Privacy & Security
Your clients trust you with their information. You can trust us to protect it.
From encrypted intake forms and private treatment photos to secure payments and account protection, SpaSphere puts your clients' privacy first. On every plan, including free.
SpaSphere Forms is free, with the same protections as SpaSphere Pro.
On every plan
Security isn't a premium feature
SpaSphere Forms is free, and it runs on exactly the same platform as SpaSphere Pro. Your clients get the same protection whether you pay nothing or everything.
- Encrypted while it travels and while it's stored
- Private intake forms, signatures and photos
- File links that expire within 15 minutes
- Passkeys and two-step verification
- Your business walled off from every other
- A 30-day log of who opened which file
Your client data
Your clients' information stays protected
Intake answers, skin histories, signatures and before-and-after photos are some of the most personal things a client shares. Here's how we keep them that way.
Stored in the United States
Your clients' records live in Amazon Web Services data centers in the US, and we back them up automatically every day.
Encrypted, everywhere
Everything is encrypted on the way between your device and SpaSphere, and again where it's stored. A stolen disk would be unreadable.
Private files, never public links
Intake answers, signed consents and treatment photos have no permanent web address that could be shared or found.
Links that expire in 15 minutes
Each time your team opens a file, SpaSphere makes a fresh link that stops working within 15 minutes. A forwarded or copied link soon goes dead, and seeing the file again means signing in.
Walled off from every other spa
Every time someone opens a page, we check which business they belong to and show only that business's information. Another spa can never see your clients.
Card numbers never reach us
With SpaSphere Pro payments, card numbers go straight to Stripe, which meets PCI DSS Level 1. We keep only what you need to recognize a card, like Visa ending in 4242.
Your account
You're in control
Decide who gets in, see where your account is signed in, and take your data with you whenever you like.
Passkeys and two-step sign-in
Sign in with your face or fingerprint, or add a 6-digit code from an authenticator app on top of your password.
Every device, at a glance
See every computer and phone signed in to your account, and sign out a lost phone or an old front desk computer in one click.
Roles for your team
Each person signs in with their own account and gets a role. Providers work with your clients but never see your revenue. Roles are checked on our side, not just on the screen.
A log of who opened what
Owners can download a 30-day activity log showing who on the team opened or downloaded which client files.
Your data, ready to take
Export your clients, appointments, services, notes, SOAP notes and more as spreadsheets whenever you like.
Delete what you choose
Owners and managers can permanently delete a client's record. Leaving altogether? We'll delete your whole account on request.
AI
AI with privacy built in
SpaSphere uses AI to save you time. Your clients' identities aren't part of the deal.
Free forms stay out of AI
On SpaSphere Forms, the forms your clients fill out and the photos they upload are never sent to AI.
Names stay with us
When SpaSphere Pro's AI helps you, like the business assistant or skin assessment reports, we replace client names, emails, phone numbers and birthdays with placeholders before anything is sent, then put them back on our side.
Only what the job needs
The AI sees what it needs to help, like skin concerns or how long since a last visit, and nothing more. It runs through a trusted AI partner under a business agreement.
Never used for training
Information sent for AI features is used only to give you the answer. It's never used to train AI models.
Your client list is yours
We don't sell it, rent it or trade it, and we never will. We don't give your clients' information to other companies for their own use.
Our support team opens your account only when you ask for help. Only authorized members of our team can, and every access is documented.
Questions estheticians ask us
Can another spa see my client records?
No. Every business on SpaSphere is kept completely separate. Each time someone opens a page, SpaSphere checks which business they belong to and shows only that business's information.
Who can see my clients' private treatment photos?
Only people on your team who work with clients, signed in to your account. Photos have no public web address, and each link SpaSphere makes expires within 15 minutes. Owners can download a 30-day log of who opened which file. Our support team opens your account only when you ask for help, and every access is documented.
Are my clients' card numbers stored?
No. Card numbers go straight to Stripe and never touch SpaSphere's servers. We keep only the card brand and last 4 digits so you can recognize a saved card.
Does AI train on my client information?
No. Information sent for AI features is used only to give you the answer, and it's never used to train AI models. On SpaSphere Forms, client submissions and uploaded photos are never sent to AI at all.
Do you sell or share my client list?
No, and we never will. We don't sell, rent or trade your client list, and we don't give your clients' information to other companies for their own use. Partners like Stripe only get what they need to do their one job.
What happens if I leave SpaSphere?
Export your data any time as spreadsheets. If you cancel, we keep your account for up to 3 months in case you come back. If you'd rather it be gone, request deletion on our Delete Your Account page and we permanently delete your business data, client records and appointments within 5 business days.
Is the free plan as secure as the paid version?
Yes. SpaSphere Forms and SpaSphere Pro run on the same platform with the same protections: encryption, private files, expiring links, passkeys and two-step verification, and your business walled off from every other.
Where is my data stored?
In Amazon Web Services data centers in the United States, encrypted while it travels and while it's stored.
Is SpaSphere HIPAA compliant?
SpaSphere's standard plans don't include a Business Associate Agreement (BAA). If your practice is a HIPAA covered entity and needs one, email support@spasphere.ai and we'll talk it through.
Want every detail? Read how we protect your business and your clients in our help center, and our Privacy Policy.
Give your clients forms they can trust
Start with SpaSphere Forms. Free, no card needed, and protected like everything else in SpaSphere.