Privacy Policy

Effective: October 9, 2026. This policy explains what Studio Toolbox collects, why we collect it, and what rights you have over it.

Who we are

Studio Toolbox Limited operates this website at studiotoolbox.com. The company is registered in Ontario, Canada. Our mailing address is 126C Main Street N, Markham, ON L3P 1Y1, Canada. We make booking and staff scheduling software for creative studios, and we operate booking websites for studios. Studio Toolbox Limited is the data controller for the data that this policy describes. For a privacy question or request, write to support@studiotoolbox.com.

What we collect and why

When you ask for demo sites

We collect the name of your studio, your name, your email address, your website’s address, the styles that you pick, and your answers to our questions. With your permission, we read the public pages of your website for its text and pictures, as a visitor would. We use this data to build your private demo sites and to send you a link to them.

An AI service helps us build the demo sites from your answers and your website. A person at Studio Toolbox reviews every request and checks every demo site before we send it. The AI service receives your answers and the content of your website only for this purpose. It is not trained on your text and pictures, and it keeps no memory of them from one task to the next. The provider may keep a record of each task for a limited time for safety checks. We delete our working copies when your demo sites are deleted.

When your link ends, 7 days after we send it, or at once when you ask, we delete your demo sites and our copy of the text and pictures from your website. We keep your request and your confirmation: what you sent us, and when you gave us permission to read your website. They show that we had your permission. We keep them for 2 years, then delete them. Legal basis: your consent, steps at your request before a contract, and our legitimate interest to show that we had your permission.

When you choose a booking website

When you choose one of your demo sites, we keep that demo site and the text and pictures in it until you pay. We also keep what you send us for your website, such as your logo, photos, and text, and your phone number if you give it. When you pay, we use it to build and operate your website. If you do not pay within 7 days of choosing, we delete all of it. Only your request and your confirmation stay, as described above. Legal basis: steps at your request before a contract, and performance of our contract with you.

When you subscribe

Paddle.com Market Ltd sells your subscription to you as the merchant of record. Paddle collects your payment details and your billing address. Paddle tells us your name, your email address, your country, your plan, and the status of your subscription and your payments. We use this data to set up and operate your booking website, to give you support, and to meet our tax and accounting obligations. Legal basis: performance of our contract with you, and our legal obligations.

Booking websites that we operate

When we operate a booking website for a studio, the website collects data about the customers and the staff of that studio. Examples are names, email addresses, phone numbers, bookings, and the answers to booking questions. Payments go to the payment account of the studio. The website does not store full card numbers.

For this data, the studio is the controller and we are its processor. We process the data only to operate the website, and only as the studio instructs. We do not use it for our own purposes, and we do not sell it. The privacy policy of the studio applies to its customers. If you are a customer of a studio, send your privacy request to the studio. We help the studio to answer it.

Each studio receives our Data Processing Agreement with its contract. It gives the details.

When you write to us

When you use our contact form, we collect your name, your email address, and your message. When you send feedback from inside one of our plugins, or answer the short question when you deactivate one, we receive your message and, if you give them, your name and email address, together with the version of the plugin and the address of your website. We keep each message on our website and send it to our support mailbox. We use it to answer you and to improve our software. Legal basis: our legitimate interest to answer you and to improve our software.

When you try a live demo

We collect your email address. Your name is optional. We use it to send your demo link. We also send occasional product email, because you asked us about our products. Every message identifies us, gives our mailing address, and includes an unsubscribe link. You can opt out at any time. We stop within 10 business days, as the Canadian anti-spam law requires. Legal basis: your consent or implied consent from your inquiry, and our legitimate interest to follow up.

The live demo runs a disposable copy of our software in your browser. Text that you type into a demo is sample data in a temporary environment. We delete it when the demo expires. Demos do not send real email and do not take real payments.

Cookies and analytics

We use strictly necessary cookies for login and to keep your demo open in your browser. WordPress and our demo set these cookies. On the payment page, Paddle’s checkout sets its own cookies to process your payment and to prevent fraud. For visitor statistics we use Independent Analytics. This tool runs on our own server and keeps the data in our own database. It sets no tracking cookies and sends no data to a third party.

Who we share it with

We do not sell your personal data. We share it only with the service providers that operate our business. Each provider works under a data processing agreement.

• Payments: Paddle.com Market Ltd processes your payment as the merchant of record. You enter your card details with Paddle and not with us. We never see or store your full card number.
• Our website and its email: DreamHost hosts our website. DreamHost also delivers our email, for example your demo link.
• Hosting of booking websites: OVHcloud, with servers in Quebec, Canada.
• An AI service that helps build demo sites: Anthropic (Claude), in the United States.

Some providers process data outside your country, and outside the EU. Where the law requires it, these transfers use safeguards such as Standard Contractual Clauses.

How long we keep it

We keep subscription and payment records for six years after the end of the tax year, as Canadian tax law requires. We keep the request and the confirmation for demo sites for 2 years. We delete a live demo sign-up after 180 days. We delete temporary demo environments when they expire.

For a booking website that we operate, we keep the data while the subscription is active. When the subscription ends, the studio can sign in for 30 days to download its data. After those 30 days, we delete the website and its data. Copies in our backups are deleted within 30 days after that.

Your rights

Your rights depend on where you live. Two examples are the EU GDPR and the Canadian PIPEDA. You can have the right to access, correct, export, or delete your personal data. You can also have the right to object to some processing, to restrict it, and to withdraw consent. To use any of these rights, write to support@studiotoolbox.com. We answer in the time that the law requires. You can also complain to your local data protection authority.

How we protect it

We serve the site over HTTPS. We restrict access to the systems that hold personal data. No system is fully secure. If a breach affects your personal data, we notify you and the relevant authority as the law requires.

For the booking websites that we operate, we install security updates, restrict access to the servers, and run each website under its own system user.

Changes to this policy

We post each change here and update the date above. We send an email to the studios that subscribe about a material change.