What 'we never sell your clients' data' actually rules out

"We never sell your data" shows up on so many software homepages that it's become wallpaper — a sentence you're trained to skip on the way to the pricing table. That's a shame, because it's one of the few promises in this industry specific enough to actually test. A line that vague deserves to be held to something concrete: what, exactly, does it rule out, and what does it leave standing?

For a massage practice the stakes sit a notch higher than for most small businesses. An intake form and a set of chart notes can carry medical history, medications, areas of chronic pain — sometimes more than a client's own doctor sees in a year. That's exactly the kind of information a scheduling tool ends up holding, which is why the plain-language version of this promise matters more here than it would for a tool that just books restaurant tables.

What the promise is supposed to cover

At minimum, "we never sell your clients' data" should rule out three things: handing client contact information to a data broker for resale, renting a client list to a marketing company, and placing ad-tracking scripts on any page where client information lives — the browser pixels that quietly report back to a big ad platform every time someone fills out an intake form. If a vendor's privacy policy can't speak plainly to those three, the tagline on the homepage is doing more work than the policy behind it.

One reviewer's account worth reading carefully

A Vagaro reviewer, writing on Capterra on September 13, described their own software this way: it will "share client info across other businesses." That's one person's account of one platform — not a verdict on scheduling software generally. We looked for a second instance before writing this and didn't find one. Worth taking seriously as a specific, named complaint; not worth stretching into a pattern that isn't there yet.

The honest catch

Here's the part a clean-sounding privacy line tends to skip: "we don't sell your data" and "we comply with privacy law" are two different promises, and compliance is the floor, not the whole house. A vendor can stay fully inside the law and still run co-marketing arrangements, "partner" integrations that pass contact details along, or list your business — and by extension the people who book with you — inside a marketplace or directory you never asked to join. None of that shows up if you only read the tagline. It shows up if you read the actual privacy policy and look for the word "partners."

Four questions worth asking any vendor, including us

• Does the privacy policy name specific categories of third parties, or just say "partners"? A policy that names categories — payment processors, the SMS carrier — and stops there is a different promise than one that leaves room for "service providers we may add in the future."
• Is there a tracking script anywhere a client actually sees — the booking page, the intake form, the confirmation screen? Not every tracker is nefarious, but it answers the "no ad trackers" question better than any sentence can.
• If you cancel, does your full client list and chart history export with you, or does it stay behind?
• Is the BAA actually included, or available "on request" — a phrase that in practice means a phone call and a wait?

What this rules out, specifically, for Stillbook

Since we're asking vendors to answer plainly, here's our own answer, checked against the live site rather than memory. Stillbook's homepage states "We never sell your clients' data — no ad trackers on anything that touches it," and frames the standard in professional terms worth naming directly: it "meets your board's confidentiality duty" — the standard your license already holds you to, not a vague tech-company promise on top of it. The pricing page confirms the BAA is included at signup, countersigned automatically, not something you request and then wait on. Export is unrestricted and ongoing — you can pull your full practice data any time and delete your account, with no lock-in.

That doesn't mean there's no analytics anywhere near stillbook.app. The marketing pages you're reading right now — the ones with no client information on them — run ordinary site analytics and an ad-conversion tag, the same as almost every website does. The promise is narrower and more useful than "we track nothing": none of that tooling runs on a page where a client's name, phone number, or health information lives.

A privacy line that can survive being asked "what does that actually mean" is worth more than one that can't. That's the bar worth holding every vendor to while you compare — Stillbook included, and our Stillbook vs. Vagaro comparison covers the fuller picture separately if you want it.