Cuts by Amber Privacy Policy

Cuts by Amber, a DBA of Red River Prairie Group LLC ("we," "our," or "us"), respects your privacy. This Privacy Policy explains how information is collected, used, stored, and shared when you use Cuts by Amber services.

This policy is intended to align with Apple App Store privacy expectations, Square requirements, and applicable Texas and U.S. legal requirements.

1. Information We Collect

We may collect the following categories of information:

• Contact information: name, phone number, email address.
• Profile information: birthdate (if you provide it).
• Appointment information: requested service, date/time, notes or preferences.
• Profile verification information: the email address or phone number used to look up a Square customer profile, one-time verification challenge data, verification attempts, and short-lived session information.
• Website usage details: pages visited, referring pages, approximate device/browser details, and request timestamps.
• Analytics data, if Google Analytics 4 is enabled: information about website interactions, device/browser context, and approximate location derived from the connection.
• Booking form details: submitted selections, communication preferences, and basic anti-spam validation fields.
• Sweepstakes and giveaway entry details: name, phone number, email address, referral source, eligibility acknowledgments, entry timestamps, and limited hashed identifiers used to apply entry limits.
• Public review content: selected review text, ratings, dates, source labels, and source links retrieved from Google or Facebook when those integrations are enabled.
• Technical/app information: limited diagnostics and usage data made available by Apple platforms.
• Push-notification information: if you choose to enable appointment reminders and updates in the iOS app, an Apple Push Notification service (APNs) device token, the associated customer record, and token-registration status.
• Payment information: payment credentials are processed by Square; we do not store full card numbers in-app.
• Cookie/similar technology data from linked web services where applicable.

2. How We Use Information

We use information to:

• Provide booking and scheduling services.
• Create and manage customer records.
• Send confirmations, reminders, updates, and service messages.
• Protect booking workflows, prevent abusive traffic, and detect suspicious activity.
• Send promotions and marketing communications (subject to your choices and applicable law).
• Support internal business tools and app operations.
• Improve reliability, security, and user experience.
• Comply with legal obligations and prevent fraud/misuse.

Mobile App Use and Permissions

If you use a Cuts by Amber iOS app, the app may request device permissions only when needed for app features (for example, notifications, camera/photos, or location if those features are enabled in the app).

You can manage or revoke app permissions at any time through iOS Settings. Disabling certain permissions may limit related app features.

If you choose to enable appointment reminders and updates, the app registers a device token with Apple Push Notification service (APNs) and sends that token to our server after your profile is verified. We use the token only to send transactional appointment confirmations, cancellations, rescheduling updates, and reminders to that device. We do not use APNs device tokens for marketing notifications under the current app configuration.

You may disable appointment push notifications in the app or iOS Settings. Disabling them removes the device token from our active notification registry when the app can reach our service; disabling notifications in iOS Settings also prevents delivery by Apple. Push notifications may be delayed or unavailable because of device, network, or platform conditions.

Where required by Apple or applicable law, in-app permission prompts provide just-in-time notice before access to protected device features.

If biometric sign-in is enabled, device-level authentication (such as Face ID or Touch ID) is processed by Apple on your device. Cuts by Amber does not collect or store biometric templates.

If location access is enabled, location data is used only for enabled app features and may include foreground and, where specifically enabled by you, background access. You can disable location permissions in iOS Settings.

If in-app purchases or subscriptions are offered, payment and billing details are processed by Apple under App Store terms. Cuts by Amber may receive limited transaction status data needed to provide services and support.

3. Purpose and Use of Collected Personal Information

Collected personal information is used for customer service, appointment management, business administration, communications, promotions, lawful internal app operations, and legal compliance.

Sweepstakes and Giveaways

When you enter a Cuts by Amber sweepstakes, giveaway, contest, or similar promotion, we collect the information requested in the entry form, which may include your name, email address, phone number, referral source, and eligibility acknowledgments. We use this information to administer the promotion, verify eligibility, apply entry limits, select and contact a winner, handle prize claims, resolve questions or disputes, and maintain required records.

Entry information may be processed through our website entry system and, when used for a particular promotion, Google Forms and Google Sheets. We retain promotion entry information only as long as reasonably necessary to administer the promotion, handle prize claims, resolve questions or disputes, and meet applicable legal, tax, fraud-prevention, and recordkeeping obligations.

Entering a promotion does not enroll you in marketing emails, text messages, or other promotional communications unless you separately choose to opt in. Marketing consent is not required to enter or win a promotion.

4. How We Share Information

We do not sell personal information. We may share information with:

Booking and customer personal data used by the scheduling workflow is stored and managed in Square systems. Our PHP API endpoints act as an integration layer to push and pull required booking and customer data to and from Square.

• Square APIs: for availability searches, booking creation and management, customer record creation or association, appointment updates, and related scheduling workflows. Depending on the action, requests may include service and location IDs, appointment date/time, customer name, email, phone, booking notes, and communication preferences. Full payment card numbers are not stored in our app-managed systems.
• Twilio and email delivery providers: when profile verification is requested, the selected contact information and one-time code are sent through the configured SMS and/or email delivery provider. Verification challenges and sessions are short-lived and are not intended to serve as permanent account credentials.
• Apple/platform services: where platform diagnostics/analytics are processed under Apple policies.
• Apple Push Notification service (APNs): when you enable appointment notifications, Apple processes the device token and notification delivery. Our server keeps the token with the associated customer record solely to deliver transactional appointment notifications.
• Google Places API: our server requests publicly available Google Reviews ratings and reviews using a configured place ID and selected review fields, then displays eligible review content on our website. We do not send personal customer data to Google for this purpose.
• Meta Graph API: when enabled, our server requests selected publicly available reviews or recommendations from the configured Cuts by Amber Facebook Page and displays limited excerpts, source labels, ratings, dates, and links back to Facebook. We do not send booking information or customer contact information to Meta for this review display. Page credentials and access tokens are kept server-side. See the Meta Privacy Policy and Meta Platform Terms.
• TikTok services: if TikTok reporting or account connection is enabled, we may receive limited TikTok account, public video, and performance information authorized by the account owner, such as profile identifiers, video identifiers, views, likes, comments, shares, and publication dates. We use that information only for the connected business reporting features, keep OAuth credentials server-side, do not sell it, and do not use it to create or send content without the required approval. TikTok access may be revoked through TikTok or by contacting us. TikTok authorization data is deleted within 30 days after disconnection unless retention is required for security, legal, accounting, or dispute-resolution purposes. See the TikTok Privacy Policy and TikTok Terms of Service.
• Google Analytics 4: if enabled, Google Analytics may process website usage and device/browser information for analytics and reliability measurement. It is not used for cross-app or cross-website advertising tracking by Cuts by Amber.
• Google Forms and Google Sheets: for sweepstakes, giveaway, contest, or similar promotion entry collection and administration. Depending on the promotion, submitted information may include name, email address, phone number, referral source, and eligibility acknowledgments.
• Service providers: supporting infrastructure and operations under confidentiality obligations.
• Marketing/public channels: pictures, videos, testimonials, comments, reviews, and similar content posted on our website, social media, other online media, or print media may be used for marketing and advertising where permitted by law.
• Legal/compliance requests: when required by law or to protect rights, safety, and security.

Photos and Marketing Content

Photos, videos, testimonials, and other content displayed on this website are used with permission from the content owner, photographer, person depicted, or authorized representative, as applicable. Permission may include use on this website, social media, advertising, and other business marketing materials. If you believe content has been displayed without proper authorization, please contact Cuts by Amber at amberlirette@cutsbyamber.com so we can review the request.

5. Data Retention

We retain information only as long as reasonably necessary for services, records, legal/tax/accounting requirements, dispute resolution, and agreement enforcement.

• Appointment and customer records are retained for business continuity and client support.
• Messaging consent records (including timestamp, source, and phone number) are retained for audit and compliance purposes.
• Sweepstakes, giveaway, contest, and similar promotion entry records are retained for at least two years after the last prize is awarded, and longer when reasonably needed to administer the promotion, handle prize claims, resolve questions or disputes, or meet applicable legal, tax, fraud-prevention, and recordkeeping obligations.
• Technical logs are retained for security monitoring, diagnostics, and abuse prevention for a limited period.
• Active APNs device tokens are retained for up to one year after their most recent registration, unless you disable notifications, the token becomes invalid, or we no longer need it for appointment notifications.
• When data is no longer needed, we delete or de-identify it where reasonably possible.

6. Data Security

We use reasonable administrative, technical, and organizational safeguards to protect personal information. While no system is 100% secure, we work to reduce risk using industry-standard practices.

• Encryption in transit is used where supported (for example, HTTPS/TLS for website and API traffic).
• Access to customer data is limited to authorized personnel and trusted providers with a business need.
• Payment card handling is performed by Square; Cuts by Amber does not store full card numbers.
• Operational safeguards are used to reduce unauthorized access, misuse, and accidental exposure.

7. Cookies, Advertising, and Analytics

To provide passwordless account access across Cuts by Amber website and app subdomains, we use a necessary short-lived secure, HttpOnly session cookie and an opaque browser-session token after successful verification. These session controls authorize account access, appointment management, and booking prefill; they are not used for advertising or cross-website tracking.

If Google Analytics 4 is enabled, Google may use cookies or similar technologies to measure website usage and improve reliability. The current server configuration sends the anonymize_ip setting when GA4 is initialized. Google Analytics is not used by Cuts by Amber for cross-app or cross-website advertising tracking. GA4 data retention and any consent controls are managed in the applicable Google Analytics property settings.

If we run digital advertising or retargeting campaigns in the future, those campaigns will be managed according to applicable law and platform policies, and users may opt out through browser/device controls and platform ad settings.

If TikTok integrations are enabled, TikTok may process information under its own privacy policy and platform terms when you authorize the connection or interact with TikTok links. Cuts by Amber does not receive your TikTok password. We retain only the limited authorization and reporting information needed for the enabled integration and will remove or disconnect it when the connection is revoked or no longer needed, subject to legal and operational recordkeeping requirements.

To request deletion of TikTok connection data, email amberlirette@cutsbyamber.com with the subject “TikTok Data Deletion Request.” Please do not include passwords, access tokens, or other secrets in your request.

You can manage analytics and advertising technologies through:

• Device privacy settings.
• Browser cookie settings on websites.
• Platform advertising preferences.

8. Opt-Out and Access Rights

Depending on your location and applicable law, you may have rights to:

• Access personal information we hold.
• Correct inaccurate information.
• Request deletion.
• Object to/restrict certain processing.
• Withdraw consent where processing depends on consent.
• Opt out of marketing communications.

When you book an appointment and provide your phone number, you consent to receive appointment-related communications, including confirmations, scheduling updates, and reminders, by email and/or text message from Cuts by Amber and/or Square, our booking platform, at the contact details you provide. We may also send one-time non-promotional operational notices, such as a location or closure update, when reasonably needed to support existing customers.

We may also call your provided phone number to confirm, update, or discuss your appointment when needed. These calls are service-related only. We do not place marketing or telemarketing phone calls.

Marketing emails are sent only when permitted by law and your communication choices. Every marketing email includes an unsubscribe method, and opt-out requests are honored as required by applicable law.

Appointment push notifications are optional and separate from SMS and marketing choices. Turning on push notifications authorizes delivery of appointment-related alerts to the device you register; it does not enroll you in marketing texts, marketing emails, or promotional push notifications.

Marketing messages are separate and are sent only when you affirmatively opt in. Marketing texts may include loyalty messages, coupons, discounts, promotions, and service announcements. Opting in to marketing texts also enrolls or maps your phone number to our Square Loyalty program. Loyalty enrollment is separate from appointment booking and is subject to Square’s terms and privacy policy.

You can opt out of text messages at any time by replying STOP (or HELP for help). You can opt out of marketing emails through unsubscribe instructions in the message or by contacting us directly. Message and data rates may apply. Joining a marketing text program is not a condition of purchase.

To submit an access or correction request, contact us using the details below. In the iOS app, a verified customer can start deletion through Account > Account deletion. Website profile access does not create a separate username or password account. Deleting a customer profile removes the active customer profile and registered appointment-notification devices; appointment, transaction, and other records may be retained where required for legal, tax, fraud-prevention, or transaction recordkeeping purposes.

Deletion requests may require identity verification to protect account security and prevent unauthorized data removal. Certain records may be retained as required for legal, tax, fraud-prevention, or transaction recordkeeping purposes.

For reviews posted on third-party platforms (including Google and Facebook), edits or deletions must generally be made through that platform account. If review content appears on our website, you may request that we remove or stop displaying that content on our site, but we cannot directly delete content from third-party platforms unless their tools permit it.

9. Children and Minors

We offer a Kids Cut for children 12 and under. A parent or legal guardian must make and manage any Kids Cut booking. The booking name, contact details, and consent choices must belong to the parent or legal guardian; the child name is collected only when needed to identify the appointment. We do not knowingly create online accounts for children or send marketing messages directly to children, and we do not knowingly collect personal information from minors in violation of applicable law. If discovered, we will take appropriate deletion or remediation steps.

10. Links to Other Websites

Our app and website may contain links to third-party websites and services. Their privacy practices are governed by their own policies.

11. International and Regional Compliance

If you access services outside the U.S., your data may be processed where service providers operate, with safeguards as required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the effective/last-updated dates and, where required, provide additional notice.

13. Security Incident Response

If we become aware of a security incident that affects personal information, we will investigate, contain, and remediate the issue as appropriate.

• We will work with relevant service providers when incident response involves third-party systems.
• Where required by law, affected individuals and authorities will be notified within required timeframes.

14. Contact Us

Cuts by Amber
DBA of Red River Prairie Group LLC
Email: amberlirette@cutsbyamber.com
Phone: (806) 640-7702
Address: 350 NW Parkway St. Suite 500, Azle, TX 76020