Privacy Policy

1. The short version

We collect what we need to come to your door and do your hair: your name, email, phone, service address, appointment details and any notes you give us. We don't sell it. We share it only with the services that run the Site (sign-in, email, payments) and never for advertising.

2. Who is responsible

HAVAH, operated by Jennifer Tarverdi as a sole proprietor in California, is responsible for your information under this policy.

3. What we collect

You give us:

• Account: your email address and first name (through our sign-in provider, Clerk).
• Booking: name, email, phone, service address, unit or room number, access notes, location type, preferred date and time, service and finish, hair, skin or allergy notes, and any reference photos you attach.
• Gift cards: your name and email, the recipient's name and email, and your message.
• Stylist applications: your verified account email, name, phone, city, services, experience, license status, portfolio link, availability and introduction. HAVAH owners use these details to review and contact you about your application.
• Inquiries and emails you send us.

Collected automatically:

• Technical logs: IP address, browser type, pages requested and timestamps, kept by our hosting for security and troubleshooting.
• Cookies: a session cookie from Clerk to keep you signed in, and a cookie that remembers your sign-in state on this Site. We do not use advertising or cross-site tracking cookies.

From payment processing (when enabled): Stripe tells us whether a payment succeeded, the amount, the last four digits of the card and the card brand. We never see or store your full card number.

4. How we use it

• To review your request, quote travel, confirm and perform your appointment.
• To email you about your request: received, quote ready, accepted, approved, declined, cancelled. These are transactional emails; you can't opt out of them while you have an active request, because they are how the booking works.
• To text or call you on the day about arrival or changes.
• To keep records of past appointments, quotes and the policy saved with each one.
• To process payments, deposits, gift cards and refunds.
• To keep the Site secure and to fix problems.
• To send marketing email only if you ask for it (for example, by joining the membership waitlist). Every marketing email has an unsubscribe link.

We do not use your information to build advertising profiles and we do not sell or "share" it as those words are defined in California privacy law.

5. Who we share it with

We use a small number of service providers who process data on our behalf under their own contracts and privacy terms:

• Google Maps Platform (address suggestions, when enabled): the street-address text you type and your selected suggestion. See Google’s Privacy Policy.
• U.S. Census geocoder: your street, city, state and ZIP code to check service availability.
• Clerk (sign-in and account management): your email, name and sign-in activity.
• Resend (transactional email): your email address and the content of booking emails.
• Stripe (payments, when enabled): your name, email, payment details and amounts. Stripe acts as its own controller for fraud prevention.
• Hosting and database: all Site data, stored in the United States.

We may also disclose information if the law requires it, to protect someone's safety, or to a successor if the business changes hands (we'd tell you first).

Address lookup providers receive the address information described above. In the Site, your requests are visible only to you and to Jennifer as the owner.

6. How long we keep it

• Requests, quotes and appointment records: 3 years after the appointment, then deleted or anonymized, unless we need them for tax or legal records.
• Account: until you ask us to delete it, or after 3 years of inactivity.
• Reference photos: deleted after the appointment unless you ask us to keep them.
• Payment records: as long as tax law requires (generally 7 years).
• Server logs: 30–90 days.

7. Your choices + rights

Whatever state you live in, you can:

• See what we hold about you.
• Correct it.
• Delete it. We'll delete your account and request history within 30 days, except records we must keep by law.
• Take it with you: ask for a copy in a readable format.
• Opt out of marketing email at any time.

Email us from the address on your account. We'll confirm your identity by replying to that email and won't treat you differently for asking. If you'd rather, an authorized agent can ask on your behalf with your written permission.

8. Photos + social media

We only post photos of you with your permission (see the Terms). If you tag us or message us on Instagram or another platform, that platform's privacy policy applies to what you share there.

9. Children

The Site is for adults. Services for anyone under 18 are booked by a parent or guardian, and we don't knowingly collect information from children online.

10. Security

Data moves over HTTPS. Sign-in uses one-time codes instead of passwords. Access to the owner portal is limited to Jennifer's account. No system is perfectly secure, so if we learn of a breach affecting you, we'll tell you as California law requires.

11. Changes

We'll update the revised date when this policy changes. Big changes get an email to active account holders.

12. Contact

HAVAH · Jennifer Tarverdi · Turlock, California.