Privacy and data retention

account42 holds a studio's customer data on the studio's behalf: the studio is the business the customer deals with, and the studio's own privacy terms apply to what its customers see. This page says what account42 itself stores, for how long, and what happens to it afterward. The policies themselves live on the company site: Privacy Policy, Terms of Service, Security Incident Response Policy. Security contact: security@account42.com.

What is stored about a customer

A customer is one person at one studio: a name, an email address and/or a phone number, their messaging preference, and the phone's carrier and line type when a text message was sent to it. Each booking carries the attendee's name, email, phone and the free-text answer to the class's question, if the class asks one. Notifications (confirmations, reminders, waitlist offers) record the address or number each message went to, and the usage ledger records that a message was sent, with its segment count and wholesale price. Web-push subscriptions record the browser endpoint the customer subscribed from. Payments and refunds record the amount, the currency, the provider and the provider's references, never a card number.

Nothing is shared between studios: a customer who books at two studios is two unrelated customer rows.

How long it is kept

Two rules, set 2026-10-16:

• Contact details are deleted 24 months after the customer's last booking. The clock starts at the later of the booking's date and the class's date; a customer who never booked ages from the day their row was created. A customer who still holds an active membership, an unexpired class bundle or a credit balance is not swept, however old their last booking.
• Payment and refund records are kept 7 years. Nothing in the sweep touches a payment, a refund, a credit entry or a usage-ledger row. (A rule for money records older than 7 years is a later decision.)

A nightly job runs the sweep at 03:30 UTC. For each customer who is due it:

• blanks the attendee name, email, phone and free-text answer on every one of their bookings, keeping the bookings, their status and their money;
• deletes their web-push subscriptions;
• replaces the recipient on their notifications older than 24 months, and the carrier on those messages' ledger rows, with the word redacted, keeping the rows and the counts;
• blanks the customer row's name, email, phone, phone lookup details and calendar-feed token, and marks it anonymized_at. The row itself stays, so payments and refunds keep their customer reference.

A booking with no customer row behind it (a walk-in who gave only a name) is blanked by the same clock. The sandbox studio and account42's own demo and test studios are exempt, so developer walks are not erased from under you. Every run writes one audit record with its counts.

A customer who returns after being swept is simply a new customer row: nothing links them to the old one.

What a studio agrees to

Every account42 sign-in and sign-up screen says, under its button: By continuing you agree to the Terms of Service and Privacy Policy. There is no checkbox; the button is the acceptance. The acceptance is recorded on the studio (when, and which version of the Terms) the first time the studio signs in through such a screen, and again whenever the Terms change. Today's version is v1 2026-10-16.

For developers

The widget and the API hold a customer's details only as described above; a key never returns another studio's data (see the API reference). Connector apps (WordPress, Wix, Shopify) hold no customer data of their own: Shopify's protected-customer-data access is requested at Level 1 only, and the order payload's customer fields are dropped before the order is recorded as a payment's settlement record.

Questions about data: support@account42.com.