Privacy Policy

• Booking details: your name, email address, phone number, Instagram handle (optional), inspiration photo link (optional), notes, the services you choose, and your appointment date and time.
• Policy acknowledgments: the times you read and re-confirmed our booking policy.
• Technical data: IP address, browser type and pages visited, collected automatically for security and to prevent spam (for example, rate limiting).
• Communications: messages you send us by email, text or Instagram.

We do not collect or store payment card numbers on this website. Deposits are processed by Stripe on Stripe's secure checkout page, under Stripe's own privacy policy (stripe.com/privacy). We keep a record that the deposit was paid and Stripe's payment reference.

• To schedule, confirm, change and manage your appointment.
• To send booking emails and appointment-related texts or calls.
• To track deposits and keep a record of cancellations, late arrivals and no-shows.
• To prevent fraud, spam and abuse, including declining bookings from people who previously violated our policies.
• To keep records required for tax, legal and insurance purposes.

We do not sell your personal information, and we do not share it for third-party advertising.

We use trusted service providers who process data only to help us run the business: Supabase (database and login), Resend (booking emails), and Vercel (website hosting). If the live feed is enabled, Instagram (Meta) supplies public posts to this site. We may also disclose information if required by law or to protect our rights, safety or property.

If a client repeatedly no-shows, behaves abusively, charges back a deposit or otherwise seriously violates our policies, we may record their name, email and phone number on a private list so we can decline future bookings. This list is kept internally and is not shared or published.

The public website does not use advertising or tracking cookies. Essential cookies are used only for the owner's secure login. Embedded Instagram posts, when shown, may set their own cookies under Instagram's policies.

We keep appointment records for up to 7 years for tax, accounting and dispute purposes, then delete or anonymize them. Rate-limiting data is deleted automatically within a day.

Data is stored with Supabase using encryption in transit and role-based access controls, and only the owner can access client records. No system is 100% secure, so we cannot guarantee absolute security.

You may ask to see, correct or delete the personal information we hold about you, or object to certain uses, by contacting us (details below). Depending on where you live (for example California, Colorado, Virginia or other states with privacy laws), you may have additional rights, including the right to know, delete, correct and opt out of the sale or sharing of personal information. We do not sell or share personal information. We will not discriminate against you for exercising your rights. We may need to keep some information where the law requires it. To stop texts, reply STOP (see Text & Photo Consent).

Our online booking is intended for adults 18 and over. We do not knowingly collect information from children under 13. A parent or guardian must book for and attend appointments with anyone under 18.

We may update this policy and will change the date at the top when we do. Questions or requests? Message us on Instagram at @taysbeautygarden or reply to any of our booking emails.