors are bound by data processing agreements and handle data only as instructed. We will update this list before engaging any new sub-processor.

Where your data is stored. Our sub-processors operate outside Canada, including in the United States, so personal information handled through HotSeat — including appointment records and any intake answers a customer gives a shop — is stored and processed there. While it is outside Canada it is subject to the laws of that country, and a foreign court or government agency may be able to compel access to it under those laws. We rely on contractual protections with each sub-processor to keep it protected to a comparable standard, but we cannot exempt it from foreign legal process. If you would rather your information were not handled this way, do not use the Service.

Promotions and our social media accounts. If an Owner claims a promotion such as the student offer and agrees to its sharing licence (section 14 of our Terms of Service), we may share the shop's published profile information, images, services and booking link on HotSeat's own LinkedIn, Instagram and Facebook accounts. That is content the shop has already published on HotSeat, shared with the Owner's consent. We never share customer data this way: customer names, reviews and appointments are not part of it. The Owner can ask us to stop future posts at any time by emailing info@hotseatbooking.ca.

5. Data retention

We keep personal information for as long as the account it belongs to exists, including after that account stops being used. No personal information is deleted or anonymised automatically; deletion happens when someone asks for it, as described below.

• Active shops: retained while the shop uses HotSeat.
• Shops whose subscription has ended: kept unchanged, so the shop can pick up where it left off if it subscribes again.
• Closed shops: when a shop is closed, its booking page is taken down and its team can no longer reach it. Its records, including customer details, appointment history and intake answers, are kept.
• What we keep even after a deletion request: our audit log of account activity; records of people who replied STOP to our text messages, so we never text them again; billing records held by our payment processor under its own terms; the record that a shop claimed a promotion and when it agreed to its terms (we remove the school and program it gave us, but keep that the free year was used, so it cannot be claimed twice); and copies in our service providers' backups until those backups expire.

Deletion requests. You can ask us to correct, anonymise or delete your personal information by emailing info@hotseatbooking.ca. A shop's Owner can ask the same for customer records the shop collected. We will confirm who you are and reply within 30 days, telling you what we changed and what we kept, and why.

6. Your rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion or anonymisation of your personal information (section 5 lists what we keep regardless)
• Request a copy of the personal information you gave us. A shop's Owner can also use “Request my data” in Settings to receive the shop's customer list, booking history and revenue summary as CSV files.
• Withdraw consent for optional processing at any time — for example by unsubscribing from marketing email, replying STOP to a text message, changing your cookie choice, or asking us to stop sharing your shop on our social media accounts

To exercise any of these rights, email us at info@hotseatbooking.ca. We will respond within 30 days.

7. Québec residents (Law 25)

If you are in Québec, Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) gives you additional protections, and we commit to them across the platform:

• Privacy Officer. The person responsible for protection of personal information is reachable at info@hotseatbooking.ca.
• Confidentiality incidents. If a breach poses a risk of serious injury, we will notify the Commission d'accès à l'information and the affected individuals promptly, and keep a register of incidents as required.
• Retention and deletion. Section 5 explains how long we keep personal information and how to ask us to delete or anonymise it.
• Portability. You may ask to receive the computerised personal information you provided in a structured, commonly used technical format.

8. Cookies

These are all the cookies HotSeat sets, each on HotSeat's own domain, with how long each one lasts. Every one but the campaign attribution cookie is needed for the site to work. We do not use third-party advertising cookies or tracking pixels.

• Sign-in session (sb-…, up to 400 days): the cookies that keep you signed in. They last up to 400 days unless you untick “Keep me signed in on this device” when you sign in, in which case they end when you close your browser.
• Sign-in choice (hs_persist, until you close your browser): set only when you untick “Keep me signed in on this device”, so that your session ends when the browser closes.
• Password link (hs_recovery, 15 minutes): if you use an emailed link to set or reset your password, a cookie that lasts 15 minutes and lets only the person who opened the link set a new password. It is sent only to the password page.
• Cookie choice (hs_cookie_consent, 1 year): remembers whether you accepted or declined analytics.
• Campaign attribution (hs_attribution, 90 days): not needed for the site to work, and set whether or not you accept analytics. If you arrive through a link that carries campaign tags (“utm_” parameters), we store those tags and the referring page in a cookie for up to 90 days, so we can tell which campaign brought a business to HotSeat. The referring page is the address of the page that linked you to us. If you create a business account while it is present, we save those details with the account.
• Staff setup session (hs_build_session, 2 hours): set only in the browser of a HotSeat staff member who is setting up a shop on its owner's behalf.

We load analytics, which measure page views and site speed in aggregate and do not identify individual users, only if you agree in the cookie banner. If you can reach your HotSeat dashboard, you can change that choice at any time in Settings > Account; otherwise, clear this site's cookies and stored data in your browser and we will ask again.

9. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Authentication is managed through Supabase Auth, and your signed-in session is kept in same-site cookies scoped to HotSeat's own domain. We conduct regular reviews of our security practices. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but commit to industry-standard protections.

10. Children's privacy

HotSeat accounts are for businesses. You must be at least 18 to create one, and we do not knowingly collect personal information from children for our own purposes.

A shop's own customers are a separate matter: a shop may serve customers of any age, and an appointment for a minor should be made by a parent or guardian. Some shops ask a customer to confirm they are 18 or older before a particular service. That confirmation is the customer's own statement to the shop — HotSeat does not verify anyone's identity or age, and the shop remains responsible for checking identification in person where its own rules or the law require it.

11. Changes to this policy

We may update this Privacy Policy from time to time. It is published and revised together with our Terms of Service. We will notify each shop's Owners and Admins of material changes by email at least 14 days before they take effect, and the date at the top of this page shows when the current version takes effect. Continued use of HotSeat after the effective date constitutes acceptance of the updated policy. We will not use personal information for a new purpose without any consent the law requires.

12. Contact

Questions about this policy? Email us at info@hotseatbooking.ca.