Privacy Policy

Privacy Policy

This Privacy Policy describes how we collect, use, and protect personal information when you visit this website or submit an inquiry. By using the site you agree to the practices described here.

1. Who we are. This website is operated by the business named in the site footer. Inquiries can be sent through the Contact page. Online booking or shop features may be offered when enabled by the site owner.

2. What we collect.

• Contact form submissions: name, email, phone number, text-message consent (optional, with the time it was given), message text, and the timestamp of submission.
• Newsletter signups: email address, optional first name, marketing consent timestamp, and an unsubscribe token used to honor opt-out requests (when newsletter features are enabled).
• Appointment or card-on-file booking: when booking is enabled, service selection, appointment time, intake answers, e-sign artifacts, and payment-provider identifiers (for example Stripe Customer / PaymentMethod ids and card brand/last-four) as configured by the site owner. Full card numbers and security codes are handled by the payment provider and are not vaulted in this application.
• Site usage: standard server logs (IP address, browser user-agent, pages visited) used for security, debugging, and abuse prevention. These are not used for marketing profiling.
• Admin accounts: if you are an authorized administrator, we store your login email, hashed password, role assignments, session metadata, and an admin activity log.

3. How we use the information. We use submitted personal information to respond to your inquiry, to fulfill services, to schedule appointments when booking is enabled, to send transactional confirmations, and to keep business records. If you opt in to a newsletter, we use your email for those messages. We do not sell or rent personal information. We do not use contact-form data for unrelated marketing without your separate opt-in. If you opt in to text messages, we use your phone number only for transactional texts about your inquiry or appointment. We will not share or sell your mobile information to third parties for marketing purposes.

4. Third-party service providers. We use a small number of vendors that process information on our behalf as part of running the site. Each operates under its own privacy policy:

• Mailgun — outbound transactional email delivery.
• Telnyx — text-message delivery, only when you opt in to texts.
• Microsoft Azure Blob Storage — file and content storage.
• Cloudflare R2 / CDN — static asset delivery and caching (when configured).
• Hosting provider — web application hosting for this site.
• Stripe — card-on-file or payments when booking/payment features are configured. See Stripe's Privacy Policy.
• Google Analytics (GA4) — aggregated public-site traffic measurement when enabled (page path, referrer, device/browser type). See Google's Privacy Policy.

5. Cookies & session data. The public site may load Google Analytics 4 (gtag) when a Measurement ID is configured. When the optional cookie consent banner is enabled, analytics scripts load only after you Accept; Decline keeps GA4 off in that browser. When the banner is disabled, a configured Measurement ID may load gtag without a prompt. GA4 helps us understand aggregate traffic. It is not used for advertising remarketing on this site by default. You can limit Google advertising personalization via Google Ads Settings. The admin portal sets a session cookie when an administrator signs in; that cookie is required for the portal to function and is separate from public analytics. Consent preferences are stored in local browser storage (not as a server cookie) when the banner is used.

6. Email open and click tracking. Transactional emails sent from the admin tools may include a tiny tracking pixel and wrapped links so the site owner can confirm that confirmation emails were delivered and read. These are used for delivery diagnostics, not advertising.

7. Data retention. Contact inquiries and related email history are retained for as long as needed to service the inquiry and meet recordkeeping needs. Booking and payment metadata (when enabled) are retained for operations and recordkeeping unless you request earlier deletion where applicable. Standard server logs are retained per the configured retention window (90 days by default) and then deleted. You may request earlier deletion at any time (see Section 10).

8. Security. We use industry-standard measures including TLS in transit, hashed passwords, role-based access controls, and audit logging. No system is perfectly secure; we cannot guarantee that information will never be intercepted or compromised.

9. Newsletter unsubscribe. Marketing emails include a one-click unsubscribe link. You may also opt out through our email opt-out page or by requesting removal through the Contact page. We honor unsubscribe requests promptly.

10. Your rights. Depending on your location, you may have rights to access, correct, or delete personal information we hold about you, or to opt out of certain processing. Send requests through the Contact page and we will respond within applicable legal timeframes.

11. Children. This site is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has submitted information through the site, please notify us and we will delete it.

12. International visitors. The site is operated in the United States unless otherwise stated. By using the site you understand that your information may be processed in the United States, which may have different privacy laws than your country of residence.

13. Changes to this policy. We may update this policy from time to time. Changes take effect when posted to this page.

14. Contact for privacy requests. Privacy questions and rights requests can be sent through the Contact page.