Privacy Policy

Effective date: December 19, 2025. Last updated: June 2026.

Introduction

SUGARED + BRONZED® LLC (“SUGARED + BRONZED,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, and share your personal information when you visit sugaredandbronzed.com (the “Site”), use our mobile services, visit our salon locations, or otherwise interact with us.

This Privacy Policy applies to residents of all U.S. states. If you are a resident of Washington or Nevada, please also review our separate Consumer Health Data Privacy Policy, which governs “consumer health data” under the Washington My Health My Data Act and Nevada law and is linked on our homepage.

1. Information we collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“Personal Information”). Categories of Personal Information we collect:

  • A. Identifiers: Name, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, phone number, and account login credentials.

  • B. Commercial Information: Records of products or services purchased, obtained, or considered; consuming histories (e.g., appointment history, membership status).

  • C. Sensitive Personal Information & Consumer Health Data:

    • Health Data: Information regarding skin conditions, allergies, or medications (collected solely for safety during services via our Intake Forms), as well as information about the specific services you receive that may reveal health status. We treat all of this as “sensitive personal information” under the CCPA and as “consumer health data” under applicable state health-privacy laws. We do not sell or share this information, and we do not use it for targeted advertising..

    • Washington & Nevada Residents: This category constitutes “Consumer Health Data” under the My Health My Data Act (MHMDA) and comparable Nevada law. We collect this strictly for service safety and customization and do not sell it. You may withdraw consent and request deletion of your consumer health data as described in our separate Consumer Health Data Privacy Policy.

  • D. Internet/Network Activity: Browsing history, search history, and information regarding a consumer’s interaction with our website or advertisement (via cookies/pixels).

  • E. Geolocation Data: Approximate location derived from IP address.

  • F. Inferences: Inferences we draw from the information above to create a profile reflecting your preferences, characteristics, and predispositions.

2. How we collect your information

We collect this information from the following sources:

  • Directly from you: When you book an appointment, fill out a client intake form, create an account, purchase a membership, or sign up for SMS/email marketing.

  • Automatically: As you navigate the Site (cookies, logs, web beacons).

  • Third Parties: From service providers (e.g., our booking platform, payment processors) or advertising partners (e.g., Google, Meta).

3. How we use your information

We use your Personal Information for the following business purposes. We collect and use only the personal information that is reasonably necessary and proportionate to provide the services you request and to accomplish the purposes described in this Policy, consistent with applicable data-minimization requirements (including the Maryland Online Data Privacy Act).

  • Service Fulfillment: To schedule appointments, process payments, and provide sugaring/tanning services safely (including reviewing health contraindications).

  • Customer Service: To respond to your inquiries and manage your account.

  • Marketing: To send you text messages (SMS) and emails regarding promotions, new products, and appointment reminders (subject to your consent).

  • Loyalty & Referral Programs: To operate our memberships, our “Refer a Friend” program, and other promotions (see “Financial Incentives” below).

  • Safety & Security: To detect security incidents and protect against malicious activity.

  • Improvement: To analyze site usage and improve our services and user experience.

4. Sharing your information

We do not sell your Personal Information for monetary value. However, under California law, sharing data with advertising networks (like Google or Meta) for cross-context behavioral advertising may be considered “Sharing.” We do not sell or share your sensitive personal information or consumer health data, and we do not use those categories for targeted advertising. We do not knowingly sell or share, or use for targeted advertising, the personal information of consumers we know to be under 16 without opt-in consent, and we comply with stricter state prohibitions applicable to consumers under 18.

We may disclose your personal information to:

  • Service Providers: Companies that perform services on our behalf (e.g., Shopify for e-commerce, Booking Software, Payment Processors). They are contractually prohibited from retaining, using, or disclosing your information for any purpose other than providing the services to us.

  • Advertising Partners: We use third-party tracking tools (such as Google Ads and Meta Pixel) to serve you personalized ads based on your browsing activity. In addition to website pixels, we may upload limited contact information you provide when you book or purchase — such as your name and email address, and in some cases your mobile number — to advertising platforms including Google (Customer Match) and Meta (Custom Audiences) to show you our ads and reach similar audiences. We do not include your health, skin-condition, intake-form, or specific service information in these uploads. You may opt out at any time through our Do Not Sell or Share My Personal Information page or via a Global Privacy Control signal, and we suppress opted-out individuals from these uploads.

  • Legal & Corporate: We may disclose personal information to comply with law or legal process, to protect our rights and safety, or in connection with a merger, financing, or sale of all or part of our business.

5. Your California privacy rights (CCPA/CPRA)

If you are a resident of California, you have specific rights regarding your Personal Information:

  • Right to Know: You have the right to request that we disclose the specific pieces of Personal Information we have collected about you, the categories of sources, and the business purpose for collecting it.

  • Right to Delete: You have the right to request that we delete Personal Information that we have collected from you (subject to certain exceptions).

  • Right to Correct: You have the right to request that we correct inaccurate Personal Information.

  • Right to Opt-Out of Sale/Sharing and Targeted Advertising: You have the right to opt-out of the sale or sharing of your personal information for cross-context behavioral advertising. You may exercise this right through our Do Not Sell or Share My Personal Information page.

  • Sensitive personal information: We use your sensitive personal information (such as health and skin-condition data) only for the purposes permitted under the CCPA — providing your services safely and related operational purposes. Because we do not use or disclose it for other purposes, and do not sell or share it or use it for targeted advertising, we are not required to offer a separate option to limit its use.

  • Right Regarding Automated Decisionmaking/Profiling: To the extent we use automated decisionmaking technology that produces legal or similarly significant effects about you, you may have the right to opt out and to obtain information about it. We do not currently use automated decisionmaking technology for such purposes.

  • Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Global Privacy Control (GPC): Our website is configured to recognize the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we will treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device, both in California and in other states that recognize universal opt-out mechanisms.

6. Notice to European users (GDPR & UK GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, the following rights apply to you. SUGARED + BRONZED® LLC is the “Data Controller” of your personal information.

  • Legal Basis for Processing: We process your data based on: Contract (to fulfill appointments and orders); Consent (for marketing communications, withdrawable at any time); Legitimate Interests (for fraud prevention and security); and Legal Obligation (for tax and accounting laws).

  • Your Rights: You have the right to access, rectify, erase (“Right to be Forgotten”), restrict processing, and port your data to another service. You also have the right to object to processing based on legitimate interests.

  • International Transfers: Your data is transferred to and processed in the United States. We rely on standard contractual clauses (SCCs) or the EU-US Data Privacy Framework where applicable to ensure data protection.

  • Complaints: You have the right to lodge a complaint with your local Data Protection Authority (DPA) or the UK Information Commissioner’s Office (ICO).

7. Additional U.S. state privacy rights

If you are a resident of a U.S. state with a comprehensive consumer privacy law — currently including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, and Rhode Island — you may have some or all of the following rights, depending on your state of residence:

  • Access & Portability: To confirm whether we process your personal information, access it, and obtain a portable copy.

  • Correction & Deletion: To correct inaccuracies in, and request deletion of, your personal information.

  • Opt-Out: To opt out of (i) the sale of your personal information, (ii) targeted advertising, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects. We honor recognized universal opt-out mechanisms (such as Global Privacy Control) in states that require it.

  • Right to Opt-In for Sensitive Data: We will not process your “Sensitive Data” (e.g., health/skin condition data) without your explicit consent. By submitting your Client Intake Form, you explicitly consent to this processing for service safety. We do not sell sensitive data in any state, including Maryland, where such sales are prohibited.

  • Minors: Where we know a consumer is a minor, we obtain opt-in consent before any sale, sharing, or targeted advertising as required (under 16 in California; 13–16 in New Jersey; up to 17 in Connecticut, Colorado, and Delaware), and we comply with state laws that prohibit targeted advertising to minors entirely.

  • Right to Appeal: If we decline your privacy request, we will explain why. You may appeal this decision by emailing customerservice@sugaredandbronzed.com with the subject line “Privacy Appeal.”

Financial incentives (notice of financial incentive)

We offer programs that may be considered “financial incentives” under the CCPA because they provide benefits in exchange for the collection or retention of personal information, including: monthly memberships (offering discounts on services and retail), our “Refer a Friend” program (a credit for you and the person you refer), and email/SMS sign-up offers. Material terms: to participate, you provide identifiers such as your name, email, and/or phone number; participation is voluntary and you may opt in by enrolling and withdraw at any time by canceling, unsubscribing, or contacting us. We will not discriminate against you for declining to participate.

Value of your information and how we calculated it. We estimate the value of the personal information involved using the expenses reasonably related to each offer (a method permitted under the CCPA regulations): 

  • Memberships: the value is reasonably related to the discount and benefits a member receives — member pricing on services and retail, and rollover of unused services. We calculate it based on the expenses reasonably related to providing the membership discount.

  • Refer a Friend: the value equals the referral credit issued — $10 to you and $10 to the person you refer.

  • Sign-up offers: the value equals the sign-up discount we provide (if any). Where no discount is provided, the program is not a financial incentive.

8. How to exercise your rights

To submit a request regarding your data (Access, Delete, Correct, or Opt-Out), please contact us using one of the methods below. Because we operate physical salon locations, we provide more than one method:

  • Email: customerservice@sugaredandbronzed.com (Re: Privacy Request)

  • Opt-out located on our CCPA Compliance page

We will confirm receipt of your request within 10 business days and will verify your identity before processing it. We will respond within 45 days (extendable once where permitted). You may use an authorized agent to submit a request on your behalf; we may require written proof of authorization.

9. Data retention

We retain your Personal Information only for as long as is reasonably necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. In general: account and transaction records are retained as required by tax and accounting law (typically up to 7 years); health/intake information is retained only as long as needed for service safety and applicable recordkeeping; and marketing contact data is retained until you opt out or become inactive. We delete or de-identify personal information when it is no longer needed.

10. SMS / mobile privacy

By subscribing to SUGARED + BRONZED text notifications, you agree to receive recurring automated marketing and transactional messages. Message and data rates may apply. We obtain your express written consent before sending marketing texts, consistent with the Telephone Consumer Protection Act (TCPA).

  • Privacy: We will use the information you provide to send your mobile messages, and as described in Section 4, for our own marketing.

  • Carrier and Advertising Sharing: We share your mobile number with the messaging vendors that deliver our texts, and we may share your contact information — including your mobile number — with advertising platforms such as Google and Meta to deliver our own ads. We do not sell your mobile number, and we do not share it with unaffiliated third parties for those third parties’ own marketing. Sharing with advertising platforms is a “share” for cross-context behavioral advertising under California law; you may opt out at any time and we honor Global Privacy Control signals.

  • Opt-Out: Text “STOP” to our short code at any time to cancel. Opting out of texts also removes your mobile number from advertising-platform uploads.

11. Cookies & tracking technologies

We use cookies, pixels, tags, and similar technologies (including the Meta Pixel and Google tags) to enhance your experience, measure performance, and deliver advertising.

  • Consent & control: Where required, we present a cookie consent/preference tool that lets you accept or decline non-essential cookies, and we honor Global Privacy Control signals.

  • Management: You can choose to disable cookies through your browser settings.

  • Interest-based advertising: You can opt out of many interest-based ads through the DAA (optout.aboutads.info) and NAI (optout.networkadvertising.org) tools.

  • Google Analytics: You can opt-out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.

  • Health information: We do not configure our advertising trackers to capture your intake-form responses or health information.

12. Children’s and minors’ privacy

Our Site and services are not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it. Consistent with the amended COPPA Rule, we do not condition participation on more information than is reasonably necessary and do not disclose children’s information to third parties for targeted advertising. For minors under 18, we do not knowingly sell or share their personal information, or use it for targeted advertising, without opt-in consent where required, and we comply with state laws that further restrict or prohibit such activities.

13. Data security

We implement reasonable administrative, technical, and physical security measures to protect your information, consistent with applicable laws including the New York SHIELD Act. However, no method of transmission over the Internet is 100% secure. In the event of a data breach affecting your personal information, we will notify you and applicable regulators as required by law.

14. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on our Site. We will revise the “Last updated” date above when we make changes.

15. Contact information

If you have questions about this Privacy Policy, please contact us: SUGARED + BRONZED® LLC, Email: customerservice@sugaredandbronzed.com.