Privacy Policy

Introduction

This Privacy Policy describes how Twiggs Salon, Inc. (“Twiggs Salon,” “we,” “us,” or “our”) collects, uses, discloses, and protects your personal information when you visit or make a purchase from shop.twiggssalonspa.com (“the Site”).

By using the Site, you consent to the practices described in this policy. If you do not agree with this policy, please do not use the Site. This Privacy Policy is incorporated into and subject to our Terms of Use.

Information we collect

We collect information that you provide directly to us, information collected automatically when you use the Site, and information from third-party sources that help us operate the Site.

Information you provide

Information collected automatically

How we use your information

We use the information we collect for the following purposes:

• Fulfill orders — process payments, pack and ship products, send order confirmations and shipping updates
• Manage your account — create and maintain your account, authenticate your identity, enable password resets
• Process returns — manage return requests, issue refunds, communicate about return status
• Customer support — respond to your inquiries, troubleshoot issues, resolve disputes
• Improve the Site — analyze usage patterns to improve navigation, performance, and product offerings
• Prevent fraud — detect and prevent fraudulent transactions and unauthorized access to accounts
• Communicate with you — send transactional emails (order confirmations, shipping notifications, password resets) and, with your consent, promotional communications
• Legal compliance — comply with applicable laws, regulations, and legal processes

Sharing & third parties

We share your information only with third-party service providers who assist us in operating the Site and fulfilling orders. These providers are contractually obligated to use your information only for the purposes we specify and to protect it in accordance with this policy.

We may also disclose your information if required to do so by law, in response to a valid legal process (such as a subpoena or court order), to protect our rights or property, to prevent fraud, or to protect the safety of our users or the public.

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Site before your information becomes subject to a different privacy policy.

Cookies & tracking technologies

We use cookies and similar technologies to operate the Site, remember your preferences, and understand how you interact with it.

Essential cookies

Required for the Site to function. These include session cookies that maintain your cart contents and authentication state. You cannot opt out of essential cookies without disabling core site functionality.

Analytics cookies

Help us understand how visitors use the Site — which pages are most popular, how users navigate between pages, and where drop-offs occur. This data is aggregated and anonymized. We may use tools such as Google Analytics or Plausible Analytics for this purpose.

Functional cookies

Remember your preferences, such as your preferred grid view on the catalog page or recently viewed products. These improve your experience but are not strictly necessary.

Most web browsers allow you to control cookies through their settings. You can choose to block or delete cookies, though doing so may affect your ability to use certain features of the Site, including the shopping cart and checkout.

Data retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Account data — retained for as long as your account is active, plus 12 months after account deletion to address potential disputes
• Order data — retained for 7 years from the date of purchase to comply with tax and accounting requirements
• Payment data — full card details are not stored by Twiggs Salon; Stripe retains payment records in accordance with their own retention policies
• Server logs — retained for up to 90 days
• Analytics data — retained in aggregated, anonymized form indefinitely

When personal information is no longer needed, we securely delete or anonymize it.

Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, use, alteration, and disclosure. These include:

• HTTPS/TLS encryption on all pages of the Site
• Payment card data processed exclusively by Stripe’s PCI DSS Level 1 certified infrastructure — no card data is stored on or passes through our servers
• Passwords stored using industry-standard one-way hashing algorithms
• Access to customer data limited to authorized personnel on a need-to-know basis
• Regular security reviews of our hosting infrastructure and application code

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. If you believe your account has been compromised, please contact us immediately.

Your rights & choices

Depending on your location, you may have certain rights regarding your personal information. We honor the following requests from all users, regardless of location:

Access & portability

You may request a copy of the personal information we hold about you in a commonly used, machine-readable format.

Correction

You may request that we correct any inaccurate or incomplete personal information. You can update most account information directly through your account settings.

Deletion

You may request that we delete your personal information. We will comply with your request unless we are legally required to retain certain data (for example, order records for tax compliance). Upon deletion, your account will be permanently closed.

Marketing opt-out

You can unsubscribe from promotional emails at any time by clicking the “unsubscribe” link in any marketing email, or by updating your preferences in your account settings. Transactional emails (order confirmations, shipping updates, password resets) are not affected by this preference and will continue as long as you have an account or open orders.

To exercise any of these rights, contact us using the information in Section 13. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

Minnesota residents

If you are a resident of Minnesota, you may have additional rights under the Minnesota Consumer Data Privacy Act (MCDPA), which takes effect on July 31, 2025. These rights include:

• The right to know what personal data we collect and how it is used
• The right to access and obtain a copy of your personal data
• The right to correct inaccuracies in your personal data
• The right to delete your personal data
• The right to opt out of the sale of personal data, targeted advertising, or profiling

Twiggs Salon does not sell personal data, engage in targeted advertising, or make decisions based on automated profiling that produce legal or similarly significant effects.

To exercise your rights under the MCDPA, contact us using the information in Section 13. If we decline your request, you have the right to appeal. We will respond to appeals within 45 days.

Children’s privacy

The Site is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at the address in Section 13.

Third-party links

The Site may contain links to third-party websites, including but not limited to our main salon website (twiggssalonspa.com), the SalonBiz booking platform, and product brand websites. This Privacy Policy applies only to shop.twiggssalonspa.com. We are not responsible for the privacy practices of third-party sites and encourage you to review their privacy policies before providing any personal information.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will update the “Last updated” date at the top of this page.

For material changes that significantly affect how we collect, use, or share your personal information, we will provide prominent notice on the Site or send a notification to the email address associated with your account at least 30 days before the changes take effect.

Your continued use of the Site after any changes to this policy constitutes your acceptance of the revised policy.

Contact information

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how your information is handled, please contact us:

For privacy-specific requests, we aim to respond within 30 days. If you are not satisfied with our response, you may file a complaint with your local data protection authority.