Privacy Policy

What we collect

Two things, and they are very different from each other.

What you send us. If you use the contact form, we receive your name, email address, phone number if you choose to give one, and whatever you write in the message. That is it — there is no account to create, nothing to log in to, and no newsletter on this site.

How the site is used. Analytics records pages viewed, roughly where in the world the visit came from, which site referred you, the kind of device and browser, and two specific interactions: clicking through to book a treatment, and how far down the services menu you read. This is measured to learn which treatments people are actually looking for.

What we do not collect

We do not take payments on this site, so we never see your card details. Payment happens on GlossGenius.

We do not ask for health information on this website. Please do not put medical history, medications, or other sensitive health details into the contact form — it travels by ordinary email. Bring it to your appointment or your intake paperwork instead, where it belongs.

We are not a HIPAA covered entity and this site makes no HIPAA claim.

Cookies and analytics

We use two analytics tools, on purpose, and they behave differently.

Umami is self-hosted on our own infrastructure. It sets no cookies, records no personal data, and does not follow you anywhere. It is the measurement we rely on.

Google Analytics 4, loaded through Google Tag Manager, is also present so the studio can read its numbers in a familiar place. GA4 does set cookies (typically `_ga` and `_ga_*`) and processes data on Google's infrastructure under Google's terms.

Google Consent Mode is configured so that visitors in the EEA, the UK and Switzerland default to denied — no analytics or advertising cookies are set there unless consent is given, and there is currently no consent banner, so that default stands. Elsewhere, including Colorado, analytics storage defaults to granted.

Cloudflare, which serves and protects the site, may set a security cookie such as `__cf_bm` to tell humans from bots. Cloudflare Turnstile does the same job on the contact form, without the puzzles.

This site runs no advertising or remarketing tags. We do not sell your personal data, we do not share it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects.

Turning analytics off

You can block all of it and the site will work exactly the same:

• Use any content blocker — GA4 and Google Tag Manager are on every blocklist there is.
• Install Google's own opt-out browser add-on.
• Turn on your browser's tracking protection, or browse privately.

Who we share it with

We do not sell your information. It reaches these services only because they perform a function the site needs:

• Mailgun — delivers the contact form to the studio's inbox. Your message passes through their systems as email.
• Google (Tag Manager and Analytics 4) — website analytics.
• Cloudflare — serves the site, provides the domain's DNS, and runs the Turnstile anti-spam check.
• GlossGenius — booking and payment. You reach them by clicking a booking link. Anything you enter there is governed by their privacy policy, not this one.
• Earth Coast Productions — builds and maintains the site, and hosts the self-hosted Umami analytics.

How long we keep it

Contact form enquiries stay in the studio's email for as long as they are useful — to answer you, and to keep a record of what was discussed if you become a client. You can ask us to delete yours.

Analytics is retained according to the settings in Google Analytics and in our Umami instance. Neither identifies you by name.

Your rights in Colorado

The Colorado Privacy Act gives Colorado residents the right to know what personal data we hold, to get a copy of it, to correct it, to delete it, and to opt out of its sale or use for targeted advertising. As above, we do not sell data and run no advertising tags, so there is nothing to opt out of on that front.

To exercise any of these, use the contact form or call the studio. We will respond as promptly as we reasonably can, and if we refuse a request you may appeal by replying to tell us so.

Rights under other laws, including the GDPR if you are contacting us from Europe, are honoured on the same basis.

Children

This website is not directed to children under 16 and we do not knowingly collect their personal information. If you believe a child has sent us something through this site, contact us and we will delete it.

Security

The site is served over HTTPS, the contact form is protected against automated abuse, and access to the studio's email is limited to the studio. No website can promise perfect security, and we will not pretend otherwise.

Changes

If this policy changes in a way that matters, the date at the top changes with it. There is no version history on this page — the current text is the policy.