Privacy Policy

Account and profile. Name, email, phone, password hash, profile photo, and, for providers, business name, category, services, hours, address, county, sales-tax rate, time zone, tax ID, and payment-processor account IDs.

Work you publish. Photographs and captions you upload to a portfolio, including a staff member's own gallery, are published on the business profile and are visible to anyone who visits it. A staff member's portfolio is shown under their name and photo. If a staff member leaves a business, the photographs they uploaded remain with that business, because they document work carried out for it; the business can remove them at any time. Do not upload images of a client without their permission.

Booking and service history. Appointments, intake-form responses, agreements you sign, messages with providers, cancellations, no-shows, reviews, and tips. For mobile services, a service-specific address and contact phone so the provider can reach you en route.

Payment information. Card details are tokenized by our payment processor and never touch our servers. We retain limited data such as the last four digits, card brand, expiry, and processor customer and payment-method IDs to complete transactions, refunds, and autopay.

Text message consent. If you agree to receive text messages, we record the phone number, which kind of message you agreed to, the exact wording you were shown, the time you agreed, and the browser user-agent it came from. We keep it after you opt out as well, because the record of a withdrawn consent is what shows when it was given and when it ended. Mobile phone numbers and SMS consent are never shared with third parties or affiliates for their own marketing, and are not sold or rented to anyone.

Push notification consent. If you turn on push notifications, we record which device you turned them on from, which kind of notification you agreed to, the exact wording you were shown, the time you agreed, and the browser user-agent it came from. Permission is also granted separately to your browser, and you can withdraw it there or in POSCHI at any time. We keep the record after you turn them off, for the same reason we keep the text message one: it is what shows when the agreement began and when it ended. Consent is per device, so turning notifications on using your phone does not turn them on for your laptop.

Legal acceptances. When you accept our Terms of Service or this Privacy Policy, we record which version you accepted, when, and the IP address and browser user-agent the acceptance came from. This is kept as evidence of agreement and is deleted with your account.

Trust and Safety reports. If you submit a report against a provider, we retain the report category, your description, optional booking context, your identity linked to your account, and the status changes made by our team. We do not share your identity with the reported provider, see section 12.

Affiliate and referral attribution. If you sign up with a referral or affiliate promo code, we record the code, the affiliate it resolves to, and your plan choice at signup so commission can be attributed correctly. Affiliates also have a PIN hash for dashboard access; PINs themselves are never stored in plain text.

Location. Approximate location from your IP address and, with your permission, precise location for "near me" search.

Device and usage. Browser, device, operating system, IP address, pages viewed, and interactions, used for analytics, fraud prevention, and diagnostics.

Diagnostic logs. When something goes wrong, we record the error, the page it happened on, and technical details that help us reproduce it. Before that record is stored we strip out credentials and personal identifiers: sign-in tokens, one-time codes, and API keys are removed, the values in a page address's query string are dropped, and email addresses and phone numbers are redacted.

Marketing engagement. Whether you opened or dismissed a notification in the app. We do not track whether you opened an email or clicked a link in one.

Health information: not collected. POSCHI is not a healthcare service and does not knowingly collect health information. Providers are prohibited from requesting health data such as allergies, medical conditions, medications, injuries, pregnancy, or treatment history through intake forms, file uploads, or any other POSCHI feature, and our form builder blocks forms that request it. Do not include health details in form answers, notes, messages, or uploads. If a form asks for health information, skip those questions and report it via Report Abuse. If we become aware health information was submitted despite this policy, we will delete it.

We use personal data only for the purposes below. Where a purpose ends, so does our reason to keep the data, which is what section 5 turns into concrete retention periods.

• Providing the service. Creating and securing your account, listing providers, taking bookings, confirming and reminding, processing payments and payouts, and delivering the messages the service depends on.
• Payments and financial records. Charging and refunding, paying providers, issuing invoices and receipts, and keeping the tax and accounting records the law requires.
• Support. Answering your questions and investigating problems you report.
• Safety and fraud prevention. Detecting abuse, investigating Trust and Safety reports, enforcing our Terms, and protecting people on the platform.
• Improving the product. Understanding which features are used and where they break, using aggregated and de-identified data wherever it will do.
• Marketing, with your consent. Sending promotional messages you have opted into, which you can stop at any time without affecting the service itself.
• Legal compliance. Meeting obligations that apply to us, and establishing or defending legal claims.

We use the providers below to operate POSCHI. Each receives only the data its service needs, is bound to handle it confidentially, and processes it on our instructions rather than for its own purposes, except where that provider is acting as an independent controller of your relationship with it, which is the case for the payment and authentication providers. Provider names link to their own privacy policies.

Beyond this list, we disclose personal data only where the law requires it, such as a valid legal request, or where it is necessary to prevent serious harm. If we ever add a provider that receives personal data, we will update this table and, where the change is material, ask you to accept the updated policy.

Some promotional images, illustrations, and videos shown on POSCHI, including marketing pages, category and landing artwork, and placeholder or sample imagery, may be generated or enhanced using artificial intelligence tools.

This applies to our own promotional and marketing content only. It does not mean your data is used to create those assets. We do not use your photographs, portfolio images, lookbooks, intake-form responses, messages, or any other content you provide to train, generate, or enhance AI imagery, and we do not supply that content to AI image tools. Images uploaded by providers to their own portfolios and profiles are their content, not ours, and are presented as they upload them.

This disclosure is carried in the footer of every page rather than as a badge on individual images, because it applies to our promotional media generally. Where such an image shows people, they are not real clients or providers, and any result shown is illustrative rather than a record of work performed. If you believe a provider's listing misrepresents their actual work, please report it via Report Abuse.

We use first-party cookies and local storage to keep you signed in, remember preferences, and run product analytics. We do not run third-party advertising trackers. See our Cookie Policy for details.

Storage limitation. We keep personal data only for as long as it is needed for the purpose it was collected for, and no longer. When that purpose ends, the data is deleted or de-identified. We do not keep personal data indefinitely just in case.

• Active account data. Kept while your account is open.
• Profile data after closure. Deleted within 30 days.
• Transactional records. Invoices, payouts, and tax forms may be kept up to 7 years for tax and financial compliance.
• Legal acceptance records. Kept for the life of the account, then deleted with it.
• Aggregated, de-identified analytics. May be retained indefinitely, because it is no longer personal data.
• Backups. Roll off within about 35 days.

Where we retain something past account closure it is because the law requires it, or because we need it to resolve a dispute, prevent fraud, or enforce our agreements. What we keep is limited to what that obligation actually requires, and it is deleted once the obligation expires.

You can update most information in Settings. From Account, Data and Privacy, you can export your data or request permanent deletion. Deletion is processed within 30 days, except where records must be retained for legal or financial compliance, in which case we tell you what is being kept and why.

You may also ask us to correct inaccurate data, to restrict or object to particular processing, and to withdraw consent for anything you consented to, such as marketing messages or precise location. Withdrawing consent does not affect processing already carried out. We do not sell personal information, so there is nothing to opt out of on that front.

To exercise any of these rights, email info@thetwinnovators.com. We answer within 30 days and will not charge you or degrade your service for asking.

POSCHI is intended for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

Our infrastructure is hosted in the United States. POSCHI accounts are currently offered to United States residents only, and we do not target our services to, or monitor the behaviour of, people in the European Economic Area or the United Kingdom. If you access POSCHI from outside the US, your information will be transferred to and processed in the US, with appropriate safeguards where required.

Where the GDPR applies. The General Data Protection Regulation protects people who are in the EEA, whatever the location of the company processing their data. To the extent it applies to our processing of your personal data, you have the right to access, correct, erase, restrict, and object to that processing, the right to data portability, and the right to lodge a complaint with your local supervisory authority. Our lawful bases are performance of our contract with you, meaning operating your account and bookings, our legitimate interests in securing the platform and preventing fraud, your consent for optional marketing and non-essential cookies, and legal obligation for tax and financial records.

We answer requests under this section within 30 days. Email info@thetwinnovators.com to make one.

Your connection to POSCHI is encrypted, and your data is encrypted where it is stored. Access is limited by role, so a client, a provider, a staff member and an administrator each reach only what their role allows, and that limit is enforced by the database itself rather than only by the app. A nightly job checks those database rules and our file storage settings against what we expect and alerts us if either has drifted.

Sensitive uploads, meaning dispute evidence and private client lookbooks, are kept in private storage and served through links that expire shortly after they are issued. Photographs you choose to publish, such as a profile picture or a portfolio image, are served from public storage, because they are meant to be seen by anyone browsing the marketplace. Please do not upload anything to those areas that you would not want to be public.

Creating an account requires a code we email to your address, so a password alone is never enough to open an account in your name. Changing your password or your email address also requires a code sent to the address already on the account, which means someone who learns your password still cannot take the account over without reaching your inbox.

If something does go wrong. No system is perfect, and a policy that only describes the defences is only telling you half of it. If we discover a breach affecting your personal information, we will notify you without undue delay and in any case within the time your state law requires, by email to the address on your account. We will tell you what happened, what information was involved, what we have done about it, and what you can do. Where the law requires it we will also notify the relevant regulators. We will not wait for certainty about the full scope before telling you that you are affected.

What protects your sign-in depends on the kind of account you hold, so we set it out plainly rather than in general terms. Administrator accounts must use an authenticator app: a password on its own will not open the admin area, and that is enforced by our database and not only by the screen you see. Providers and staff can turn on a six-digit PIN that is asked for when the portal is opened, which is there to protect a session left signed in on a shared device. It is optional, and it is stored as a hash, so nobody at POSCHI can read it.

To be equally clear about what we do not yet offer: authenticator-app two-factor authentication is not available to providers, staff or clients. For those accounts your password is the only thing checked at sign-in, and the PIN described above locks the portal rather than the account, so please use a password you use nowhere else. We will say so here when that changes. No system is perfectly secure, and if you believe your account has been accessed by someone else, contact us and change your password immediately.

Provider profiles are publicly listed so clients can discover and book services. To people who are not signed in, we serve a reduced view of the profile that excludes internal fields such as personal email, raw phone number, internal notes, and administrative state. Signed-in clients see the contact and scheduling information they need to complete a booking. Providers whose accounts are suspended pending Trust and Safety review do not appear on public marketplace, search, category, or city pages while the review is open.

If you submit a Trust and Safety report against a provider, we do not share your identity, the category you selected, or the text of your report with that provider. You may also see the status of your submitted reports, meaning open, investigating, resolved, or dismissed, from your client portal. We may share report data with law enforcement where required by law or to prevent serious harm.

If you live in California, the CCPA as amended by the CPRA gives you specific rights. Everything in section 7 applies to you as well; this section says the same things in the vocabulary that law uses, and adds what it asks us to state explicitly.

What we collect. In the categories that law names, we collect identifiers (your name, email address, phone number, and account identifiers), customer records (billing details, appointment history), commercial information (bookings, purchases, payments), internet activity (how you use the platform, in aggregate and for security), approximate location if you allow it, and visual information (photographs you upload). Section 1 sets out the same list in plain terms and in more detail.

Where it comes from and why. Directly from you, from your use of the platform, and from the service providers listed in section 3. We use it to operate your account and bookings, to take payment, to keep the platform secure, and, with your consent, to send marketing. We disclose it for a business purpose only to those service providers, who are contractually limited to acting on our instructions.

Mobile numbers and SMS consent. These are held to a stricter rule than the rest, and it is worth stating on its own: no mobile phone number and no text message consent collected by POSCHI is shared with any third party or affiliate for their marketing, and none is sold or rented. The only parties who see them are the messaging carrier that delivers the message and, for a message about your own booking, the business you booked with. POSCHI is operated by The Twinnovators, LLC. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

How often we text, and what it costs. Messages about your own bookings follow your booking activity, so how many you get is a consequence of how much you book; a typical appointment produces a confirmation, a reminder, and a message only if something changes. Promotional messages, which are a separate opt-in and off unless you switch them on, are occasional and no more than a few in a month. Message and data rates may apply, and those are set by your mobile carrier rather than by us. Reply STOP to any message to stop all of them.

We do not sell or share your personal information. Not in the ordinary sense, and not in the broader sense those words carry under the CPRA, which counts disclosing data for cross-context behavioural advertising as sharing even when no money changes hands. We do neither, we have never done either, and we do not have a Do Not Sell or Share link because there is nothing behind it. We also do not knowingly sell or share the personal information of anyone under 16.

Sensitive personal information. We do not use or disclose it for any purpose beyond providing the service you asked for, so the right to limit its use does not arise. POSCHI is not a healthcare service and providers are prohibited from collecting health information through it, which is covered in section 1.

Your rights. To know what we have collected about you and where it went, to receive a copy in a portable form, to correct what is wrong, and to have it deleted. We will not discriminate against you for exercising any of them: no price change, no reduction in service, no different treatment. Email info@thetwinnovators.com, or export and delete from Account, Data and Privacy without asking anyone. We respond within 45 days and will tell you if we need the further 45 days the law allows.

Someone acting for you. An authorised agent may make a request on your behalf. We will ask for written proof that you authorised them, and we may ask you to confirm it directly, because the alternative is handing your data to whoever asks nicely.

This policy is versioned. When we publish a material change, we notify account holders by email and in-app, and ask you to review and accept the updated version before continuing to use the platform. We keep a record of which version you accepted and when. Earlier versions are never overwritten.

For material changes we give at least 14 days notice before they take effect. Privacy questions and data-deletion requests: info@thetwinnovators.com.