Privacy Policy

1.Information We Collect

We collect the following categories of information:

Contact & Booking Information

When you book an appointment, we collect your name, phone number, email address, and — if you book a mobile/in-home appointment — your service address.

Payment Information

Payments are processed through Stripe, a third-party payment processor. We do not collect or store your full card number, CVV, or other card details on our own systems. Stripe handles payment processing on our behalf in accordance with its own privacy policy and security standards (including PCI-DSS compliance). We may retain limited payment metadata (such as transaction amount, date, and status) for our own bookkeeping.

Waiver & Consent Records

When you sign our Client Waiver & Consent form, we retain the information you provide there (health disclosures relevant to the service, your signature, and your photo/video consent choice) as a record of your appointment.

Website Usage / Hosting Data

Our website is hosted and protected using Cloudflare, which may collect limited technical data (such as IP address, browser type, and request logs) as part of providing hosting, performance, and security services (e.g., bot protection).

Cookies & Advertising Measurement

Our site uses advertising cookies and identifiers. Two measurement tools run on every page:

• Google Ads tag (gtag.js) — conversion ID AW-18375346431, loaded from googletagmanager.com.
• OpenAI Ads measurement pixel — loaded from openai.com, used to measure ads we run on ChatGPT.

These tools set cookies and similar identifiers in your browser and report your activity on our site back to Google and OpenAI. What they report is: page views (which pages you visited, including the confirmation page shown after you book) and conversion events — for example, submitting a request form on one of our ad landing pages, or reaching the end of a booking. If you arrived from an ad, we also store the ad-click reference from your link in a first-party cookie named “sunkiss_oppref” for 30 days, so the visit can be credited to the ad that brought you here.

These tools tell us that an ad worked. They do not receive your name, email address, phone number, service address, or anything you disclosed on our waiver — we do not send contact details or health information to any advertising platform, and we do not sell it to anyone.

Your choices. You can block or delete cookies in your browser settings, which stops these tools from recognizing you across visits. You can also control Google’s use of advertising data at adssettings.google.com, and manage ad personalization in your ChatGPT/OpenAI account settings. Blocking these cookies does not affect your ability to book, and we will never refuse service over it.

Do Not Track. Our site does not currently respond to browser “Do Not Track” signals. We are telling you plainly rather than implying a protection we do not provide; use the browser and platform controls above instead.

2.How We Use Your Information

We use the information we collect to:

• Schedule, confirm, and manage your appointments;
• Travel to and perform mobile/in-home appointments;
• Process payments through Stripe;
• Maintain waiver and consent records for our services;
• Communicate with you about your appointment (see Section 4, Text Messages);
• Improve our website and services;
• Measure and improve the performance of our advertising (see Section 1, Cookies & Advertising Measurement).

We do not use your information for any purpose incompatible with these listed uses without notifying you.

3.How We Share Your Information

We share personal information only as needed to run our business:

• Stripe — to process your payment.
• Cloudflare — to host and secure our website.
• Google and OpenAI — website activity (page views and conversion events) for advertising measurement, as described in Section 1. No contact details and no health information are sent to either.
• Legal or safety reasons — if required to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Sunkiss Studios, our clients, or others.
• Business transfer — if Sunkiss Studios is involved in a merger, acquisition, or sale of assets, client information may be transferred as part of that transaction, subject to this policy or a successor policy.

We do not sell your personal data to third parties, and we do not share your information with third parties for their own independent marketing purposes.

4.Text Messages (SMS)

We may text you regarding your booking — for example, to confirm, remind, or reschedule an appointment. These are transactional messages tied to a service you’ve booked, not marketing messages, and are sent because you provided your phone number when booking an appointment with us.

We will not send you marketing or promotional text messages unless you separately opt in to receive them, and you may always reply STOP to any text to opt out, or contact us at booking@customspraytans.com. Message and data rates may apply.

5.Data Retention

We retain your contact, booking, and waiver information for as long as reasonably necessary to provide our services, maintain business and liability records, and comply with legal, tax, or insurance obligations. If you request deletion of your information (see Section 6), we will delete or de-identify it unless we’re required or permitted to retain it (for example, financial records or an active waiver relevant to a recent appointment).

6.Your Privacy Rights

Depending on your state of residence, you may have rights regarding your personal data, including (in Virginia, under the Virginia Consumer Data Protection Act, where applicable) the right to:

• Confirm whether we are processing your personal data and access that data;
• Correct inaccuracies in your personal data;
• Delete personal data you’ve provided or that we’ve collected; and
• Receive a copy of your data in a portable format.

We honor these requests as a matter of policy for all clients, regardless of state of residence.

7.Children’s Privacy

Our website and services are not directed at children under 13, and we do not knowingly collect personal information from children under 13 through our website. Minors under 18 may only receive our services with a parent or guardian’s signature, as described in our Client Waiver & Consent form.

8.Data Security

We take reasonable measures to protect your information, including relying on Stripe’s PCI-DSS-compliant payment processing and Cloudflare’s hosting security features. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9.Changes to This Policy

We may update this Privacy Policy from time to time, including when we add or remove measurement tools of the kind described in Section 1. We will update the “Effective Date” at the top of this page when changes are made. Your continued use of our website or services after a change becomes effective constitutes your acceptance of the updated policy.

10.Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us: