Your data, looked after properly

01The short version

If you read nothing else, these are the four promises behind how we handle your data.

02Where your data lives

The foundation everything else sits on.

Suddenly Sorted runs on Cloudflare’s global edge network — the same infrastructure that protects a large share of the world’s busiest websites. Your bookings, customer details and settings are stored in Cloudflare D1, a managed database that sits behind that network.

Every connection travels over an encrypted (HTTPS) link, so information moving between a customer’s phone, your dashboard and our servers can’t be read in transit.

03Every business is walled off from every other

The single most important protection — and the one that stops anyone peeking at someone else’s salon.

When you sign in, we hand your browser a signed token that quietly says “this is your business.” From that moment on, every single thing the system fetches — a booking, a customer, a setting — is filtered by your business identity, taken from that signed token.

Crucially, that identity comes from the signed token and never from anything the browser asks for. So there’s no “change the number in the web address and peek at someone else’s salon” — the request simply can’t reach data that isn’t yours.

04We never see your card numbers

The most sensitive part of payments is handled by specialists, not us.

When you pay for a plan, your card details go straight to Stripe — one of the world’s most trusted payment companies — and are handled entirely on their secure systems. We don’t store your card number, we don’t see it, and it never touches our database.

That means the part of payments that matters most is looked after by a company whose entire job is keeping card data safe.

05The AI, and the short list of who else touches your data

No hidden hands — here’s everyone in the loop.

Sally’s replies are generated by Anthropic’s Claude, a leading AI provider. When a customer chats, the messages in that conversation are sent to Anthropic to write the reply, then come straight back. Anthropic does not use your data to train its models, and we never sell it.

Beyond that, a short, named list of trusted providers helps run the service — each doing one job, nothing more:

• Cloudflare — hosting, database and the edge network your data sits on.
• Anthropic — generates Sally’s chat replies (US-based).
• Stripe — processes card payments (we never see the card number).
• Resend — sends your confirmation and reminder emails.
• Google — the map, your business listing, and (if you connect it) your calendar.

06A sign-in built to resist break-in attempts

Specific, enforced protections — not vibes.

• It slows attackers down and locks them out. Too many sign-in attempts in a short window and the account locks — so automated password-guessing simply doesn’t get anywhere.
• No timing hints. Behind the scenes we use constant-time checks for sensitive comparisons — in plain terms, we don’t leak tiny clues that could help an attacker guess a secret.
• Payment notifications can’t be faked or replayed. Messages that confirm a payment are verified and anything stale or replayed is rejected.
• Your private notes stay private. Notes you keep against a client are never exposed to the assistant or to other businesses.

07How we keep it that way

Where “we built it carefully” stops being a slogan and becomes something we can show you.

Before any change goes live, it has to pass our automated test suite — the same checks every time, so a careless mistake gets caught before it ever reaches you. We also run a thorough internal security review of our own code. The most recent one found the system well-defended with no critical or high-severity issues, and we tightened a few things further off the back of it. We keep doing this as the product grows.

08Your privacy, your control

It’s your data. We just look after it.

We’re a New Zealand business and we handle personal information in line with the NZ Privacy Act. The data we hold is there to run your bookings and help you serve your customers — nothing more.

We keep your bookings and customer details for as long as you’re a customer, so your history and reminders keep working; chat transcripts are kept so Sally can do her job and you can review conversations. You’re in control:

• Export — take your bookings and client list with you, any time.
• Delete — ask us to remove a customer’s details, or your whole account, and we’ll do it (bar anything the law requires us to keep, like tax records).
• Leave — cancel any time and your data comes with you. We’re not a marketplace; your clients are yours, not ours.

If a serious data breach ever happened, we’d tell you promptly and follow the NZ Privacy Act. The full detail of what we collect and why lives in our privacy policy.