Privacy Policy
Effective October 4, 2026
This policy covers the Vivid Consent website and web application. Vivid Consent is operated by Baddie Beauty in Nova Scotia, Canada. It explains what information we handle, why we use it, who may receive it, and the safeguards and choices that apply.
Information handled through the app
When a professional or business creates an account, we may handle account and business information such as names, email addresses, profession, business settings, staff roles, login and security records, and subscription identifiers. If a business uses Vivid Consent for client records, the business may enter client names, contact details, dates of birth, health disclosures such as allergies or reactions, consent answers, guardian details, signatures, service or treatment notes, photos, optional photo identification, and related record or audit information. The exact information depends on what the business chooses to collect and how it configures its workflows.
Payment card details are entered with Stripe. Vivid Consent receives billing and subscription identifiers and status information; Vivid Consent does not store full card numbers.
How information is used
We use information to provide and maintain accounts, digital consent and signature workflows, client records, support, subscription billing, security, troubleshooting, and service improvements. Businesses use the app to manage their own client records and decide what information to request. Vivid Consent processes those records to provide the app to the business.
Who can see or receive information
Client records are available to the business and its authorized users according to the business's account roles and access settings. Vivid Consent does not sell client records or use them for advertising. We use service providers to operate the product, including Supabase for authentication, database and file storage; Vercel for app hosting and delivery; Stripe for payment processing; Hatchable for the marketing website and early-access services; and email providers where needed to deliver account or service messages. These providers process information to provide their services to us.
Information may also be disclosed when required by law, to protect people or the service, or as part of a business transfer. A business may choose to publish portfolio images or business details; material it publishes as public may be viewed by anyone with access to the public link.
Storage and processing locations
The production app's main database and file storage are hosted in Supabase's Canada Central region. Vercel, Stripe, Hatchable, and other service providers may process limited information in other locations under their own service operations. This means some information may be processed outside the province or country where you are located, subject to the providers' terms and applicable law.
Safeguards
Vivid Consent uses safeguards designed for sensitive business and client records, including HTTPS connections, business-level access separation, account roles and permissions, optional multi-factor authentication, access logging, and restricted access to sensitive files such as signed records, treatment photos, and photo identification. No electronic service can guarantee absolute security. Businesses should use individual accounts, limit staff access, protect their devices, and avoid collecting information they do not need.
Retention and deletion
Businesses are responsible for setting and following retention periods that apply to their client records. Vivid Consent does not apply one universal retention period to every client record. We retain account, billing, security, and operational information as reasonably needed to provide the service, meet legal obligations, resolve disputes, and protect the service. Deletion may be delayed where a record must be retained by law or is held in secure backups or audit logs.
To request help with your Vivid Consent account or information, email hello@vividconsent.com. If your information is in a professional's client record, contact that business first; it generally controls the record and can use its Vivid Consent account to manage it.
Website analytics
The marketing website uses first-party analytics to understand visits and improve the site. This may include a random browser identifier, page visited, time of visit, and referring page. You can manage browser storage through your browser settings. We do not sell website analytics or use them to serve targeted advertising.
Changes and contact
We may update this policy when the service or its data practices change. The effective date above shows when it was last revised. For privacy questions or requests, contact hello@vividconsent.com.