Palms StudioPalms Studio

Privacy Policy

Effective October 26, 2026

Palms Studio ("Palms Studio", "we", "us") operates a software platform that lets businesses — such as salons, florists, bakeries, landscapers, butchers, retailers and wholesalers — run their online storefronts, accept orders, manage deliveries, and communicate with customers. This Privacy Policy explains how we collect, use, and share personal information when you use our website, applications, or services (collectively, the "Service").

We act in two different roles: (a) as a controller of personal information for the merchants who sign up to use Palms Studio ("Tenants"), and (b) as a processor of personal information that customers provide to those Tenants through storefronts we host. When you place an order on a Tenant’s storefront, the Tenant decides why your data is collected and how it is used; we process it on their behalf in accordance with our agreement with them.

1. Information We Collect

From Tenants and Tenant Staff

  • Account information — name, email address, password, business name, business type (florist, candle maker, gift shop, etc.), business address, phone number.
  • Payment account information — Stripe Connect account identifiers and onboarding status. We never see or store the bank account or full card details that a Tenant connects through Stripe.
  • Configuration data — shop settings, products, pricing, hours, delivery zones, staff roster.
  • Usage data — pages visited within the dashboard, actions taken, device and browser metadata.

From Customers of Tenants

  • Contact information — name, email address, phone number, delivery address, gift recipient details.
  • Order information — products ordered, delivery instructions, card messages, fulfillment dates.
  • Payment information — collected directly by Stripe; we receive only a tokenized reference and the order total, never the card number or CVC.
  • Communications preferences — whether you opted in to receive updates about an order or marketing messages by SMS or WhatsApp, and the phone number used for those messages.
  • Account information (if you sign in) — if you choose to create a customer account on a Tenant’s storefront, we store the email you signed in with and a session token. We do not store passwords (customer sign-in uses one-time magic links).

From Visitors to palmstudio.app

On our marketing website we collect standard server logs (IP address, user-agent, referrer, timestamp) and we may set first-party cookies to remember preferences and measure anonymous traffic patterns. We do not use third-party advertising cookies.

2. How We Use Information

  • To provide the Service — process orders, route deliveries, send confirmations.
  • To communicate with Tenants about their account, billing, support requests, and Service updates.
  • To send transactional notifications (email and, with opt-in, SMS or WhatsApp) to customers about the orders they place — see our SMS Terms.
  • To let Tenants publish posts to, and message customers from, their own connected Facebook, Instagram, and WhatsApp accounts — see "Social and Messaging Integrations" below.
  • To show Tenants read-only reports from their own connected Google Search Console and Google Analytics accounts, and to publish and measure Palms Studio’s own marketing content — see "Google API Services" below.
  • To prevent fraud, abuse, and security incidents.
  • To comply with legal obligations and respond to lawful requests.
  • To improve the Service through aggregate analytics. We do not sell personal information.

3. How We Share Information

With Tenants

When you place an order on a Tenant’s storefront, the Tenant receives the information needed to fulfill it (your name, contact details, delivery address, order contents, and any messages you included). The Tenant is the controller of that information once it reaches them and is responsible for how they use it.

With Service Providers

We rely on a small set of vetted vendors to operate the Service:

  • Stripe, Inc. — payment processing and Stripe Connect for paying Tenants.
  • Supabase, Inc. — database, authentication, and file storage.
  • Vercel, Inc. — application hosting and content delivery.
  • Resend — transactional email delivery.
  • Twilio, Inc. — SMS delivery for opt-in transactional messages.
  • Google LLC — the Google Analytics, Search Console, and YouTube integrations described in "Google API Services" below.
  • OpenAI, L.L.C. and Anthropic, PBC — AI models that write short plain-language summaries in reports. For Google data, see "Google API Services" below for exactly what is sent.
  • Meta Platforms, Inc. — the Facebook, Instagram, and WhatsApp Business Platform integrations described in "Social and Messaging Integrations" below. When a Tenant connects a Facebook Page, Instagram account, or WhatsApp Business number, the content the Tenant chooses to publish or send — and the recipient phone numbers and message content for WhatsApp — are transmitted to Meta to deliver that feature.

Each provider is bound by a data-processing agreement and may only use the information we share to perform the service they provide to us.

Social and Messaging Integrations (Meta)

Palms Studio lets Tenants connect their own Facebook Pages, Instagram Business accounts, and WhatsApp Business numbers so they can publish posts and send customer messages from within our dashboard. We operate as a Meta Tech Provider for the WhatsApp Business Platform.

  • Social cross-posting — when a Tenant connects Facebook or Instagram, we store the connected Page / account identifier and an access token so the Tenant can publish posts they compose in Palms Studio to those accounts. We access only the data needed to list the Tenant’s own Pages/accounts and publish on their behalf. We do not read a Tenant’s private messages or use this data for advertising or any purpose other than the publishing feature the Tenant requested.
  • WhatsApp messaging — when a Tenant connects a WhatsApp Business number, we store its identifiers and, on the Tenant’s behalf, send and receive WhatsApp messages to and from customers who have opted in. This involves processing recipient phone numbers and message content. We use this data only to deliver the messaging features the Tenant has enabled and to handle opt-out requests; we do not sell it or use it for advertising.
  • Use of Meta Platform Data — information obtained through these integrations is used solely to provide the connected features to the Tenant, is handled in accordance with the applicable Meta Platform Terms and Developer Policies, and is deleted when a Tenant disconnects the integration or closes their account, except where retention is required by law.

Google API Services (Google Analytics, Search Console, YouTube)

Palms Studio is operated by PALMS STUDIO LLC. We use one Google OAuth application in the two places described below. We ask only for the Google permissions a feature needs, and only after you click Connect and approve them on Google’s consent screen.

Palms Studio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • SEO Insights (for Tenants) — a Tenant can connect their own Google Search Console account (permission: webmasters.readonly) and Google Analytics account (permission: analytics.readonly), each separately. We read the list of Search Console sites and Analytics properties the account can access, so the Tenant can pick one; for the chosen site, daily clicks, impressions, click-through rate, average position, and the top search queries and pages; and for the chosen property, daily sessions, active users, and key events by traffic channel. We use this data only to show the Tenant their own SEO dashboard, alerts, and the scheduled reports they ask us to email to recipients they choose. Both permissions are read-only: we never change anything in the Tenant’s Google account.
  • Palms Content (our own products) — Palms Content (content.palmstudio.app) is an internal tool used only by Palms Studio staff to market Palms Studio’s own products. It connects only Google accounts that Palms Studio owns, never the accounts of Tenants, their customers, or anyone else. With analytics.readonly and webmasters.readonly it reads the same kinds of aggregate traffic and search figures for our own websites; with youtube.upload it uploads short videos that we made to our own YouTube channel; with youtube.readonly it reads our channel’s name and our videos’ view, like, and comment counts. It also uses Google sign-in (openid, and email for the Analytics and Search Console connection) to label which Google account or YouTube channel is connected.

What we never do with Google user data. We do not sell it. We do not use it for advertising, retargeting, or interest-based ads. We do not transfer it to data brokers or information resellers, or use it to determine creditworthiness or for lending. We do not use it to develop, improve, or train generalized artificial intelligence or machine-learning models. No person at Palms Studio reads it, except with your explicit permission for specific data (for example, a support request you send us), when necessary for security purposes such as investigating abuse, to comply with applicable law, or where it has been aggregated and anonymized for internal operations.

AI-written summaries. To write the short plain-English summary at the top of an SEO Insights report, we send that report’s aggregated numbers and up to five of its top search queries to OpenAI (or to Anthropic if OpenAI is unavailable) through their business APIs, whose terms do not allow them to train models on that data. No other Google data is sent to them, and none is used to train any model.

How it is shared. Google user data is shared only with the service providers listed above and only to provide these features (Supabase stores it, Vercel runs the application, Resend delivers the report emails a Tenant schedules, and OpenAI or Anthropic as described above); when required by law; or, with prior notice, as part of a merger, acquisition, or sale of assets. Videos uploaded through Palms Content are published on YouTube, where they are public under YouTube’s terms.

How it is stored and protected. Google access and refresh tokens are encrypted by our application (AES-256-GCM) before they are stored, on top of database encryption at rest, and are never sent to a browser. Imported figures are stored in our database (Supabase, United States) behind access rules that limit them to the Tenant’s own staff (SEO Insights) or Palms Studio’s content staff (Palms Content). All data travels over TLS.

Retention and deletion. Tokens are kept only while a connection is active; disconnecting it in Palms Studio deletes them right away and stops all further access. Figures already imported stay in your history, so trends can be shown, until you ask us to delete them or close your account; we then delete them within 30 days (encrypted backups are recycled within 90 days). YouTube data is handled more strictly: the YouTube channel details and video statistics we store are refreshed at least daily while the connection is active. When a YouTube connection is disconnected or its access is revoked, we delete the YouTube data we stored through it within 7 days; videos already uploaded stay on YouTube, where the channel owner manages them. If you ask us to delete data we obtained through YouTube API Services, we delete it within 7 days of your request. To request deletion, email privacy@palmstudio.app or see our Data Deletion page.

Revoking access. You can revoke Palms Studio’s access to your Google account at any time from your Google Account’s security settings: https://security.google.com/settings/security/permissions.

YouTube API Services. Palms Content uses YouTube API Services. By using a feature that uses them, you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Google’s handling of your information is described in the Google Privacy Policy (https://policies.google.com/privacy). You can revoke Palms Studio’s access to your YouTube data at https://security.google.com/settings/security/permissions.

For Legal Reasons

We may disclose information to comply with a subpoena, court order, legal process, or government request, to enforce our agreements, or to protect the rights, property, and safety of Palms Studio, our Tenants, our Tenants’ customers, or the public.

In a Business Transfer

If Palms Studio is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of the transaction. We will notify Tenants and customers of material changes through our website or by direct communication before such a transfer.

4. Data Retention

We retain Tenant account data for as long as the account is active and for a reasonable period afterward to comply with tax, accounting, and legal obligations. Customer order data is retained for as long as the placing Tenant remains active on the Service, after which it may be deleted or anonymized. You can request deletion of your personal information at any time (see "Your Rights" below). Data received from Google APIs is retained and deleted as described in "Google API Services" above.

5. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Request access to the personal information we hold about you.
  • Request correction of inaccurate information.
  • Request deletion of your personal information.
  • Withdraw consent for processing you previously consented to, including SMS opt-in.
  • Object to or restrict certain processing.
  • Receive a copy of your information in a portable format.
  • Lodge a complaint with your local data protection authority.

Requests about information held on behalf of a Tenant should be directed to that Tenant first; we will assist them in responding. Requests about information we control directly can be sent to privacy@palmstudio.app.

6. Security

We use industry-standard safeguards — encryption in transit (TLS), encryption at rest, access controls, audit logging, and least-privilege provisioning — to protect personal information. No security system is perfect; if we learn of a breach that affects your information we will notify you in accordance with applicable law.

7. Cookies and Tracking

We use first-party cookies for essential functionality (authentication, cart state) and for limited analytics. We do not use third-party advertising or cross-site tracking cookies. You can disable cookies in your browser; some features of the Service may not work without them.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with information, please contact us and we will delete it.

9. International Users

The Service is operated from and primarily directed at the United States. If you access it from outside the United States, you understand that your information may be transferred to, stored in, and processed in the United States and other countries where our service providers operate.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Effective" date at the top of this page and, where appropriate, provide additional notice (such as an email to Tenants).

11. Contact

Questions about this Privacy Policy or our data practices can be sent to privacy@palmstudio.app.