Privacy Policy

1. Information We Collect

We collect information you provide directly to us when you:

• Create an account (name, email, phone number)
• Book an appointment (service preferences, stylist choice, scheduling)
• Make a payment (payment method details are handled by Stripe — we never store full card numbers)
• Leave a review or upload photos
• Contact us or participate in our loyalty program

2. How We Use Your Information

• Process and manage your appointments
• Send booking confirmations, reminders, and receipts
• Administer our loyalty and rewards program
• Respond to your inquiries and provide customer support
• Improve our services and personalize your experience
• Comply with legal obligations

3. Payment Information

All payment processing is handled by Stripe, which is PCI DSS compliant. We do not store your full credit card number, CVV, or bank account details on our servers. We only retain the minimum data needed to reference your transactions (e.g., Stripe payment IDs and amounts).

4. Data Sharing

We do not sell your personal information. We share data only with:

• Stripe — for secure payment processing
• Twilio — for SMS appointment reminders (only if you opt in)
• Service providers — who assist in operating our platform under strict data protection agreements
• Legal authorities — when required by law

5. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate data
• Erasure — Request deletion of your data
• Portability — Export your data in a machine-readable format
• Objection — Object to processing based on legitimate interests
• Restriction — Request restriction of processing in certain circumstances

To exercise these rights, visit Data Rights or contact us at hello@blossomregalbraids.com.

6. Cookies

We use cookies for essential site functionality (session management, CSRF protection), preferences (dark mode, language), and analytics. You can manage your cookie preferences using the consent banner on our site.

7. Data Security

We implement industry-standard security measures including encryption, secure session handling, input validation, rate limiting, and regular security audits. All web traffic is encrypted via HTTPS. Payment data is processed exclusively through PCI-compliant providers.

8. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy, or as required by law. Financial records are retained for 7 years per tax regulations. You may request earlier deletion per your GDPR rights.

9. Contact

For privacy-related inquiries, contact us at: