US State Privacy Notice
Last updated: 2026-05-01
This notice consolidates privacy disclosures for US state-level laws. It supplements our Privacy Policy. Where a state law gives you a right that is not separately described in this notice, the right under that state law still applies.
1. Which laws may apply to you
The table below summarizes the comprehensive privacy laws that may apply to Cosmixxology, Inc. based on where you live. Specific rights vary; we describe the core rights that are common across these laws below.
| State | Law | Effective | Applicability threshold |
|---|---|---|---|
| Texas | Texas Data Privacy and Security Act (TDPSA) | 2024 | Conducts business in Texas; not a small business under the SBA |
| California | CCPA / CPRA | 2020 / 2023 | $25M revenue OR 100K+ CA consumers OR 50%+ revenue from selling PI |
| Virginia | Virginia Consumer Data Protection Act (VCDPA) | 2023 | 100K+ VA consumers OR 25K+ and 50%+ revenue from selling PI |
| Colorado | Colorado Privacy Act (CPA) | 2023 | 100K+ CO consumers OR 25K+ and revenue from selling PI |
| Connecticut | Connecticut Data Privacy Act (CTDPA) | 2023 | 100K+ CT consumers OR 25K+ and 25%+ revenue from selling PI |
| Utah | Utah Consumer Privacy Act (UCPA) | 2023 | $25M revenue + 100K+ UT consumers |
| Oregon | Oregon Consumer Privacy Act (OCPA) | 2024 | 100K+ OR consumers OR 25K+ and 25%+ revenue from selling PI |
| Florida | Florida Digital Bill of Rights (FDBR) | 2024 | $1B revenue + specified data activities |
| Illinois | Biometric Information Privacy Act (BIPA) | 2008 | Any IL resident — see Biometric Notice |
| Washington | My Health My Data Act (MHMDA) | 2024 | Any WA resident if processing consumer health data |
2. Rights you generally have
If you are a resident of a state with a comprehensive privacy law, you generally have the right to:
- Know / access the categories and specific pieces of personal data we have about you.
- Correct inaccurate personal data.
- Delete personal data we hold about you, subject to limited statutory exceptions.
- Receive a copy of your data in a portable, machine-readable format.
- Opt out of the sale or sharing of personal data, targeted advertising, and certain types of automated profiling.
- Limit the use of sensitive personal data.
- Appeal a denial of any of the above; if our appeal response does not satisfy you, you can complain to your state attorney general.
- Be free from retaliation for exercising your rights.
3. How to exercise your rights
3.1 Submit a request
Email privacy@cosmixxology.com with the subject line "Privacy Request — [your state]" and a description of what you want. Include the email associated with your Cosmixxology account so we can verify you. For sensitive requests we may ask for additional verification.
3.2 Response time
We respond within 45 days. If we need more time we will tell you within 45 days and respond within an additional 45 days (90 days total). California allows extensions only when reasonably necessary; some states are stricter.
3.3 Authorized agents
You can designate someone to act on your behalf with written, signed authorization. We may verify directly with you for sensitive requests.
3.4 Appeals
If we deny your request and your state law gives you an appeal right, reply to our denial with the word "APPEAL" in the subject line. We will reconsider within 45 days. If our appeal response is unsatisfactory, you can file a complaint with your state attorney general.
4. Sale, sharing, and targeted advertising
We do not sell personal data for monetary consideration. Some state laws define "sale" or "sharing" broadly enough that some advertising-cookie practices fall inside the definition. Our cookie banner lets you opt out of analytics and marketing cookies, which serves as your opt-out under each of those state laws. Update your choice from the footer or visit Do Not Sell or Share My Personal Information.
We honor the Global Privacy Control signal as a valid opt-out request in every state where it is recognized.
5. Sensitive data
We treat the following as sensitive data and apply heightened protections: hair, scalp, and face imagery; precise geolocation; health-related information you supply (allergies, sensitivities); account credentials. We use sensitive data only for the purposes of providing the Services, ensuring security and integrity, and complying with law. You can ask us to limit the use of sensitive data at any time.
6. Texas-specific notice (TDPSA)
As a Texas-based business, we direct particular attention to Texas residents under the TDPSA. The rights described in Section 2 apply, plus:
- You can opt out of the processing of personal data for purposes of targeted advertising or sale.
- If we deny a request, we provide written reasons within the response period and an appeal mechanism.
- You can complain to the Texas Attorney General at texasattorneygeneral.gov.
7. California-specific notice (CCPA / CPRA)
California residents have additional rights described in our California Privacy Notice, including a Shine the Light right and a specific Do Not Sell or Share opt-out.
8. Illinois-specific notice (BIPA)
If you are an Illinois resident, the Biometric Information Privacy Act gives you specific rights regarding hair and scalp imagery. See our Biometric & Hair Image Data Notice.
9. Washington-specific notice (My Health My Data Act)
Hair-care information including allergies, sensitivities, and certain analysis outputs may qualify as "consumer health data" under the Washington My Health My Data Act. We apply the same heightened protections described in our Biometric Notice to this data and require your opt-in consent before collection.
10. Contact
privacy@cosmixxology.com — primary privacy contact
Cosmixxology, Inc.
2911 Vega Street
Houston, Texas 77088