Privacy policy

This policy explains what Brow Haus & Co. collects when you visit this website or book an appointment, why we collect it, who handles it for us, and the choices you have. Canada’s federal privacy law for businesses, the Personal Information Protection and Electronic Documents Act (PIPEDA), applies to all of it.

What we collect when you book

Your name, email address and phone number, and a note if you choose to add one. We keep them with the service, date and time you choose and your browser’s time zone.

When a deposit is due, you enter your card in a payment field run by Square. Your card number goes straight to Square and never reaches our website. We receive a record of the payment: its amount, its status and a link to Square’s receipt.

What the website counts

We count visits to see how the site is used. That covers the pages you open and for how long, the buttons you tap (such as Book now, our phone number or Instagram), and whether you opened, started or sent the booking form. We also record the site that sent you here, any campaign tags in the link you followed (including the click code Google adds when you arrive from one of its ads), your type of device, operating system and browser (and whether you are inside an app such as Instagram), and the country, province and city your connection comes from.

We don’t store your IP address, and the count uses no cookies. To tell visitors apart on a given day it uses a code derived from your connection that resets every night at midnight, so one day’s visits can’t be linked to the next. If your browser sends a Global Privacy Control signal, your visit isn’t counted at all.

How we use it

• To book, confirm and remind you of your appointment, and to let you move or cancel it.
• To take and, where our policy allows, refund your deposit.
• To contact you about your appointment.
• To keep automated bots from booking through the site.
• To understand how the site is used and improve it.

We use your details only for these purposes. We don’t sell them, share them with advertisers or use them to send you marketing.

Your consent

By booking, you agree to us using your details as this policy describes. You can withdraw that consent at any time by contacting us, subject to anything the law requires us to keep. Without your contact details we can’t hold or confirm an appointment for you.

The messages you’ll receive

When you book, we email a confirmation with a link to move or cancel your appointment. The link works until 30 days after the appointment. You’ll also receive a reminder before your appointment and a notice whenever it is moved or cancelled. Replying to any of these emails reaches us directly. We receive a copy of each booking at our own email address.

Our appointments are also kept on our calendar in Square, so Square may email or text you about your appointment as well.

Who else handles it

These companies run our website, payments and bookings for us, each under its own privacy policy:

• Square processes deposits and keeps our appointment calendar, which holds your name, email, phone number, note and appointment.
• Supabase stores our bookings and visit counts on servers in Oregon, in the United States.
• Resend sends our booking emails.
• Cloudflare hosts the website, and its Turnstile check on the booking form confirms that a person is booking.
• Google or Microsoft, only if we connect a Google or Outlook calendar to our bookings. Each booking then goes on that calendar with your name, email, phone number and note, and the calendar sends you an invitation.

The developer who builds and maintains our website can also access these services to keep them working. Some of these companies store information in the United States or elsewhere, so your information may be kept outside Canada and be subject to the laws of those countries. Otherwise we share it only where the law requires.

What stays in your browser

While you book, your browser keeps what you’ve typed until you close the tab, so reloading the page doesn’t lose it. Once you’ve booked, it keeps a code for each appointment so the booking window can show it to you again if you want to move or cancel. Our visit counter also keeps a random code for the open tab, so the pages of one visit stay together, and it’s gone when you close the tab. Clearing this site’s data in your browser removes all of them.

Square’s payment field and Cloudflare’s Turnstile check may collect information about your device to prevent fraud and abuse, as their own policies describe.

How long we keep it

We keep your booking details for as long as we need them to provide our services and to keep the business records the law requires, such as for tax purposes. After that we delete them.

How we protect it

Information travels over encrypted connections, and our booking records sit behind a password-protected sign-in. The link in your email is a private code: our system keeps only a scrambled copy of it, so it can’t be read back out. If a breach of our safeguards created a real risk of significant harm to you, we would notify you and the Office of the Privacy Commissioner of Canada, as the law requires.

Your rights

You can ask to see the personal information we hold about you, to correct it, or to have it deleted unless the law requires us to keep it. Contact us using the details below and we’ll respond within 30 days, at no cost. If you aren’t satisfied with how we handle a concern, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Links to other sites

The website links to Instagram and Google. What they collect once you’re on their sites is covered by their own privacy policies.

Changes to this policy

If we change this policy, we’ll post the new version on this page with its date. This version took effect on November 3, 2026.

Contact us

Helany, the owner of Brow Haus & Co., is responsible for how we handle personal information. Questions, requests and concerns can go to: