Cuts by Amber Privacy Policy

Cuts by Amber, a DBA of Red River Prairie Group LLC ("we," "our," or "us"), respects your privacy. This Privacy Policy explains how information is collected, used, stored, and shared when you use Cuts by Amber services.

This policy is intended to align with Apple App Store privacy expectations, Square requirements, and applicable Texas and U.S. legal requirements.

1. Information We Collect

We may collect the following categories of information:

• Contact information: name, phone number, email address.
• Profile information: birthdate (if you provide it).
• Gift-card order information: the purchaser's verified customer record, gift value, recipient name and email address, optional personal message, gift-card identifiers, payment and activation records, and transactional email status. Gift-card numbers are value credentials and are different from bank payment-card numbers.
• Appointment information: requested service, date/time, notes or preferences.
• Profile verification information: the email address or phone number used to look up a Square customer profile, one-time verification challenge data, verification attempts, and short-lived session information.
• Website usage details: pages visited, referring pages, approximate device/browser details, and request timestamps.
• Analytics data, if Google Analytics 4 is enabled: information about website interactions, device/browser context, and approximate location derived from the connection.
• Booking form details: submitted selections, communication preferences, and basic anti-spam validation fields.
• Sweepstakes and giveaway entry details: name, phone number, email address, referral source, eligibility acknowledgments, entry timestamps, and limited hashed identifiers used to apply entry limits.
• Public review content: selected review text, ratings, dates, source labels, and source links retrieved from Google or Facebook when those integrations are enabled.
• Technical/app information: diagnostics and usage data made available by Apple platforms and payment service providers. The Square in-app payment SDK declares collection of payment information, user and device identifiers, product interactions, and crash data; these categories may be linked to a user and are used for payment functionality and/or analytics, as declared by the SDK.
• Push-notification information: if you opt into community or shop announcements in the customer app, an Apple Push Notification service (APNs) device token, a device-scoped installation registration, separate topic preferences, permission and registration status, and delivery records needed to operate the optional service. A customer profile is not required for this opt-in.
• Payment information: payment credentials are processed by Square; we do not store full card numbers in-app.
• Cookie/similar technology data from linked web services where applicable.

2. How We Use Information

We use information to:

• Provide booking and scheduling services.
• Create and manage customer records.
• Issue and fund purchased gift cards, show the confirmed card to the purchaser, send the requested gift-card email through our email service provider, and recover incomplete activation or delivery attempts. Providing a recipient email for a gift does not subscribe the recipient or purchaser to marketing. Do not include sensitive personal information in a gift message.
• Send confirmations, reminders, updates, and service messages.
• Protect booking workflows, prevent abusive traffic, and detect suspicious activity.
• Send promotions and marketing communications (subject to your choices and applicable law).
• Support internal business tools and app operations.
• Improve reliability, security, and user experience.
• Comply with legal obligations and prevent fraud/misuse.

Mobile App Use and Permissions

The customer iOS app requests notification permission only after you choose to enable an announcement topic. It does not require notification permission to browse posts, book, or shop. The current customer app does not request camera, photo-library, contacts, or device-location access.

You can manage or revoke app permissions at any time through iOS Settings. Disabling certain permissions may limit related app features.

Square handles appointment confirmations, reminders, cancellations, and Square Go messages. The customer app's notification switches do not create duplicate appointment messages or change your Square messaging preferences.

Community updates and shop announcements are separate, device-scoped opt-ins that start off. Community updates contain shop-selected local announcements; shop announcements may include offers and promotions. Guests may opt in without signing in. Enabling a topic gives consent for that topic, requests notification permission when needed, and registers the device for that topic. Only announcements explicitly sent by the shop are eligible for these pushes; school and city feeds do not automatically send notifications. Signing in does not enroll you. Published posts remain readable without notification permission.

You may turn off either topic in the app; turning both off unsubscribes the device from future announcement targeting once the change reaches our service. Offline changes may remain pending until synced. You can also block notifications in iOS Settings. A notification already in flight may still arrive, and delivery may be delayed or unavailable because of device, network, or platform conditions. These push choices do not opt you into marketing email or SMS.

Where required by Apple or applicable law, in-app permission prompts provide just-in-time notice before access to protected device features.

The customer app does not offer biometric sign-in or collect biometric templates. Apple may authenticate Apple Pay on your device; Cuts by Amber does not receive your Face ID or Touch ID data.

Payments for physical products and salon services are processed through Square, including Apple Pay when available. The customer app does not sell digital subscriptions or use Apple In-App Purchase.

3. Purpose and Use of Collected Personal Information

Collected personal information is used for customer service, appointment management, business administration, communications, promotions, lawful internal app operations, and legal compliance.

Sweepstakes and Giveaways

When you enter a Cuts by Amber sweepstakes, giveaway, contest, or similar promotion, we collect the information requested in the entry form, which may include your name, email address, phone number, referral source, and eligibility acknowledgments. We use this information to administer the promotion, verify eligibility, apply entry limits, select and contact a winner, handle prize claims, resolve questions or disputes, and maintain required records.

Entry information may be processed through our website entry system and, when used for a particular promotion, Google Forms and Google Sheets. We retain promotion entry information only as long as reasonably necessary to administer the promotion, handle prize claims, resolve questions or disputes, and meet applicable legal, tax, fraud-prevention, and recordkeeping obligations.

Entering a promotion does not enroll you in marketing emails, text messages, or other promotional communications unless you separately choose to opt in. Marketing consent is not required to enter or win a promotion.

4. How We Share Information

We do not sell personal information. We may share information with:

Booking and customer personal data used by the scheduling workflow is stored and managed in Square systems. Our PHP API endpoints act as an integration layer to push and pull required booking and customer data to and from Square.

• Square APIs: for availability searches, booking creation and management, customer record creation or association, appointment updates, and related scheduling workflows. Depending on the action, requests may include service and location IDs, appointment date/time, customer name, email, phone, booking notes, and communication preferences. Full payment card numbers are not stored in our app-managed systems.
• Twilio and email delivery providers: when profile verification is requested, the selected contact information and one-time code are sent through the configured SMS and/or email delivery provider. Verification challenges and sessions are short-lived and are not intended to serve as permanent account credentials.
• Apple/platform services: where platform diagnostics/analytics are processed under Apple policies.
• Apple Push Notification service (APNs): when you enable community or shop announcements, Apple processes the device token and notification delivery. The announcement service stores a device-scoped registration and separate topic choices, not a required Square customer association. Square manages appointment communications separately.
• Google Places API: our server requests publicly available Google Reviews ratings and reviews using a configured place ID and selected review fields, then displays eligible review content on our website. We do not send personal customer data to Google for this purpose.
• Meta Graph API: when enabled, our server requests selected publicly available reviews or recommendations from the configured Cuts by Amber Facebook Page and displays limited excerpts, source labels, ratings, dates, and links back to Facebook. We do not send booking information or customer contact information to Meta for this review display. Page credentials and access tokens are kept server-side. See the Meta Privacy Policy and Meta Platform Terms.
• TikTok services: if TikTok reporting or account connection is enabled, we may receive limited TikTok account, public video, and performance information authorized by the account owner, such as profile identifiers, video identifiers, views, likes, comments, shares, and publication dates. We use that information only for the connected business reporting features, keep OAuth credentials server-side, do not sell it, and do not use it to create or send content without the required approval. TikTok access may be revoked through TikTok or by contacting us. TikTok authorization data is deleted within 30 days after disconnection unless retention is required for security, legal, accounting, or dispute-resolution purposes. See the TikTok Privacy Policy and TikTok Terms of Service.
• Google Analytics 4: if enabled, Google Analytics may process website usage and device/browser information for analytics and reliability measurement. It is not used for cross-app or cross-website advertising tracking by Cuts by Amber.
• Google Forms and Google Sheets: for sweepstakes, giveaway, contest, or similar promotion entry collection and administration. Depending on the promotion, submitted information may include name, email address, phone number, referral source, and eligibility acknowledgments.
• Service providers: supporting infrastructure and operations under confidentiality obligations.
• Marketing/public channels: pictures, videos, testimonials, comments, reviews, and similar content posted on our website, social media, other online media, or print media may be used for marketing and advertising where permitted by law.
• Legal/compliance requests: when required by law or to protect rights, safety, and security.

Photos and Marketing Content

Photos, videos, testimonials, and other content displayed on this website are used with permission from the content owner, photographer, person depicted, or authorized representative, as applicable. Permission may include use on this website, social media, advertising, and other business marketing materials. If you believe content has been displayed without proper authorization, please contact Cuts by Amber at amberlirette@cutsbyamber.com so we can review the request.

5. Data Retention

We retain information only as long as reasonably necessary for services, records, legal/tax/accounting requirements, dispute resolution, and agreement enforcement.

• Appointment and customer records are retained for business continuity and client support.
• Messaging consent records (including timestamp, source, and phone number) are retained for audit and compliance purposes.
• Sweepstakes, giveaway, contest, and similar promotion entry records are retained for at least two years after the last prize is awarded, and longer when reasonably needed to administer the promotion, handle prize claims, resolve questions or disputes, or meet applicable legal, tax, fraud-prevention, and recordkeeping obligations.
• Technical logs are retained for security monitoring, diagnostics, and abuse prevention for a limited period.
• Notification preferences, device registrations, and delivery records are retained as reasonably needed to operate optional community and shop announcements, honor your choices, troubleshoot delivery, and protect the service. Turning off a topic stops future targeting for that topic once the change reaches our service; records needed for security or troubleshooting may still be retained under this policy.
• When data is no longer needed, we delete or de-identify it where reasonably possible.

6. Data Security

We use reasonable administrative, technical, and organizational safeguards to protect personal information. While no system is 100% secure, we work to reduce risk using industry-standard practices.

• Encryption in transit is used where supported (for example, HTTPS/TLS for website and API traffic).
• Access to customer data is limited to authorized personnel and trusted providers with a business need.
• Payment card handling is performed by Square; Cuts by Amber does not store full card numbers.
• Operational safeguards are used to reduce unauthorized access, misuse, and accidental exposure.

7. Cookies, Advertising, and Analytics

To provide passwordless account access across Cuts by Amber website and app subdomains, we use a necessary short-lived secure, HttpOnly session cookie and an opaque browser-session token after successful verification. These session controls authorize account access, appointment management, and booking prefill; they are not used for advertising or cross-website tracking.

If Google Analytics 4 is enabled, Google may use cookies or similar technologies to measure website usage and improve reliability. The current server configuration sends the anonymize_ip setting when GA4 is initialized. Google Analytics is not used by Cuts by Amber for cross-app or cross-website advertising tracking. GA4 data retention and any consent controls are managed in the applicable Google Analytics property settings.

If we run digital advertising or retargeting campaigns in the future, those campaigns will be managed according to applicable law and platform policies, and users may opt out through browser/device controls and platform ad settings.

If TikTok integrations are enabled, TikTok may process information under its own privacy policy and platform terms when you authorize the connection or interact with TikTok links. Cuts by Amber does not receive your TikTok password. We retain only the limited authorization and reporting information needed for the enabled integration and will remove or disconnect it when the connection is revoked or no longer needed, subject to legal and operational recordkeeping requirements.

To request deletion of TikTok connection data, email amberlirette@cutsbyamber.com with the subject “TikTok Data Deletion Request.” Please do not include passwords, access tokens, or other secrets in your request.

You can manage analytics and advertising technologies through:

• Device privacy settings.
• Browser cookie settings on websites.
• Platform advertising preferences.

8. Opt-Out and Access Rights

Depending on your location and applicable law, you may have rights to:

• Access personal information we hold.
• Correct inaccurate information.
• Request deletion.
• Object to/restrict certain processing.
• Withdraw consent where processing depends on consent.
• Opt out of marketing communications.

When you book an appointment and provide your phone number, you consent to receive appointment-related communications, including confirmations, scheduling updates, and reminders, by email and/or text message from Cuts by Amber and/or Square, our booking platform, at the contact details you provide. We may also send one-time non-promotional operational notices, such as a location or closure update, when reasonably needed to support existing customers.

We may also call your provided phone number to confirm, update, or discuss your appointment when needed. These calls are service-related only. We do not place marketing or telemarketing phone calls.

Marketing emails are sent only when permitted by law and your communication choices. Every marketing email includes an unsubscribe method, and opt-out requests are honored as required by applicable law.

Manage optional community and shop push notifications through Profile > Settings > Manage notifications, including when signed out. Shop announcements may include promotional offers. You may disable either topic or unsubscribe from both. These choices do not enroll you in SMS or email marketing and do not change Square appointment messages.

Marketing messages are separate and are sent only when you affirmatively opt in. Marketing texts may include coupons, discounts, promotions, and service announcements. Cuts by Amber does not offer a loyalty or points-based rewards program. Marketing consent does not enroll you in one.

You can opt out of text messages at any time by replying STOP (or HELP for help). You can opt out of marketing emails through unsubscribe instructions in the message or by contacting us directly. Message and data rates may apply. Joining a marketing text program is not a condition of purchase.

To submit an access or correction request, contact us using the details below. In the customer iOS app, a verified customer can start deletion through Profile > Delete account. Website profile access does not create a separate username or password account. Successful deletion removes the active Square customer profile, app authentication sessions, associated session-contact records, and owner-scoped contact-verification records. Necessary identifiers may temporarily remain while a failed deletion is retried; the app reports an error rather than claiming success. Appointment, order, payment, and other records may be retained where required for legal, tax, fraud-prevention, or transaction recordkeeping purposes.

Announcement subscriptions belong to the device, not the customer profile. Signing out or deleting a profile does not change those independent choices. Use Profile > Settings > Manage notifications to unsubscribe, even when signed out, or contact us for help.

Deletion requests may require identity verification to protect account security and prevent unauthorized data removal. Certain records may be retained as required for legal, tax, fraud-prevention, or transaction recordkeeping purposes.

For reviews posted on third-party platforms (including Google and Facebook), edits or deletions must generally be made through that platform account. If review content appears on our website, you may request that we remove or stop displaying that content on our site, but we cannot directly delete content from third-party platforms unless their tools permit it.

9. Children and Minors

We offer a Kids Cut for children 12 and under. A parent or legal guardian must make and manage any Kids Cut booking. The booking name, contact details, and consent choices must belong to the parent or legal guardian; the child name is collected only when needed to identify the appointment. We do not knowingly create online accounts for children or send marketing messages directly to children, and we do not knowingly collect personal information from minors in violation of applicable law. If discovered, we will take appropriate deletion or remediation steps.

10. Links to Other Websites

Our app and website may contain links to third-party websites and services. Their privacy practices are governed by their own policies.

11. International and Regional Compliance

If you access services outside the U.S., your data may be processed where service providers operate, with safeguards as required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the effective/last-updated dates and, where required, provide additional notice.

13. Security Incident Response

If we become aware of a security incident that affects personal information, we will investigate, contain, and remediate the issue as appropriate.

• We will work with relevant service providers when incident response involves third-party systems.
• Where required by law, affected individuals and authorities will be notified within required timeframes.

14. Contact Us

Cuts by Amber
DBA of Red River Prairie Group LLC
Email: amberlirette@cutsbyamber.com
Phone: (806) 640-7702
Address: 350 NW Parkway St. Suite 500, Azle, TX 76020