kneadspace

Kneadspace Privacy Policy

Last updated: September 2026

Kneadspace is built and operated by Cumulus Vision LLC, a US company, doing business as Kneadspace. Kneadspace (“we,” “us”) is scheduling and practice software for independent massage and wellness practices. This policy covers our website, the app, and every page and message we run for a practice: what we collect, why, who can see it, and your choices.

Who this policy is for

• Practices — the therapists, owners, and staff who run a practice on Kneadspace. You are our customer.
• Clients — the people who book, join a waitlist, fill in an intake form, pay, or message a practice through Kneadspace.

When a practice uses Kneadspace with its clients, the practice decides what to collect and why; Kneadspace processes that information on the practice’s instructions as its service provider (a “processor” under state privacy laws). Clients should ask their practice first about how it uses their information; we help it answer. Where you deal with Kneadspace directly — your own account, our website, email to us — Kneadspace is responsible.

Information we collect

From practices: your name, email address, phone number, business name and address, and sign-in credentials (including a second step or passkey); the services, prices, availability, policies, staff, and content you set up; your connected Stripe and Google credentials, stored encrypted; and subscription billing details, handled by Stripe.

From clients:

• Contact details — name, email address, mobile number — and how you prefer to be contacted.
• Booking details: services, dates and times, waitlist requests, memberships, gift cards, and your appointment history.
• Payment information: card details go straight to Stripe. We keep a payment token, the card type, and the last four digits.
• Intake and health information the practice asks for, and any signature you give on a form (see Health information).
• Messages you send — chat, or email to a practice’s Kneadspace desk address — your consent choices and their timestamps, and any review you leave.

Automatically: IP address, browser and device type, pages requested, and timestamps in our server logs, plus the cookies described under Cookies. We count page views with Vercel Web Analytics, which sets no cookies and reports only aggregate numbers. We run no advertising trackers.

How we use information

• To run the service: scheduling, waitlists, reminders, intake, memberships, gift cards, checkout, and the records a practice keeps.
• To communicate about appointments and answer your messages — by email, in chat, or by text where you chose it.
• To keep accounts safe: sign-in security, fraud and abuse prevention, and fixing problems.
• To bill practices, and to improve Kneadspace using usage information that identifies no one.

We do not sell personal information, we do not use it for advertising, and we do not share it with anyone for their own marketing.

Health information

Intake answers, session notes, contraindication flags, files on a client’s chart, and anything you tell a practice about your health are health information. Several states treat this as “consumer health data” with its own rules, so here is the plain statement those laws ask for.

• What we collect: your intake answers, the notes and flags the practice records about your care, and health details in your messages.
• Why: so the practice can provide safe care and keep the records its profession requires. Kneadspace uses it only to store, display, back up, and support the service.
• Where it comes from: you, and the practice.
• Who can see it: the practice and the staff it authorizes; Kneadspace personnel only for support, security, or the law. It is stored with the providers named under Who we share information with and with no one else.
• What we never do: sell it, use it for advertising, or share it beyond those providers without your consent or a legal requirement. You can withdraw consent or ask for deletion at any time (see Your rights and choices).

Kneadspace is not a HIPAA covered entity or business associate; see Practice obligations in our Terms of Service.

AI features

Where we use AI. A practice can switch on an assistant that answers chat on its booking page; answers or drafts replies to email sent to its desk address; summarizes a client’s visit history; and drafts session notes from the practitioner’s own dictation.

What each one sends to the model.

• Chat: the practice’s services, policies, and FAQ; your first name if you are signed in; and the conversation.
• Email: the text of your message and the earlier turns in the thread — not its address or headers.
• Visit summary: the client’s visit dates, services, and chart notes, with no name or contact details.
• Session notes: the dictated transcript, with the model told to refer to “the client.”

What is never sent. Full names beyond a first name, email addresses, phone numbers, dates of birth, postal addresses, payment details, and anything we receive from Google APIs. Information we receive from Google APIs (calendar events, sign-in profile) is used only to write to your Google Calendar and to sign you in. It is never included in any request to an AI model.

Who processes it. Requests go through Vercel's AI Gateway. Our default models are Google's Gemini models, used under Google's paid API terms, which state that prompts and responses are not used to improve Google's products; we may also use Anthropic's Claude models, whose commercial terms prohibit training on customer content. The gateway is configured to request zero data retention on every request, to route only to providers with verified zero-data-retention agreements, and to reject any other provider. The gateway itself keeps no prompts or responses.

How practices stay in control. For each channel the assistant can be off, draft-only, or replying; every draft can be reviewed before it is sent; the assistant hands off anything it should not decide, and a person can take over any conversation. AI replies are not medical advice.

What we keep. The conversation, and any session note the practitioner saves; a visit summary is generated on request and not stored. Kneadspace does not build or train models, and never uses your information to train one.

Who we share information with

• Your practice, if you are a client — everything you give it through Kneadspace.
• Service providers that work only on our instructions and only to run Kneadspace:
  • Vercel — hosting, file storage, cookieless web analytics, and the AI Gateway (United States).
  • Neon — the database (United States).
  • Stripe — payments — card details go to Stripe directly and never reach Kneadspace.
  • Resend — email delivery, and inbound email to a practice's hosted desk address.
  • Telnyx — text-message delivery.
  • Twilio — text-message delivery.
  • Google — staff sign-in, Google Calendar, and Google Business Profile — only for practices that connect them.
  • Google Gemini (through Vercel AI Gateway) — the default model behind AI replies, note drafts, and summaries, under Google's paid API terms with zero data retention.
  • Anthropic Claude (through Vercel AI Gateway) — an alternative model for the same features, under Anthropic's commercial terms with zero data retention.
• The law: when a valid legal request requires it, or to protect the safety and rights of a practice, a client, or Kneadspace.
• A successor, if Kneadspace is ever sold or merged, under this policy.

Email

Service email — confirmations, reminders, receipts, sign-in links, intake requests, and replies — is part of providing your appointment, so it is sent while you have bookings or an account; ask your practice or us if you no longer want it. Marketing email from a practice goes only to its own clients, carries the practice’s postal address, and has a one-click unsubscribe link in every message, which we honor promptly. Kneadspace’s own product emails to practices work the same way.

Google user data

Practices can connect a Google account. We use these Google APIs and scopes, and nothing else:

• Google sign-in (openid, email, profile): your name and email address, only to create and sign in to your staff account and show who you are inside your practice.
• Google Calendar (calendar.events and calendar.calendarlist.readonly): we list your calendars so you can choose one, then create, update, and delete events on it that mirror your Kneadspace appointments. Sync is one way, Kneadspace → Google. Events say only “Busy” unless you opt in to the service name; they never include client notes, intake answers, or contact details, clients are never attendees, and we do not read your other events.
• Google Business Profile (business.manage), if you connect it: to show your listing and reviews on your Kneadspace profile and let you reply to reviews.

We do not use Google user data for advertising, sell it, or share it with anyone other than the service providers that host Kneadspace, and only to run the service. Humans at Kneadspace read it only with your permission, for support, for security, or where the law requires. Information we receive from Google APIs (calendar events, sign-in profile) is used only to write to your Google Calendar and to sign you in. It is never included in any request to an AI model. Kneadspace's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can read that policy at https://developers.google.com/terms/api-services-user-data-policy.

Retention and revoking access: we store your Google tokens encrypted, with the id of the calendar you chose and of the events we created, while the connection is active. Disconnect any time in Settings → Calendar → Disconnect (or Settings → Reviews for Business Profile): we delete the tokens at once and stop syncing; events already on your calendar stay for you to keep or remove. You can also revoke access at myaccount.google.com/permissions. Deleting your Kneadspace account deletes the stored Google data with it.

Cookies

We set only the cookies the service needs: a session cookie that keeps you signed in, and short-lived browser storage that remembers a booking or chat in progress. There are no advertising cookies; page views are counted by Vercel Web Analytics without cookies or cross-site identifiers. Stripe’s payment form and Google sign-in set their own cookies under their own policies when you use them. We do not track you across sites or sell or share information, so a “Do Not Track” or Global Privacy Control signal changes nothing — you are already opted out.

Retention

We keep a practice’s information while its account is open. When a practice closes its account we delete or de-identify its data, including its clients’ data, within 90 days, except records we must keep longer (payment records, and proof of consent for texts and marketing). Health records are kept as long as the practice’s licensing rules require; the practice sets that period and can delete a client’s records on request. Server logs are kept briefly for security.

Security

Everything travels over TLS. Data is encrypted at rest by our hosting providers; connected Stripe and Google credentials are encrypted again with our own keys. Health information lives in a separate part of the database with narrower access. Staff accounts can use two-step sign-in and passkeys, a practice can require them for its team, and every sign-in is logged. If a breach affects your information, we will notify the affected practice without undue delay and help it tell its clients and any regulator where the law requires.

Your rights and choices

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon, or Washington), you may have the right to know what personal information we hold about you and get a copy, to correct it, to delete it, to receive it in a portable format, to opt out of the sale or sharing of personal information and of targeted advertising (we do none of these), to limit the use of sensitive information, and to appeal a decision. We never treat you differently for exercising a right.

To exercise any of them, email hello@kneadspace.app from the address on your account, or write to your practice. We verify that it is you and answer within 45 days (extended once if needed, with the reason). An authorized agent may make the request for you with your written permission. Where we hold your information for a practice, we forward the request to the practice and help it respond.

Everyday choices: clients change contact details and preferences in their account; practices manage their data in Settings. To stop text messages, see Text messages (SMS). To stop marketing email, use the unsubscribe link in the message.

Children

Kneadspace is not directed to children, and we do not knowingly collect personal information from a child under 13. A parent or guardian may book and complete forms for a minor. If we learn that a child under 13 has given us information directly, we delete it.

Where information is kept

Kneadspace is operated from, and hosted in, the United States. If you use it from elsewhere, your information is transferred to and processed in the United States under this policy.

Changes

We may update this policy. The date at the top shows the current version; for a material change we will tell practices by email or in the app before it takes effect.

Contact

Kneadspace is built and operated by Cumulus Vision LLC, a US company, doing business as Kneadspace. Questions, requests, and complaints: hello@kneadspace.app, (415) 463-1200, or by mail to Cumulus Vision LLC, PO Box 720294, San Francisco, CA 94172.

HomeContactTerms of Service