Privacy policy.

1. Scope

This policy applies to information collected through this website and related appointment, email, review, and staff-portal functions. It does not control the privacy practices of third-party sites or services you choose to open, such as Google Maps, Google Calendar, Apple Calendar, Outlook, Instagram, or a public review platform.

2. Information we collect

Information you provide

• Booking and contact information: name, email address, phone number, selected service, appointment date and time, and notes you choose to provide.
• Feedback: ratings, review comments, and any photos or other content you voluntarily submit through a review flow.
• Communications: messages and information you provide when you reply to an email, request a change, or contact us through Instagram or another channel.
• Staff access: authorized staff email addresses, one-time authentication codes, and session records. Authentication codes expire quickly and are not stored in readable form.

Information collected automatically

Our hosting, security, and analytics providers may process limited technical information such as IP address, browser and device type, referring page, pages visited, timestamps, approximate region, campaign or referral parameters, and security event data. The site also records booking source and campaign parameters when available so we can understand how customers find us.

Information we do not collect through the site

The website does not currently collect or store payment-card details. Payment arrangements are handled outside the website. Please do not place highly sensitive information in the appointment-notes field.

3. How we use information

• Provide, confirm, manage, reschedule, or cancel appointments.
• Send transactional confirmations, reminders, calendar links, review requests, rebooking messages, and service-related updates.
• Respond to questions and provide customer support.
• Operate the staff portal, maintain availability, and protect the website against fraud, abuse, and unauthorized access.
• Understand referrals, improve services and website performance, and measure communications.
• Maintain business records, enforce our terms, and comply with legal obligations.

We may also send promotional email where permitted by law. You may opt out of promotional messages at any time; doing so will not stop necessary appointment or security messages.

4. When we disclose information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We may disclose information only as reasonably needed to:

• Service providers: Cloudflare for hosting, delivery, security, database, and limited analytics functions; Resend for email delivery; and other vendors that help us operate the business under appropriate restrictions.
• Customer-directed services: calendar, mapping, Instagram, or review services when you choose to open or use them. Calendar links include appointment details in the destination URL or file so the chosen calendar can create the event.
• Legal and safety purposes: comply with law, court process, or a valid government request; protect customers, CDM Cuts, or others; investigate fraud or security incidents; or establish and defend legal claims.
• Business changes: support a merger, sale, financing, reorganization, or transfer of all or part of the business, subject to applicable law.

These providers may independently collect information under their own privacy policies. We do not authorize third parties to track visitors across unrelated websites for CDM Cuts advertising.

5. Your choices and online tracking

• Appointments: reply to a confirmation email or contact @cdm_cuts to request a booking change.
• Marketing email: use the unsubscribe method in the message, if present, or email appointments@cdmcuts.com. We will continue to send necessary transactional or security messages.
• Browser controls: you can limit cookies or similar storage through browser settings. Some functions may not work correctly if storage is disabled.
• Do Not Track and Global Privacy Control: because there is no universally accepted Do Not Track standard, the site may not respond to legacy DNT signals. We honor legally required opt-out preference signals, including Global Privacy Control, where applicable. CDM Cuts does not sell personal information or share it for cross-context behavioral advertising.

The current website does not send automated marketing text messages. If that changes, we will request any consent required by law and provide applicable opt-out instructions.

6. California privacy rights

California residents may have rights under applicable law to request access to or correction or deletion of personal information, receive information about collection and disclosure practices, and limit certain uses or disclosures. Where the California Consumer Privacy Act applies, residents may also opt out of sale or sharing and may not be discriminated against for exercising privacy rights. CDM Cuts does not sell personal information or share it for cross-context behavioral advertising.

To make a request, email appointments@cdmcuts.com with “Privacy Request” in the subject line. Describe the request and the email or phone number connected to your booking. We may need to verify your identity and authority before completing it. An authorized agent may submit a request when legally permitted, subject to verification. We may retain or withhold information when an exception applies, including for security, fraud prevention, transaction completion, recordkeeping, or legal obligations.

7. Retention and security

We retain information only as long as reasonably necessary for the purposes described here, including providing services, maintaining appointment and tax or business records, resolving disputes, enforcing agreements, and meeting legal requirements. Retention varies by record type. One-time staff codes expire after approximately 10 minutes; staff sessions are designed to expire after approximately 30 days unless ended sooner.

We use reasonable administrative, technical, and organizational safeguards, including encrypted HTTPS connections, access controls, time-limited passcodes, and limited service-provider access. No website or storage system can guarantee absolute security. If you believe your information or an account has been compromised, contact us promptly.

8. Children’s privacy

The website is not directed to children under 13, and we do not knowingly collect personal information from a child under 13 without appropriate authorization. A parent or guardian who believes a child submitted information may contact us to request deletion. Minors should have a parent or guardian arrange appointments when required.

9. Changes to this policy

We may update this policy to reflect changes in our practices, services, or legal requirements. The effective date at the top shows when it was last revised. Material changes will be posted here and, when appropriate, communicated by another reasonable method.

10. Contact us