Cuts by Amber Data Policy

This Data Policy explains how Cuts by Amber, a DBA of Red River Prairie Group LLC, uses, processes, stores, and protects data when using Square APIs, Apple platform tools, and related internal systems.

1. Scope

This policy applies to data processed through:

• Cuts by Amber application and backend services.
• Cuts by Amber website pages and booking forms at cutsbyamber.com.
• Square APIs (booking, availability, customer records, and related transaction workflows).
• Google Places API, used to display a limited selection of publicly available Google Reviews on our website.
• Meta Graph API, used to retrieve a limited selection of publicly available Facebook Page reviews or recommendations for display on our website, when configured.
• Google Analytics 4, if enabled for website usage and reliability measurement.
• Apple platform tools and services used by the app.
• Internal business tools used for operations and customer support.

2. Data Categories Processed

Data categories may include:

• Customer identifiers: name, phone number, email address, birthdate (if provided).
• Appointment data: selected services, schedule, booking notes, history.
• Gift-card order data: purchaser identifiers, gift value, recipient name and email address, optional personal message, gift-card identifiers, payment/activation records, and transactional delivery status. We use Square for payment and gift-card activation and our email service provider for the requested recipient email; this is not marketing enrollment. Gift-card purchase and delivery records may be retained for transaction support, fraud prevention, and applicable accounting or legal requirements.
• Profile verification data: lookup contact details, one-time verification codes/challenges, failed-attempt counters, short-lived verification sessions, and necessary session cookies or opaque browser-session tokens.
• Operational metadata: request timestamps, service IDs, location IDs, and basic diagnostics.
• Website request metadata: page requests, browser/device context, and referral context where available.
• Analytics event and device/browser data, if Google Analytics 4 is enabled.
• Consent and communication preferences selected during booking flows.
• Marketing/communication preferences where provided.
• Optional announcement push data: an APNs device token, device-scoped installation registration, separate community/shop preferences, permission and registration status, and delivery records. A Square customer profile is not required.
• Square payment SDK data: payment information, user and device identifiers, product interactions, and crash data. The SDK declares these categories as linked to a user, for payment functionality and/or analytics. Not storing full card numbers in our systems does not mean the payment provider collects no payment information.

We do not intentionally store full payment card numbers in app-managed storage.

3. Square API Data Use

Square API usage is limited to legitimate business operations, including:

• Availability lookups.
• Booking creation and management.
• Customer profile creation/association for bookings.
• Operational reconciliation and support.

Booking and customer personal data used by the scheduling workflow is stored and managed in Square systems. Our PHP API endpoints act as an integration layer to push and pull required booking and customer data to and from Square.

Depending on the workflow, Square API requests may include selected service IDs, location IDs, appointment dates and times, customer name, email address, phone number, booking notes, and communication or marketing preferences. Availability searches use service and scheduling data; booking and customer endpoints use the contact and appointment information needed to create, associate, confirm, and manage appointments.

Data sent to Square is limited to the minimum required fields for those functions.

3B. Profile Verification and Appointment Access

The website can look up an existing Square customer profile using an email address or phone number supplied by the customer. Before showing profile details or appointment history, the website sends a one-time verification code through the selected SMS or email delivery provider. Verification challenges expire after a short period, are limited to a small number of attempts, and short-lived verified sessions are used only to authorize profile viewing, preference updates, and eligible appointment viewing, cancellation, or changes. Necessary secure session controls may operate across Cuts by Amber subdomains solely to maintain this verified account access.

The website does not create a separate username-and-password account through this profile feature. Contact information and appointment data remain subject to Square’s systems and retention practices as described in this policy.

3A. Meta Graph API and Facebook Reviews

When Facebook review integration is enabled, our server uses the Meta Graph API to request selected publicly available reviews or recommendations from the configured Cuts by Amber Facebook Page. The website may display a limited number of eligible review excerpts, source labels, ratings, dates, and links back to Facebook.

We do not send booking information or customer contact information to Meta for this review display. Meta credentials, including any Page access token, are kept server-side and are not exposed in the website page. Review requests are made when the review panel loads; the site displays a limited selection and does not intentionally retain a separate long-term review archive. Review content remains subject to Facebook and Meta policies, and users should manage changes or deletions through Facebook. You may also contact Cuts by Amber to request that copied review content be removed from this website. See the Meta Privacy Policy and Meta Platform Terms.

4. Apple Tools and Platform Data

Apple tools and services may process limited diagnostics, platform telemetry, and app operation data according to Apple policies and user device settings.

Cuts by Amber uses Apple platform features to support:

• App functionality and reliability.
• User experience and accessibility.
• Security and fraud-prevention controls.
• Optional delivery of shop-published community and shop announcements through Apple Push Notification service (APNs).

Community and shop topics start off. A guest may enable either topic without signing in; that explicit action requests OS permission when needed and sends the device registration over encrypted transport. Community updates contain shop-selected local announcements, and shop announcements may include offers and promotions. Only an announcement explicitly published and sent by the shop is eligible for push; school and city feeds do not automatically notify devices. Square continues to handle appointment confirmations, reminders, cancellations, and Square Go messages separately.

Device registrations and delivery records are retained as reasonably needed to honor preferences, deliver optional announcements, troubleshoot, and protect the service. Turning off both topics stops future targeting once synced; offline changes can remain pending and in-flight messages may still arrive. Invalid tokens are disabled when identified. Delivery is not guaranteed. APNs credentials remain server-side and are not delivered to the customer app.

5. Purpose Limitation

Collected and processed data is used only for:

• Service delivery and booking operations.
• Customer communications and support.
• Promotions/marketing where allowed by law and user choices.
• Internal operations and app administration.
• Legal and compliance obligations.

6. Data Minimization and Retention

We limit data collection and API payloads to what is reasonably necessary. Retention follows business and legal requirements and may vary by record type.

• Only fields needed for booking, communication, and support are collected in normal workflows.
• Security and operational logs are retained for a limited period for diagnostics and threat monitoring.
• Records are deleted or de-identified when no longer required, where reasonably feasible.

7. Security Controls

Reasonable safeguards are applied, including:

• Controlled access to systems and records.
• Network and infrastructure protections where available.
• Separation of payment credential handling via Square.
• Administrative controls for staff access and workflow boundaries.
• Encryption in transit where supported (for example, HTTPS/TLS for website and API communication).
• Monitoring and review processes to identify misuse, abnormal traffic, and unauthorized access attempts.

8. Sharing and Disclosure

We do not sell personal information.

Where digital advertising or analytics tools are used, data sharing is limited to lawful business purposes and user choice controls where applicable.

Google Places API is used to display a limited selection of publicly available Google Reviews ratings and reviews on our website. Our server requests review data when the review panel loads and does not intentionally retain a separate long-term review archive. Our server sends Google the configured place ID and requested review fields; no personal customer data is sent to Google for this purpose. See the Google Privacy Policy and Google Maps Platform Terms.

When enabled, the Meta Graph API is used to retrieve selected publicly available Facebook Page reviews or recommendations for display on this website. Our server sends Meta the configured Page identifier and authorized review request parameters; booking information and customer contact information are not sent to Meta for this purpose.

If Google Analytics 4 is enabled, Google may process website usage and device/browser data for analytics and reliability measurement. The current server configuration sends the anonymize_ip setting when GA4 is initialized. GA4 data retention and any consent controls are managed in the applicable Google Analytics property settings. Cuts by Amber does not use it for cross-app or cross-website advertising tracking.

Data may be shared with:

• Square and required service providers.
• Google, where Google Places API or optional Google Analytics 4 processing is enabled for the purposes described above.
• Meta, where the Meta Graph API integration is enabled for the limited Facebook review display described above.
• Apple platform services where relevant to app operation.
• Apple Push Notification service, when a customer enables community or shop announcements, for device-token processing and notification delivery.
• Business marketing channels, including website placements, social media, other online media, and print media, for pictures, videos, testimonials, comments, reviews, and similar content where permitted by law.
• Authorities where legally required.

9. User Rights and Requests

Users may request access, correction, or applicable opt-out choices by contacting Cuts by Amber. In the customer iOS app, a verified customer can delete the profile through Profile > Delete account. Successful deletion removes the active Square customer profile, authentication sessions, associated session-contact records, and owner-scoped contact-verification records. A necessary deletion retry record may temporarily remain if cleanup fails; the app does not report success until cleanup finishes. Appointment, order, payment, and other records may be retained where required for legal, tax, fraud-prevention, or transaction recordkeeping purposes. The website profile feature does not create a separate username-and-password account.

When a user books an appointment and provides a phone number, appointment-related communications, including confirmations, scheduling updates, and reminders, may be sent by email and/or SMS from Cuts by Amber and/or Square, our booking platform, to the provided contact details. We may also send one-time non-promotional operational notices, such as a location or closure update, when reasonably needed to support existing customers.

Cuts by Amber may also place service-related calls to confirm, update, or discuss appointments using the provided phone number. Cuts by Amber does not place marketing or telemarketing phone calls.

Marketing emails are managed separately from transactional service notices and include unsubscribe instructions. Opt-out requests are processed according to applicable law and platform requirements.

Device-scoped community/shop subscriptions remain independent of sign-in and account deletion. Profile > Settings > Manage notifications remains available without an account and lets you disable either topic or unsubscribe from both. These choices do not enroll you in SMS or email marketing and do not change Square appointment messages. You may also disable OS permission in iPhone Settings.

Marketing messages are processed separately and are sent only when a user affirmatively opts in. Marketing texts may include coupons, discounts, promotions, and service announcements. Cuts by Amber does not offer a loyalty or points-based rewards program. Marketing consent does not enroll you in one.

Users can opt out of SMS messages by replying STOP (or HELP for help) and can opt out of marketing emails through unsubscribe instructions or by contacting Cuts by Amber. Message and data rates may apply. Joining a marketing text program is not a condition of purchase.

For review content sourced from third-party platforms such as Google and Facebook, users should manage edits or deletions through the originating platform account. Upon request, Cuts by Amber can remove or stop displaying copied/highlighted review content on this website, but cannot directly remove content from third-party platforms unless platform tools permit it.

10. Minors

We offer a Kids Cut for children 12 and under. A parent or legal guardian must make and manage any Kids Cut booking. The booking name, contact details, and consent choices must belong to the parent or legal guardian; the child name is collected only when needed to identify the appointment. We do not knowingly create online accounts for children or send marketing messages directly to children, and we do not knowingly collect personal information from minors in violation of applicable law. If discovered, appropriate deletion or remediation steps are taken.

11. Compliance Alignment

This Data Policy is intended to align with:

• Square developer and platform data handling expectations.
• Apple App Store and Apple platform privacy expectations.
• Applicable Texas and U.S. legal requirements.

12. Security Incident Response

If a security event affects customer information, we will investigate, contain, and remediate the issue according to applicable requirements.

• We coordinate incident response with relevant providers when third-party systems are involved.
• Where required by law, notifications are provided to affected users and authorities.

13. Contact

Cuts by Amber
DBA of Red River Prairie Group LLC
Email: amberlirette@cutsbyamber.com
Phone: (806) 640-7702
Address: 350 NW Parkway St. Suite 500, Azle, TX 76020