Legal
Privacy Policy
Version 1.0 · Last updated [LAST UPDATED DATE]
1 Who we are and our role
MethodData Sync For Mindbody(the “App”) connects Mindbody and HubSpot to synchronize the records selected by a business using the App (a “Customer”). The App is operated by [FULL LEGAL ENTITY NAME], doing business as Method Data (“we,” “us,” or “our”), at [BUSINESS CONTACT ADDRESS]. You can contact us about privacy at NEXT_PUBLIC_SUPPORT_EMAIL.
For the records a Customer synchronizes, the Customer is the controller (or “business”) and we act as its processor (or “service provider”). We process those records only on the Customer’s instructions, under our Terms and Conditions and the Data Processing Addendum. We are the controller of the information we need to manage our own relationship with the Customer, such as account, billing, and support information.
This policy does not replace the privacy notices of the Customer whose records are synchronized, HubSpot, Mindbody, or Stripe. The App is a business tool. It is not used directly by a Customer’s clients, and it is not directed to children.
2 Information we process
| Category | Information |
|---|---|
| HubSpot connection | Portal ID, hub domain, granted permissions, and encrypted OAuth access and refresh tokens. |
| Mindbody connection | Site ID, encrypted API key, staff username or email, encrypted staff password, and encrypted Mindbody authentication tokens. |
| Connected records | Contact and client information, mapped custom properties, and sale, contract, appointment, visit, deal, and line item information needed for the configured sync. The specific fields depend on the records and mappings selected. |
| Webhook information | Subscription identifiers, encrypted signature keys where applicable, event identifiers, delivery metadata, and event payloads received from connected platforms. Payloads may contain personal information from the relevant records. |
| Sync configuration and records | Field mappings, identifiers linking records between platforms, sync status, errors, and run logs. |
| Billing | Stripe customer, subscription, and price identifiers; subscription status; billing period end; cancellation status; and billing email. The App may display card brand, last four digits, and expiry information received from Stripe. We do not store full card numbers or card security codes. |
| Cookies | Two strictly necessary cookies: mbs_session, a signed session cookie that keeps you signed in to the dashboard for 7 days, and mbs_oauth_state, which lasts 10 minutes and is used only while the App is being installed from HubSpot. |
| Support communications | Messages sent to our support address and the information included in them. |
| Technical and log information | We do not store IP addresses or device information in our database. IP addresses are used briefly in memory to limit request rates. Our logs contain record identifiers and error messages. Our hosting providers may keep IP addresses in their own request logs. |
Connection details are provided during setup, records and events come from the connected HubSpot and Mindbody accounts, and billing information comes through Stripe. The App uses no advertising, analytics, or tracking tools.
The App currently requires a Mindbody Site ID, API key, and staff login to connect to the site.
The App does not request HubSpot sensitive-data scopes, and our Terms and Conditions require Customers not to synchronize health or medical records, payment card numbers, bank account details, or government identification numbers. Mapped fields may still contain sensitive information if a Customer chooses to include it.
3 How we use information
We use information to:
- Authenticate and maintain the connected accounts.
- Perform the syncs and mappings selected by the Customer, display sync reports, and investigate errors.
- Manage subscriptions and payments, respond to support requests, and communicate with Customers about the service.
- Maintain security, prevent abuse, and improve service reliability.
- Meet legal obligations and establish, exercise, or defend legal claims.
We do not sell personal information or share it for cross-context behavioral advertising, and we do not use synchronized records for advertising.
Where data protection law requires a legal basis for the processing we carry out as a controller, we rely on our contract with the Customer (providing the App, billing, and support), our legitimate interests (securing, maintaining, and improving the service), and compliance with legal obligations (such as tax and accounting records).
4 How information is shared
The App exchanges information with the HubSpot and Mindbody accounts authorized by the Customer, according to the saved sync settings. We also use the providers below to operate the App, under written agreements that require them to protect the information.
| Provider | Service |
|---|---|
| Vercel | Application hosting. |
| Supabase | Application database. |
| Amazon Web Services | Queued job processing through SQS and Lambda. |
| Stripe | Subscription payments, Checkout, Customer Portal, and invoices. |
| Our email provider | Hosts our support mailbox, NEXT_PUBLIC_SUPPORT_EMAIL. |
We may also disclose information to professional advisers, where required by law or a valid government request, to protect the rights, safety, or security of us, our Customers, or others, and to a successor in a merger or sale of our business, subject to this policy.
5 Security and processing locations
Connection secrets, including OAuth tokens, API keys, staff passwords, authentication tokens, and webhook signature keys, are encrypted at rest. Information is encrypted in transit using TLS, and each Customer’s data is kept separate from other Customers’ data.
We use reasonable administrative, technical, and organizational safeguards designed to protect information held by the App, but no system is completely secure. If we become aware of unauthorized access to Customer records held by the App, we notify the affected Customer without undue delay.
The App is operated from the United States, and all of its hosting is there: Vercel in Washington, D.C., Supabase in Oregon, and AWS in Northern Virginia. Information may be accessed by our personnel in [COUNTRIES WHERE STAFF OR CONTRACTORS WITH PRODUCTION ACCESS ARE LOCATED]. Where the law requires safeguards for transferring personal information to another country, we rely on standard contractual clauses, which are included in our Data Processing Addendum.
6 How long information is retained
| Information | Retention period |
|---|---|
| Connection credentials and tokens | Kept until the Customer’s information is deleted as described below. |
| Webhook payloads | Deleted as soon as the delivery is processed. A failed delivery is kept until it succeeds or is deleted. |
| Field mappings, record identifiers, and sync logs | Kept until the Customer’s information is deleted as described below. |
| Subscription and billing records held by us | Kept while the subscription is active and afterward for the period needed for tax, accounting, and legal purposes. |
A Customer can delete all information held by the App at any time with Delete my data in Settings. This deletes it immediately, stops synchronization, and cancels the subscription at once.
Uninstalling the App stops synchronization and cancels the subscription at the end of the current period. We delete the information held by the App seven days after we detect the uninstall. Neither option deletes records already created in HubSpot or Mindbody.
We also delete information held by the App within 30 days after the Customer asks us to at NEXT_PUBLIC_SUPPORT_EMAIL, and in any case within 90 days after the subscription ends. Deleted information may remain in backups until the backup cycle completes. We may keep information longer where the law requires it or where it is needed to resolve a dispute or enforce our agreements. Information held by HubSpot, Mindbody, or Stripe is subject to their own retention practices.
7 Your choices and privacy requests
Customers can change sync settings and Mindbody credentials in Settings, delete all information held by the App with Delete my data in Settings, uninstall the App from HubSpot, and email NEXT_PUBLIC_SUPPORT_EMAIL to request export or deletion of information held by the App.
If your information belongs to a studio or another business using MethodData Sync For Mindbody, contact that business first. Where we process information on its behalf, we refer requests to that business and help it respond.
Depending on applicable law and our role, you may have rights to access, correct, delete, or receive a copy of your personal information, to restrict or object to certain processing, and to complain to a data protection authority. We do not discriminate against anyone for exercising these rights.
To make a request, email NEXT_PUBLIC_SUPPORT_EMAIL and identify the relevant business or connected account. Do not send passwords, API keys, or tokens. We may need to verify your identity before acting, and we respond within the period required by applicable law, generally within 30 to 45 days.
8 Changes and contact
We may update this policy. If we make material changes, we will notify Customers by email or in the App at least 30 days before the changes take effect.
Privacy requests: NEXT_PUBLIC_SUPPORT_EMAIL
Operator: [FULL LEGAL ENTITY NAME], doing business as Method Data
Address: [BUSINESS CONTACT ADDRESS]
Terms and Conditions: Terms and Conditions