California Privacy Notice
Last updated: 2026-05-01
This notice supplements our Privacy Policy and applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA").
1. Categories of personal information we collect
In the past 12 months we collected the following categories of personal information ("PI"):
| Category | Examples | Collected | Shared with |
|---|---|---|---|
| Identifiers | name, email, account ID, IP address | Yes | Service providers (auth, email, analytics) under contract |
| Customer records | phone, billing address, payment instrument (tokenized via Stripe) | Yes | Stripe for payment processing |
| Commercial information | purchase history, subscriptions, formulas ordered | Yes | Stripe; salons fulfilling your orders |
| Internet/network activity | pages visited, click events, device, browser | Yes | Analytics processors (only with consent) |
| Geolocation | approximate location from IP; precise location only if you authorize the mobile app | Yes | Salon/professional discovery |
| Audio / electronic / visual | photos of hair, scalp, and (optionally) face you upload | Yes | Our AI engine under contract; professionals you authorize |
| Sensitive PI (CPRA) | health-related info you supply (allergies, sensitivities); biometric-style hair/scalp data | Yes | Same as visual, used only for purposes you specify |
| Inferences | preferences inferred from analysis results, recommendations | Yes | Service providers |
2. Sources of personal information
- Directly from you (account creation, uploads, support requests);
- Automatically from your device (cookies, log files);
- From service providers (payment processor, email delivery, analytics);
- From professionals or salons you authorize to view your information.
3. Purposes for which we use PI
See our Privacy Policy section "How We Use Your Information". In summary: providing the Services, securing the Services, complying with law, and (with your consent) marketing.
4. Sale or sharing of PI
We do not sell personal information for monetary consideration. We do not knowingly sell or share personal information of California residents under 16 without affirmative authorization (the "Do Not Sell" right under §1798.120(c) is honored by default for minors).
The CPRA also defines "sharing" to include certain disclosures for cross-context behavioral advertising. Our cookie banner lets you opt out of analytics and marketing cookies, which serves as your opt-out of sharing for behavioral advertising. You can update your choice at any time:
Do Not Sell or Share My Personal Information
We honor the Global Privacy Control signal as a valid opt-out request.
5. Sensitive personal information
We collect certain sensitive PI, including health-related information you supply (allergies, sensitivities) and hair/scalp imagery that we treat as biometric-style data. We use sensitive PI only for the purposes permitted by §7027(m) of the CCPA regulations — namely, to provide the Services you request, to ensure security and integrity, and to comply with law. We do not use or disclose sensitive PI to infer characteristics about you for any purpose beyond delivering the Services.
6. Retention
We retain each category of PI only for as long as necessary to fulfill the purpose for which it was collected, plus a reasonable period to satisfy legal, accounting, and dispute-resolution needs. See our Privacy Policy and the Biometric Notice for category-specific retention schedules.
7. Your rights
- Right to know — request a copy of the PI we hold about you, including categories, sources, purposes, and recipients.
- Right to delete — request deletion of PI, subject to statutory exceptions.
- Right to correct — request correction of inaccurate PI.
- Right to opt out of sale/sharing — see Section 4.
- Right to limit use of sensitive PI — though we already self-limit, you may direct us in writing.
- Right to non-discrimination — we will not deny goods, charge different prices, or provide a different level of service for exercising your rights.
7.1 How to exercise your rights
Submit a request by emailing privacy@cosmixxology.com with the subject line "California Privacy Request" and a description of your request. We will verify your identity by matching information you provide against our records (and may request reasonable additional information for sensitive requests). We will respond within 45 days, with one 45-day extension when reasonably necessary.
7.2 Authorized agents
You may designate an authorized agent to make a request on your behalf. The agent must provide written, signed permission from you, and we may require you to verify your identity directly.
8. Shine the Light (California Civil Code §1798.83)
California residents may request a notice describing what categories of personal information we share with third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.
9. Notice of financial incentives
We do not currently offer financial incentives or price differences in exchange for personal information.
10. Contact
privacy@cosmixxology.com · Toll-free privacy line: [TBD] · Cosmixxology, Inc., 2911 Vega Street, Houston, Texas 77088