Privacy at Chairspace.

Effective October 22, 2026 Version 2026-10-22

Chairspace is operated by McAllister Labs in Ontario, Canada. This policy explains the information handled when someone visits the Chairspace site, starts a business account, uses a shop workspace, or books with a shop using Chairspace. Each shop controls its own public content, services and customer relationships. We provide the software and handle information needed to run it.

What we collect

For a business account, we handle the email submitted to request access, verification and account status, the name and login details supplied during account setup, staff roles, shop settings, service lists, schedules, website content and support correspondence. We keep records of account and security actions so that access and changes can be reviewed.

A signup link expires after one hour. While a request is pending, the system keeps the email and delivery material in protected form, plus delivery status and provider receipts needed to manage retries. After a trial is created, a keyed fingerprint of the verified email is retained to enforce one free trial per mailbox. We do not treat opening the link alone as account creation.

When a shop uses booking features, its customers may provide a name, phone number, optional email, appointment choices, service or intake answers, and feedback. The system records appointment history, price and policy snapshots, waitlist requests, communication preferences and messages needed to operate bookings. Some shop-entered notes and intake answers are private to authorized staff. A public review is displayed only through the shop's review and moderation controls.

Our servers also receive technical information such as the requested page, host, IP address, browser and device details, timestamps, session identifiers and security events. We use essential cookies or similar session storage to keep staff and customer sessions separate and protect requests. The marketing site does not currently add advertising trackers or analytics cookies.

Why we use it

We use information to verify requests and accounts, provide the shop website and booking service, deliver requested operational messages when a provider is enabled, protect accounts, prevent abuse, answer support or privacy requests, and maintain records needed for service operation, security and legal obligations. A verification email is part of an account request; requesting access does not itself subscribe anyone to promotional messages. Optional promotional communication requires its own applicable consent and unsubscribe path.

Who can see it

Authorized shop staff see information according to their role and shop. A customer can access their own appointment information after the applicable phone verification. McAllister Labs personnel with a legitimate support or security need may have controlled access. We may share only the information needed with infrastructure, email, SMS, security and other service providers that are actually enabled for the service. A shop may choose to connect a permitted Google review source; its public Google reviews stay identified as Google content and are separate from Chairspace website reviews. Opening an external service takes you to that service's own terms and privacy practices.

Providers may process information in Canada or elsewhere. Information processed outside Canada may be subject to the laws and lawful access requests of that place. We assess provider arrangements and use contractual or other safeguards appropriate to the information involved. We may also disclose information when required by law or to address a serious security or safety issue.

How long we keep it

We keep information only as long as needed for the purposes above, the shop's active service, dispute and security records, backups, and applicable legal duties. Different records have different lifecycles; we do not promise immediate removal from backups or a fixed deletion date for every record. When information is no longer needed, we delete, de-identify or securely dispose of it under an applicable retention process. A shop may need to preserve appointment records to meet its own obligations.

Your choices and requests

Shop customers can open My appointments, choose Profile, and download their data or delete their profile at that shop after a fresh phone verification. The download includes the customer's own profile, appointments, messages, feedback and communication choices; it excludes private staff notes and other customers' records. Upcoming appointments must be cancelled before deletion, and a visit in progress requires help from the shop. Deletion removes or de-identifies the active customer record and related personal content at that shop, while limited historical appointment, consent, delivery and audit records may be retained. Other shops' profiles are separate; a shared sign-in phone is retained when another shop profile still needs it. Copies in backups, already delivered messages and external services follow their own retention rules.

You can ask to access or correct personal information, withdraw an optional communication choice, or request deletion where applicable. We will verify the requester's authority before disclosing or changing records, and explain any legal or operational limit on a request. For a shop's customer record, contact the shop first if you can; you may also contact us and we will direct or assist with the request as appropriate. Account holders can use available workspace controls for their own settings and communication preferences.

Use the McAllister Labs Contact form for privacy questions or requests. Select Contact on that site and tell us that your request concerns Chairspace. Please do not include a password, verification code, or sensitive appointment detail in the first message. We will provide a secure way to verify and handle the request.

Security and changes

We use access controls, separated shop records, protected sessions, and safeguards appropriate to the information. No system can promise absolute security. We investigate suspected incidents and notify people and authorities when required. We may update this policy as the service and providers change; the effective date above identifies this version, and material changes will be communicated where required.