Privacy policy
Allure Bay Spa | Effective September 7, 2026 | Last updated September 7, 2026
This Privacy Policy explains how Allure Bay Spa ("Allure Bay," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit allurebayspa.com, request or receive services, contact us, or interact with our communications. It also describes choices and rights that may be available to you.
1. Scope
This Policy applies to personal information handled through our website, appointment process, customer communications, and in-person spa operations. It does not govern a third party's independent practices, even when our website links to that party. A separate treatment consent or intake notice may apply to information collected for a particular service.
2. Personal Information We Collect
Depending on how you interact with us, we may collect the following categories of information:
Identifiers and contact details, such as name, email address, telephone number, mailing address, date of birth, and account or booking identifiers.
Appointment and transaction information, such as requested treatment, date and time, provider preference, purchase history, deposits, payment status, promotions used, and communications about a booking.
Payment information. Payment card details may be collected directly by a payment processor. We may receive limited information such as payment confirmation, card brand, last four digits, or transaction identifier.
Treatment and preference information, such as skincare goals, allergies, sensitivities, medications, pregnancy or nursing status, relevant conditions, treatment notes, consent records, before-and-after photographs when authorized, and product preferences.
Communications and submitted content, including messages, reviews, survey responses, call or text records, and customer-service requests.
Internet and device information, such as IP address, browser, device type, operating system, referring page, pages viewed, approximate location derived from IP, cookie identifiers, and interactions with our website or messages.
Marketing and preference information, such as communication choices, campaign interactions, and interests inferred from use of our Services.
Other information you choose to provide or that we collect with notice or consent.
3. Sources of Personal Information
We collect information directly from you, automatically from your browser or device, from booking and payment providers, from communications and marketing providers, from social media or review platforms when you interact with us there, from referrals you authorize, and from service providers that help us operate our business.
4. How We Use Personal Information
Provide consultations, appointments, treatments, customer service, and aftercare information.
Confirm, reschedule, and manage appointments and process authorized payments.
Personalize services and help assess treatment suitability and safety.
Send administrative, transactional, and security communications.
Send marketing email or SMS messages when permitted and manage opt-outs.
Operate, secure, troubleshoot, measure, and improve our website and Services.
Maintain business records, detect fraud or misuse, enforce agreements, and protect safety and legal rights.
Comply with law, respond to lawful requests, and establish or defend legal claims.
Carry out another purpose disclosed when information is collected or with your consent.
5. Cookies, Analytics, and Advertising
We and providers working for us may use cookies, pixels, local storage, tags, and similar technologies to keep the website working, remember preferences, understand traffic, measure campaigns, and support advertising. These tools may collect device and usage information and may connect activity across websites or services. You can adjust browser settings to block or delete cookies, but parts of the website may not function properly. Where required, we will provide cookie choices. If our practices constitute "selling" or "sharing" under California law, you may opt out as described below. We will process a legally recognized opt-out preference signal, such as Global Privacy Control, where required by law.
6. How We Disclose Personal Information
We may disclose personal information to:
Vendors and service providers that support booking, payments, website hosting, analytics, communications, marketing, security, professional services, and business operations.
Our personnel and contractors who need information to provide services and operate the spa.
Advertising, analytics, and social media partners, subject to your choices and applicable law.
Government authorities, courts, regulators, law enforcement, or other parties when we reasonably believe disclosure is required or permitted by law or needed to protect rights, safety, and security.
A buyer, investor, lender, adviser, or successor in connection with a merger, financing, reorganization, sale, or transfer of some or all of our business, subject to appropriate protections.
Other parties at your direction, with your consent, or as disclosed when the information is collected.
We do not sell personal information for money. Some online advertising or analytics disclosures may be considered "sharing" or a "sale" under California law even when no money changes hands. You may opt out of those practices where applicable by sending a request to support@allurebayspa.com with the subject line "Privacy Choices." You may also enable Global Privacy Control in a supported browser. We do not knowingly sell or share the personal information of consumers under 16.
7. Sensitive and Treatment-Related Information
Some treatment information may be considered sensitive personal information under certain laws. We use it to assess treatment suitability, deliver requested services, document consent and care, protect health and safety, comply with law, and handle related claims. We do not use sensitive personal information to infer characteristics about you for unrelated advertising. Allure Bay Spa is not necessarily a health care provider or covered entity under the federal Health Insurance Portability and Accountability Act (HIPAA), and information you provide may not be protected by HIPAA. Other privacy and consumer-protection laws may still apply.
8. Retention
We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including providing services, maintaining treatment and consent records, honoring communication choices, meeting tax and accounting duties, resolving disputes, protecting safety, and complying with law. Retention periods vary based on the type and sensitivity of information, the relationship with you, operational need, legal requirements, and risk. We delete or deidentify information when it is no longer reasonably needed, subject to lawful exceptions and backup cycles.
9. Security
We use reasonable administrative, technical, and physical safeguards designed to protect personal information. No website, transmission, or storage system is completely secure, so we cannot guarantee absolute security. Please use care when sending sensitive information by email or text and contact us if you believe your interaction with us is no longer secure.
10. Your Choices
Email marketing: Use the unsubscribe link in a promotional email or contact us.
SMS marketing: Reply STOP to a promotional text or contact us. Message and data rates may apply.
Cookies: Use available cookie controls, browser settings, or a supported opt-out preference signal.
Account and contact details: Contact us to request a correction.
Photographs and testimonials: Contact us to withdraw permission for future use, subject to existing lawful uses and signed releases.
11. California Privacy Rights
Depending on our size, activities, and applicable exemptions, California privacy law may give California residents rights to request that we:
Confirm whether we process personal information and provide access to specific information.
Provide information about categories of personal information collected, sources, purposes, and categories of recipients.
Correct inaccurate personal information.
Delete personal information, subject to legal exceptions.
Opt you out of sale or sharing of personal information and recognize qualifying opt-out preference signals.
Limit certain uses and disclosures of sensitive personal information where the right applies.
Provide portable information where required.
Not discriminate against you for exercising an applicable privacy right.
To submit a request, email support@allurebayspa.com with the subject line "California Privacy Request," call (408) 604-5087, or mail us at the address below. Describe the right you want to exercise and provide enough information for us to identify relevant records. We may verify your identity and authority before completing a request. An authorized agent may submit a request as permitted by law, but we may request proof of authorization and identity verification. We will respond within the period required by applicable law. If we deny a request, we will explain the basis when required.
12. Do Not Track and Opt-Out Signals
Browsers may offer a Do Not Track setting, but there is no universally accepted response standard. We do not currently respond to traditional Do Not Track signals. We do process legally recognized browser-based opt-out preference signals, including Global Privacy Control, where required by applicable law.
13. Children
The website is not directed to children under 13, and we do not knowingly collect personal information online from a child under 13 without verifiable parental consent. A parent or guardian who believes a child provided information may contact us to request review or deletion. Services for minors must be arranged by a parent or legal guardian and may require additional consent.
14. Third-Party Links and Services
Our website may link to or integrate with third-party booking, payment, map, social media, review, or other services. Those parties may collect information under their own privacy policies. Review their policies before providing information. We are not responsible for an independent third party's privacy practices.
15. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices, technology, services, or legal requirements. We will post the updated version and revise the effective or last-updated date. If required, we will provide additional notice or obtain consent before a material change applies.
16. Contact Us
Allure Bay Spa
Attn: Privacy
877 W Fremont Ave, Suite D-1
Sunnyvale, CA 94087
Email: support@allurebayspa.com
Phone: (408) 604-5087
Implementation Notes for the Website Owner
Complete these operational steps before or when publishing the policies:
Link both policies in the website footer and beside appointment, contact, newsletter, and SMS consent forms.
Use an unchecked, optional checkbox for promotional SMS consent. Keep marketing consent separate from appointment reminders and state that consent is not a condition of purchase.
Make sure every marketing text identifies Allure Bay Spa and supports STOP. Maintain records of consent and opt-outs.
Inventory the actual booking, payment, analytics, advertising, email, SMS, hosting, and review tools in use. Update the disclosure language if any provider uses data for its own purposes.
If targeted advertising cookies are active, add a clear Privacy Choices or Do Not Sell or Share My Personal Information link and configure it to disable applicable tags. Test Global Privacy Control behavior.
Place a short notice at collection near forms that states what information is collected, why, and links to this Privacy Policy.
Adopt internal procedures to verify and answer privacy requests, retain treatment records appropriately, and securely delete data when no longer needed.
Have California counsel review the final policies, treatment consent, intake form, cancellation practices, and any body-contouring claims before launch.
Reference Sources
California Department of Justice, California Consumer Privacy Act (CCPA): https://oag.ca.gov/privacy/ccpa
California Privacy Protection Agency, Law and Regulations: https://cppa.ca.gov/regulations/
California Department of Justice, Global Privacy Control: https://oag.ca.gov/privacy/ccpa/gpc
Federal Communications Commission, Stop Unwanted Robocalls and Texts: https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts
Drafting notice: This document is a practical website-policy draft based on the public website and the business choices provided. It is not legal advice and does not create an attorney-client relationship.