Privacy Policy

This Privacy Policy explains how Cosmos Studio(Cosmos Studio LLC, "we", "us") collects, uses, and protects information about you. It applies whenever you book an appointment with us, save a card on file, or otherwise use our booking service.

Cosmos Studio is a hair salon with locations in Titusville and inside Crown & Copper Salon in Orlando, Florida. Our booking service runs on Cosmos Booking, our own scheduling software. Cosmos Studio is the business you are dealing with, and Cosmos Studio is the sender of any text message you receive from us.

1. Information we collect

From you directly:

• Name, email address, phone number.
• Appointment details (service, stylist, date/time, notes).
• Optional intake answers (how you heard about the salon, inspiration photos you upload).
• Birthday (if provided, used for birthday outreach when you have opted in to SMS).
• Health information you choose to share so a service can be performed safely — allergies, sensitivities, and the results of patch tests.
• Service records kept by your stylist: colour formulas, treatment notes, visit history, and photographs of your hair.
• Consent forms and release documents you sign electronically, together with the date and time of signing.

Photographs, uploaded files, and signed documents are held in private storage and are opened only through short-lived links issued to salon staff. They are not published and are not publicly reachable.

Automatically:

• Basic technical data (IP address, browser, pages viewed) used for security, abuse prevention, and platform performance.
• Session cookies set by our authentication provider (Supabase) for logged-in users.

From payment processing:

• A reference to your card on file (a Square card token and customer ID). Full card numbers are never sent to or stored by us — they are collected directly by Square in your browser and handled by Square per their privacy policy.

2. How we use information

• To create and manage your appointments.
• To send informational appointment messages when you select Text updates, including confirmations, reminders, scheduling changes, waitlist availability, and secure checkout links.
• To send marketing and re-engagement messages when you separately select News & offers, including birthday messages, rebooking reminders, review requests, and salon news or offers.
• To process payments at checkout and, where applicable, to charge a cancellation or no-show fee under the salon's displayed policy.
• To send marketing email — only when you have opted in.
• To improve the platform (aggregate usage analytics, debugging, abuse prevention).

3. SMS consent

Our booking form offers two separate, optional SMS programs. Text updates covers informational appointment messages: confirmations, reminders, scheduling changes, waitlist availability, and secure payment or checkout links. News & offers separately covers marketing and re-engagement messages: birthday messages, rebooking reminders, review requests, and salon news or offers. Selecting one does not enroll you in the other. Message frequency may vary. Message and data rates may apply. Consent is not required to book and is not a condition of purchase.

Login verification texts are separate from the booking messaging program and are sent only when you request a one-time code for account access.

You can revoke consent at any time by replying STOP to any message; this suppresses both programs. Replying START clears the carrier-level block but does not recreate consent for either program—you must explicitly opt in again. Reply HELP for support.

Mobile information collected for our messaging program is never shared or sold to third parties or lead generators for marketing or promotional purposes at any time. Your number is passed only to Twilio, the provider that delivers the message on our behalf, and only for that purpose.

4. Email consent and unsubscribe

Every marketing email contains a one-click unsubscribe link. You can also email hello@cosmosstudio.services to be removed from marketing email. Transactional email (e.g. a booking confirmation) is required for the service and is not subject to unsubscribe.

5. Sharing with third parties

We share data only with the service providers that run the platform:

• Square — payments and card-on-file storage.
• Supabase — database, authentication, file storage (e.g. inspiration photos).
• Twilio — SMS delivery (only when you have opted in).
• Resend — email delivery.
• Vercel — application hosting.
• Sentry — error monitoring, used to detect and fix faults in the platform.

We do not sell your personal information. We do not share your information for third-party marketing. Mobile information collected for our messaging program is never shared or sold to third parties or lead generators for marketing or promotional purposes at any time.

6. Data retention

We retain appointment, client, and payment records for as long as needed to provide the service, comply with our legal obligations (e.g. tax, chargeback windows), and resolve disputes. Signed consent and release documents are kept for as long as they may be needed to evidence the consent they record. You may request earlier deletion as described below.

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your data (subject to legal-retention exceptions).
• Withdraw consent for SMS or marketing email at any time.
• Receive a portable copy of the data you provided to us, in a structured machine-readable format.

To exercise any of these rights, email hello@cosmosstudio.services. We respond within the timeframes required by applicable law.

8. Children

Cosmos Studio is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact hello@cosmosstudio.services and we will delete it.

9. Security

We use industry-standard measures to protect your information, including TLS encryption in transit and access controls on our database. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.

10. International users

Our service providers (listed above) operate primarily in the United States. By using the platform from outside the United States, you acknowledge that your information may be processed in the United States, which may have different data-protection rules than your jurisdiction.

11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date above and, where appropriate, by direct notice.

12. Contact

Privacy questions or data requests: hello@cosmosstudio.services.