PRIVACY POLICY

Valenbay Holdings LLC (DBA BreezeSlot / BreezeDock / BreezeCrew)

Effective Date: November 4, 2026 | Document Version: 1.2 (SRS v2.11.33 / Migrations V0–V75 & Release D)
Applies To: breezeslot.com, breezedock.com, breezecrew.com, Client Portals, and all Workspace booking pages

1. INTRODUCTION & STATUTORY PRIVACY ROLES

This Privacy Policy explains how Valenbay Holdings LLC, a Texas limited liability company operating under the assumed names BreezeSlot, BreezeDock, and BreezeCrew ("Valenbay," "we," "us," or "our"), collects, uses, retains, and safeguards personal information across our software-as-a-service (SaaS) appointment scheduling, session commerce, client portal, and practice management platform (the "Platform").

Under the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Ch. 541), and comparable United States state privacy laws, our statutory role depends on your relationship with the Platform:

1. When You Book an Appointment, Buy a Package, or Use a Client Portal with a Business Using BreezeSlot/BreezeDock (Valenbay as "Service Provider" / "Processor"):
   • Each independent business, service provider, coach, tutor, or organization operating a workspace on the Platform (a "Workspace" or "Provider") is the "Business" or "Data Controller" that determines the purposes and means of processing its customers' ("Customers" or "Consumers") personal information.
   • Valenbay Holdings LLC acts strictly as a "Service Provider" or "Processor" to that Workspace (BR-PRIV-04), processing Customer personal data solely on the Workspace's behalf to provide scheduling, reminders, waitlists, session credit ledgers, client portals, video rooms, file vaults, and payment routing.
   • Strict Per-Workspace Isolation (NFR-SEC-04): Every tenant table is isolated by PostgreSQL Row-Level Security (app.workspace_id, plus app.customer_id for signed-in Client Portal sessions). Valenbay never links, merges, or cross-references a Customer's identity across different Workspaces. We never sell Customer personal data or share it for cross-context behavioral advertising.
2. When You Create or Manage a Workspace Account (Valenbay as "Business" / "Controller"):
   • For Workspace Owners, Managers, Staff members, and Referral/Partner program participants, Valenbay acts as the independent Business / Controller for your account registration, authentication, subscription billing, and support records.

2. PERSONAL INFORMATION WE COLLECT

2.1 Information Collected from Appointment & Portal Customers (On Behalf of Workspaces)

When you book an appointment, submit an inquiry, join a waitlist, purchase a session package or membership, or sign into a Workspace's Client Portal, we collect on behalf of that Workspace:

• Contact & Identity Snapshots (FR-029): Your name, primary email address (contact_email_snapshot), US mobile phone number (contact_phone_snapshot), and local time zone (customer_time_zone_snapshot).
• Appointment, Package & Service Details: The service or package selected, price and discount snapshots, 8-character booking reference number (FR-298), date and time, appointment status, booking notes, session credit balance and ledger (FR-302–FR-305), and answers to custom intake questions (FR-317).
• BreezeDock Client Portal, Video, Messages & File Vault (FR-306–FR-315): If your Provider uses BreezeDock, we process passwordless magic-link portal sessions (7 days idle / 30 days max, D-14), 1-to-1 client-provider messages (FR-309), Private and Shared session notes (FR-314), client action items/homework (FR-315), ephemeral WebRTC video room tokens via Daily.co (FR-308, with recording strictly disabled), and files uploaded to the encrypted Cloudflare R2 File Vault (PDF, PNG, JPEG, DOCX, TXT up to 25 MB, FR-310).
• Customer-Location Address (Mobile / On-Site Services Only): If you book a service performed at your location, your street address, city, state, ZIP code, and access instructions.
• Minor / Dependent Information (Adult-Booked Only — FR-220.2, FR-220.3): If a parent or legal guardian books a service for a minor dependent, only the dependent's first name/initial (dependent_first_name, max 100 chars) and non-identifying context (dependent_metadata, max 100 chars) are collected, while all contact fields remain the adult parent/guardian's own email and phone number.
• Communication & Marketing Consent Records (FR-152, FR-298, FR-318): Your explicit, separate opt-in or opt-out (STOP / Unsubscribe) status, wording version, and timestamps for automated SMS reminders, automated WhatsApp reminders, and promotional/re-engagement emails (marketing_consent).

2.2 Payment & Billing Receipt Information (FR-250–FR-259)

• PCI DSS Level 1 Card Isolation (PCI DSS SAQ A): Payment card numbers, expiration dates, and security codes (CVV) are entered directly into Stripe Checkout (PCI DSS Level 1) and never reach or reside on Valenbay servers.
• Privacy Notice for Saved Receipt & Billing Address (FR-185, FR-258, FR-259): Your receipt email address (contact_email_snapshot) and billing address are collected solely to issue payment and refund receipts (FR-259), calculate applicable statutory taxes (via Stripe), and maintain mandatory accounting and tax audit records. Payment and refund notices (PAYMENT_RECEIPT and PAYMENT_REFUND_NOTICE) are sent by BreezeSlot/BreezeDock solely to the email address submitted with the booking. Upon a verified privacy deletion request, saved payment methods are detached in Stripe and personal contact identifiers are scrubbed from active profiles, while non-identifiable transaction amounts, timestamps, and statutory tax/receipt audit records are retained for 7 years as required by US tax law.

2.3 Information Collected from Workspace Providers

• Account & Identity Data: Name, email address, hashed password or Google/Microsoft OIDC identity link, TOTP multi-factor authentication (MFA) configuration, and role (Owner, Manager, or Staff).
• Workspace Business Profile & Stripe Connect: Business name, public slug, US phone number (+1), US business postal address (FR-212, FR-300), working hours, services, and Stripe Connect Express account identifier (acct_...).
• External Calendar Integration: If you enable one-way calendar export (Google Calendar or Microsoft Outlook), we store encrypted OAuth credentials and exported calendar event IDs solely to create, update, or redact exported appointment blocks.

3. PROHIBITED DATA CATEGORIES (NO HEALTH / HIPAA OR GOVERNMENT ID DATA)

1. No Protected Health Information (PHI / HIPAA — FR-238, D-2): The Platform is designed strictly for non-clinical scheduling, coaching, consulting, tutoring, and training. Valenbay is not a healthcare provider or "Business Associate" under HIPAA. Neither Providers nor Customers may enter, upload, or transmit medical diagnoses, clinical treatment notes, mental health therapy records, prescription records, or health insurance details in any booking note, custom field, BreezeDock session note (FR-314), intake form (FR-317), message (FR-309), or file vault upload (FR-310).
2. No Government Identification Numbers (FR-207): Collecting or entering Social Security Numbers (SSNs), Individual Taxpayer Identification Numbers (ITINs), Employer Identification Numbers (EINs), driver's license numbers, passport numbers, or state ID numbers is strictly prohibited and automatically blocked (HTTP 422).

4. AGE RESTRICTIONS (18+) & CHILDREN'S PRIVACY (COPPA COMPLIANCE)

1. 18+ Booking Requirement (FR-220.1): Every person submitting a booking, inquiry, or waitlist entry on the Platform must be at least eighteen (18) years of age and must affirmatively confirm their age (18+) at submission.
2. No Direct Collection from Children Under 13 (FR-220.2, FR-220.3): We do not knowingly collect personal information directly from children under the age of 13 (or under 18). When a Workspace offers services for minors (such as tutoring or youth lessons), the booking must be completed exclusively by the minor's parent or legal guardian, using only the parent or legal guardian's email address and mobile phone number.

5. EMAIL, SMS & WHATSAPP MESSAGING PRIVACY

1. Transactional Emails (Postmark Transactional Stream): Booking confirmations, reschedule/cancellation notices, waitlist openings, magic-link sign-in emails, and payment/refund receipts (FR-259) are sent by email to the address provided for that specific booking or account.
2. Promotional Discount & Re-Engagement Emails (Postmark Broadcast Stream & CAN-SPAM Compliance — FR-291–FR-305, FR-316, FR-318, D-11): Workspaces on eligible paid plans may send service discount invite emails or BreezeDock dormant-client re-engagement emails only to Customers who affirmatively checked a separate, unchecked marketing consent checkbox (marketing_consent table, FR-298) for that Workspace. Those emails are dispatched strictly through an isolated Postmark Broadcast Message Stream and always include the Workspace's business name, valid US physical postal address (FR-300), and a 1-click Unsubscribe link (List-Unsubscribe / List-Unsubscribe-Post headers, FR-299). Clicking Unsubscribe immediately stops future promotional emails from that Workspace while preserving transactional appointment emails.
3. Automated SMS & WhatsApp Reminders (FR-130–FR-156): Sent only if you explicitly check the separate, optional SMS or WhatsApp consent box during booking (which is never a condition of booking or purchasing any service). Promotional blasts via SMS or automated WhatsApp are strictly prohibited.
4. 1-Click WhatsApp (wa.me — FR-157) Links: Workspaces may use client-side https://wa.me/ links to initiate a manual appointment message from their own WhatsApp application (hidden if you opted out via STOP), or offer a Chat on WhatsApp button on their booking page. These links open directly in the user's WhatsApp client without automated server dispatch.
5. Opt-Out (STOP) & Help (HELP): You may opt out of automated SMS or WhatsApp messages from a Workspace at any time by replying STOP. You will receive one final confirmation message, and future reminders will fall back to transactional email. Reply HELP for the Workspace business's name and contact details.
6. Strict Non-Sharing of Mobile Opt-In Data: We never sell, rent, loan, trade, or share mobile phone numbers or SMS/WhatsApp opt-in consent data with any third parties or affiliates for marketing, promotional, or lead-generation purposes. Mobile information is shared only with our telecommunications subprocessors (Twilio and Meta) strictly as necessary to deliver your requested appointment notifications.

6. YOUR PRIVACY RIGHTS (R2 EXPORT & TWO-PHASE DELETION) & 45-DAY FULFILLMENT

Regardless of your US state of residence, we provide all Consumers with the following privacy rights for each Workspace you interact with:

1. Right to Access / Encrypted Cloudflare R2 Data Export (FR-219, FR-320, Migration V65):
   • You may request a machine-readable copy (ZIP archive containing data.json, formula-neutralized CSV files, and README.txt) of your personal data held in a Workspace, including your profile, contact records, appointments, locations, custom field and intake answers, waitlist entries, session credit entitlements and ledger, messages, vault files, session notes (D-12), action items, message delivery metadata, consent logs, and payment history. Internal security/abuse records (CustomerRiskProfile, CustomerBlockLog) and cryptographic hashes are permanently excluded.
   • Private R2 Storage & Immediate Deletion on Download (V65): When the Workspace Owner generates your export, the encrypted ZIP archive is stored in a dedicated private US Cloudflare R2 bucket (breezeslot-exports-prod). You receive an email with a single-use download link (/{slug}/privacy/download?t=<token>) requiring an explicit button click (POST). The moment you download your ZIP file, it is immediately deleted from Cloudflare R2 (and any un-downloaded archive is automatically deleted after 7 days or within 1 hour of a privacy deletion by PrivacyExportCleanupJob, backed by an 8-day R2 bucket lifecycle rule).
2. Right to Delete (Two-Phase Erasure — FR-240, FR-320): You may request the permanent erasure of your personal data from a Workspace:
   • Phase 1 (Cancel & Notify): Any future PENDING or BOOKED appointments in that Workspace are automatically canceled (cancel_reason = 'PRIVACY_DELETION'), open reschedule requests and portal sessions are closed, and a final cancellation confirmation is dispatched.
   • Phase 2 (Permanent Scrub): Your name, email snapshots, phone snapshots, notes, custom field and intake answers, session notes, messages, vault files, customer-location addresses, and exported external calendar event names are permanently erased (customer_id = NULL), and any saved Stripe payment methods are detached.
3. How to Submit a Request, Verification & 45-Day Deadline (FR-239, FR-239.1):
   • Submit your request through the Privacy Request link (/{slug}/privacy) on the Workspace's booking page or via our Support & Help Center.
   • For your security, you must verify your request by clicking a single-use verification link sent to your primary email address on record.
   • Verified requests are placed in the Workspace Owner's privacy queue and fulfilled within 45 calendar days (extendable once by +45 days with notice to you; if a statutory exemption applies, you will receive an email explaining the reason). Automated platform reminders escalate to the Workspace Owner at 15 days remaining (Day 30), 5 days remaining (Day 40), and on the final day (under 24 hours remaining). If you send a request regarding a Workspace directly to Valenbay ([email protected]), we will refer it to the responsible Workspace within 10 business days and notify you which business will respond.

7. DATA RETENTION, ANONYMIZATION & SUPPRESSION HASHES (FR-240.1, FR-320)

We enforce an automated data lifecycle and purge schedule across the Platform:

Keyed HMAC-SHA256 Suppression & Safety Hashes

When personal data is scrubbed (either upon a verified privacy deletion request or at the end of its retention period), raw email addresses and phone numbers in contact and consent tables (customer_contact, SmsConsent, WhatsAppConsent, marketing_consent) are overwritten with irreversible, one-way keyed HMAC-SHA256 cryptographic hashes (using a platform secret stored outside the database). These keyed hashes are retained strictly to:

1. Honor federal TCPA (STOP) and CAN-SPAM opt-out, unsubscribe, and bounce suppression lists so we never accidentally message an opted-out number or email; and
2. Enforce safety blocks (is_blocked = true with customer_id = NULL) under Cal. Civ. Code § 1798.105(d)(2) and Tex. Bus. & Com. Code § 541.107(a)(2) so a blocked individual cannot use a deletion request to bypass a Workspace's anti-harassment block.

8. US-ONLY DATA HOSTING, SECURITY & SUBPROCESSORS

1. United States Hosting Only: All Platform databases, application servers, and encrypted object storage buckets are hosted exclusively within United States cloud data centers.
2. Security Safeguards: We protect data using TLS 1.2+ / DTLS-SRTP encryption in transit, AES-256 encryption at rest, PostgreSQL Row-Level Security (NFR-SEC-04), rate limiting, CSV formula neutralization, and mandatory TOTP multi-factor authentication (MFA) for administrative operations (where cross-tenant operator metrics use aggregate SQL functions only and any support lookup requires a logged reason under FR-299).
3. Core Infrastructure Subprocessors: We use US-compliant subprocessors strictly to deliver the Platform:
   • Render Services, Inc. (US application hosting & managed PostgreSQL 18 database);
   • Cloudflare, Inc. (Cloudflare R2 encrypted US object storage for privacy exports, backups, and File Vault; Cloudflare Turnstile bot protection);
   • Stripe, Inc. (Stripe Connect Express customer payments, Billing subscriptions, and Stripe Tax);
   • Postmark / ActiveCampaign, LLC (separated Transactional and Broadcast email delivery streams);
   • Twilio Inc. (verified US Toll-Free SMS delivery);
   • Meta Platforms, Inc. (WhatsApp Business Cloud API);
   • Daily.co / Pluot Communications, Inc. (BreezeDock embedded WebRTC video rooms with recording disabled); and
   • Google LLC / Microsoft Corp. (optional OIDC sign-in and one-way calendar export).

9. CHANGES TO THIS PRIVACY POLICY & CONTACT INFORMATION

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated Effective Date and notified to Workspace Owners.

For privacy inquiries, please contact:

• Legal Entity: Valenbay Holdings LLC (DBA BreezeSlot / BreezeDock / BreezeCrew)
• Mailing Address: 539 W. Commerce St #8195, Dallas, TX 75208, United States
• Privacy Email: [email protected]
• Support & Privacy Portal: Support & Help Center