How we protect your data

We would rather describe what we do than show a badge. Every practice on this page is something the product does today, enforced in code or in the terms you accept. Where we do not do something, we say so in its own section further down.

If anything here is unclear, ask us and we will answer in plain words.

You own your business data: your leads and members, and the contacts, conversations and call records in the Workspace. You also own your advertising accounts, campaign history, names, logos and material. We hold your data to run the product for you.

When a location's service ends, it keeps its advertising accounts, campaigns, history, domains, landing pages and material. Members export to CSV from inside the product, and you can ask us for anything else.

We keep ownership of the MaverStudio software itself. You have the right to use it, including the Workspace, while its fee is paid.

• We do not sell your data.
• We do not give identifiable data from your account to another client, and we do not use it to advertise for another client.
• We do not pool your data with another customer's.
• We do not upload customer lists or identifiable offline conversion data to an ad platform unless you approve it separately and confirm the required privacy notice and opt-out process are in place.
• We do not send conversions to Google's or Meta's APIs.
• We do not call or text your leads. Your team does, from the Workspace.

Each customer is its own tenant. Every table that holds customer data is protected by Postgres row-level security, keyed to the organization of the person signed in, as a second wall under the scoping the application already does.

Your data is never mixed into another customer's reports, and theirs never reaches yours.

Inside your account, one location is one workspace: its own leads, phone numbers, conversations, calls and boards. Workspace data never crosses from one location to another.

A combined view across locations exists only for the people you give access to every location. Everyone else sees only the locations you assign them.

Traffic to the product is encrypted with TLS from end to end. Our server has no inbound ports open: requests reach it through a Cloudflare Tunnel.

The keys and tokens you give us for your providers (PushPress, Mindbody, GoHighLevel, Meta and Twilio) are encrypted at rest with AES-256-GCM, an authenticated cipher. They are never shown back, to you or to our team.

Passwords are hashed with bcrypt at cost 12 and are never stored in readable form.

When you sign in, your browser keeps a session cookie marked httpOnly, Secure and SameSite=Lax. We store only a SHA-256 hash of the session token, so the value in our database cannot be used as a session. A session stays valid for 30 days from its last use.

Tokens for the lead intake API are shown once when created and stored only as hashes. They can be issued for the whole account or for one location. Sign-in to our own back office is rate limited.

There are four roles: Owner, Manager, Marketing and Regular. Each person can be given every location or specific ones, and you choose which locations' calls ring them.

Regulars, the front desk, reach the Workspace and nothing else. That is enforced on the server, and every page, route and server action in the product is classified and tested for what a Regular can reach.

You can also allow or deny one person a specific Workspace action. Every change to those exceptions is kept in a history of who changed what, which cannot be edited.

Our operators can open your account only through a support session. The session is written to an audit log before it exists, lasts at most 60 minutes, cannot be renewed, and shows a banner across your app that cannot be dismissed.

Every action our staff take across customer accounts, reads included, is written to a platform audit log.

Each location connects its own gym software with its own credentials: an API key for PushPress; an API key, a site ID and a staff login for Mindbody.

Google Ads connects through a script you paste into your own Google Ads account, so no sign-in approval is granted to us. Meta connects with a system-user token from your own Business portfolio and your ad account ID. GoHighLevel connects through a webhook action in your own workflows, with a secret we issue, plus an API token per sub-account. Twilio connects with your own account's credentials.

Every sync writes a record of what ran, for which location, how far it got and what it brought back. You can read it as Sync history on each integration.

• PushPress: nothing. We only read.
• Mindbody: where you switch it on for a site, leads from our pages are created as Mindbody clients, and a contact log can be added to an existing client.
• GoHighLevel: leads from our pages enter your own workflow, and card moves, tags, deletes and calendar bookings made in the Workspace are written back. Calendar writes happen only where that location's switch is on.
• Google and Meta: nothing through their APIs.
• Twilio: the calls, texts and number purchases your team makes, in your own account.

Every write is recorded before it is sent and read back afterwards, and anything the provider did not take is named.

Every delivery from a provider is verified before it is trusted: HMAC signatures for Mindbody and Meta, a per-connection secret for GoHighLevel, and request signatures for Twilio and Stripe.

Each delivery is stored exactly as it arrived before it is processed, so it can be replayed if something goes wrong. A webhook and the scheduled sweep that carries the same event resolve to one row, never two.

Phone numbers, calls and texts run on your own Twilio account. Calls are recorded and transcribed while they happen, using Twilio's speech-to-text, and the recordings and transcripts are part of your business data.

You are responsible for consent to call, text and record your contacts where the law requires it. STOP, HELP and START replies are handled, and a number that opted out cannot be texted.

Forms on the landing pages we host store proof of text-message consent with each entry: the exact sentence shown, the time, the IP address and the browser. A bot guard on those forms stops a script from making your gym text a stranger.

The tracking snippet on your website keeps each visitor's first and last touch in their browser and in two first-party cookies on your own domain, so an ad click on Monday and a form on Thursday can be joined.

Site traffic counts page views by page and by where the visit came from. Query strings are never stored, and a page view names a browser, never a person.

On landing pages we host for you, your own Google Ads tag and Meta pixel run in the visitor's browser, as they would on your own site.

This marketing site, maverstudio.com, sets no cookies and runs no analytics or advertising trackers.

MaverStudio's fees are paid through Stripe, by card or bank debit, set up separately for each location. Payment details are entered in Stripe's checkout and kept by Stripe.

Your advertising budget is charged by Google and Meta to your own ad accounts and never passes through us.

The database is backed up every night to storage off the server, on Cloudflare R2, and kept on daily, weekly and monthly schedules. A restore drill runs automatically, and the age of the latest backup is checked.

Every release runs the full typecheck, lint and test suite on the server before it goes live. If any check fails, the release does not happen.

When a source goes quiet, it raises an insight: a location that has sent no Google Ads data for hours, Mindbody deliveries that lapsed, a GoHighLevel sweep that stalled, or texts that need attention.

Data quality checks on the Integrations screen list leads missing a Google click id, leads missing a location, possible duplicate people, recent memberships without a lead, and leads without attribution. Possible duplicates wait for a person to decide. Nothing merges on its own.

• No SOC 2, ISO 27001, HIPAA or PCI certification.
• No multi-factor sign-in and no single sign-on. Sign-in is by email and password.
• No public status page and no uptime commitment. The product may occasionally be unavailable for maintenance or because of an outside provider.
• No 24/7 or fixed-response-time support. We help as quickly as we reasonably can.
• No choice of the region where data is stored.

If you find a vulnerability, write to [email protected] with what you found and the steps to reproduce it. Please do not access other customers' data, disrupt the service or publish the issue before it is fixed.

Questions about this page, or a request about your data: [email protected].