Your data, looked after properly

01The short version

If you read nothing else, these are the four promises behind how we handle your data.

02Where your data lives

The foundation everything else sits on.

Suddenly Sorted runs on Cloudflare’s global edge network — the same infrastructure that protects a large share of the world’s busiest websites. Your bookings, customer details and settings are stored in Cloudflare D1, a managed database that sits behind that network.

Every connection travels over an encrypted (HTTPS) link, so information moving between a customer’s phone, your dashboard and our servers can’t be read in transit.

03Every business is walled off from every other

The single most important protection — and the one that stops anyone peeking at someone else’s salon.

When you sign in, we hand your browser a signed token that quietly says “this is your business.” From that moment on, every single thing the system fetches — a booking, a customer, a setting — is filtered by your business identity, taken from that signed token.

Crucially, that identity comes from the signed token and never from anything the browser asks for. So there’s no “change the number in the web address and peek at someone else’s salon” — the request simply can’t reach data that isn’t yours.

04We never see your card numbers

The most sensitive part of payments is handled by specialists, not us.

When you pay for a plan, your card details go straight to Stripe — one of the world’s most trusted payment companies — and are handled entirely on their secure systems. We don’t store your card number, we don’t see it, and it never touches our database.

That means the part of payments that matters most is looked after by a company whose entire job is keeping card data safe.

05A sign-in built to resist break-in attempts

Specific, enforced protections — not vibes.

• It slows attackers down and locks them out. Too many sign-in attempts in a short window and the account locks — so automated password-guessing simply doesn’t get anywhere.
• No timing hints. Behind the scenes we use constant-time checks for sensitive comparisons — in plain terms, we don’t leak tiny clues that could help an attacker guess a secret.
• Payment notifications can’t be faked or replayed. Messages that confirm a payment are verified and anything stale or replayed is rejected.
• Your private notes stay private. Notes you keep against a client are never exposed to the assistant or to other businesses.

06How we keep it that way

Where “we built it carefully” stops being a slogan and becomes something we can show you.

Before any change goes live, it has to pass our automated test suite — the same checks every time, so a careless mistake gets caught before it ever reaches you. We also run a thorough internal security review of our own code. The most recent one found the system well-defended with no critical or high-severity issues, and we tightened a few things further off the back of it. We keep doing this as the product grows.

07Your privacy, your control

It’s your data. We just look after it.

We’re a New Zealand business and we handle personal information in line with the NZ Privacy Act. The data we hold is there to run your bookings and help you serve your customers — nothing more.

You can ask us to export your data or delete it at any time. The full detail of what we collect and why lives in our privacy policy.