Privacy Policy

Who this policy covers

This policy explains what information we collect, how we use it, who we share it with, and the choices you have. It covers our websites (www.hairplayspa.com and scalp.hairplayspa.com), our ads and forms on Facebook and Instagram, booking through Vagaro, and the texts and emails we send.

Information we collect

Information you give us

• Your name, email address and phone number
• Booking details: the service, date, time, price and any promo code
• Your answers on our forms, such as whether we may text you and how you heard about us
• Messages you send us by text or email, including replies to our review requests

Information from our forms on Facebook and Instagram
When you fill in one of our forms on Facebook or Instagram, Meta sends us what you entered (usually your name, email and phone number), the ad you came from and the form's reference number.

Information collected automatically on our websites

• Your IP address, browser and device type
• Pages you visit, how long you stay and the site that sent you
• Ad click and browser identifiers that Meta sets when you arrive from one of our ads
• Cookies and similar tools (see "Advertising and measurement" and "Google Analytics" below)

Payments
Payments are handled by Vagaro. We do not see or store your full card number.

Health and intake forms
If you fill in a health or intake form in Vagaro, it stays in Vagaro and is used only by our team to care for you during your service. We never use it for advertising, never send it to Meta and never send it to AI tools.

How we use your information

• To book, confirm and manage your appointments
• To text you, only in the ways you chose (see "Text messages" below)
• To answer your messages, including through our automated booking assistant
• To ask how your visit went, ask for a review, and make sure the right person follows up
• To measure which of our ads lead to real bookings, so we spend our ad budget where it works
• To improve our website, services and ads
• To keep the records we need for taxes and the law, and to prevent fraud

Text messages

When you book online, our form asks two separate questions. You choose each one:

• Visit texts: after your visit, we text to ask how it went and to ask for a review. These texts are not sales messages.
• Offer texts: openings and special offers, only if you said yes.

If you fill in one of our forms on Facebook or Instagram, you can choose to get texts there too. If you do not choose texts, we contact you by email.

Texts come from (405) 796-8638. Message frequency varies. Message and data rates may apply. Saying yes is not a condition of booking or buying anything. Text STOP to opt out at any time, or HELP for help. We also accept END, CANCEL, UNSUBSCRIBE and QUIT to opt out, and INFO for help. For support, email admin@hairplayspa.co or call (405) 494-0560.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information may be shared with subcontractors that provide support services, such as customer service, messaging infrastructure, or technical assistance, solely as necessary to provide those services. Text messaging originator opt-in data and consent will not be shared with any third parties.

We keep records of opt-ins, opt-outs and messages as carriers and the law require.

Artificial intelligence (AI)

We use AI in three places. In each one, AI never receives your name, email address or phone number.

1. Booking assistant. If you reply by text to one of our ads, an automated assistant that uses AI may answer to help you find a time. Before your message reaches the AI, our system removes your name, email addresses and phone numbers. Our team confirms every booking and can take over the conversation at any time.
2. Review replies. When you reply to our "how was your visit?" text, AI reads your reply, with your name and contact details removed, so the right person can follow up. Every guest gets the same review link, whatever their reply says.
3. Ad results. We use AI to review the results of our ads, such as spend, clicks and the number of bookings. It sees totals only, never information about any one person.

The AI services that handle guest messages are set to keep no copy of them and not to use them to train their models.

Advertising and measurement (Meta)

We advertise on Facebook and Instagram, which belong to Meta Platforms, Inc. To learn which ads lead to real bookings, we use two Meta tools.

The Meta Pixel runs on scalp.hairplayspa.com. It sends nothing to Meta until you accept cookies on that page. It records that you visited and which pages you saw. If you have given us your email address, the Pixel may include it in scrambled (hashed) form.

The Meta Conversions API. When an appointment is booked, our system tells Meta that a booking happened, the service and its price. To help Meta match the booking to an ad, it also sends:

• Your email address, phone number, first and last name, city, state, ZIP code, country and our booking system's customer number, all hashed first. Hashing turns each one into a scrambled code before it leaves our systems, so Meta never receives them in readable form.
• If you came from one of our ads: Meta's click and browser identifiers, your IP address and your browser details. Meta needs these in their original form, so they are not hashed.
• If you came through one of our Facebook or Instagram forms: that form's reference number.

We never send Meta your appointment notes, health or intake answers, payment details, or the text messages you send us.

Meta uses this information under its own terms and its Privacy Policy (https://www.facebook.com/privacy/policy) and may keep it for up to two years.

Your choices

• Change how Meta uses your information in your Facebook or Instagram ad settings.
• Decline cookies on scalp.hairplayspa.com, which keeps the Meta Pixel off.
• Email admin@hairplayspa.co to ask us to stop including your bookings in ad measurement. We will act on it within 30 days.

Google Analytics

Both of our websites use Google Analytics to count visits and see which pages work. Google sets cookies to do this. You can block them in your browser settings or with Google's opt-out add-on: https://tools.google.com/dlpage/gaoptout

Who we share information with

We do not sell your personal information. We share it only with these service providers, and only to run our business:

• Vagaro: booking, payments and our booking forms
• HighLevel: our contact list, texts and emails
• Meta: ads and ad measurement, as described above
• Google: Google Analytics, and a Google Sheets record of bookings and ad clicks that our automation keeps
• Cyber Realm (JNR Infinite Realm LLC): our marketing and automation provider. It runs our booking tracking, review requests and booking assistant on a server hosted by Render in the United States, and uses these services to do it:
  • an AI routing service (OpenRouter) and the AI model it chooses, for messages with names and contact details removed
  • Telegram, for staff alerts that show booking numbers and totals, never your name or contact details
• Our website hosts, which see your IP address when you visit

We may also share information when the law requires it, to protect our rights or our guests, or as part of selling or transferring our business.

How long we keep information

• Booking records stay in Vagaro for as long as we need them for your service, taxes and the law.
• Contact records stay in HighLevel until you ask us to delete them, or until we no longer need them.
• Our automation keeps your name, email address and the link to your contact record for no more than 30 days. After that it removes them from its booking records and deletes its record of your ad click. What stays is a scrambled code and the booking itself (date, service, price and the ad it came from), so our ad reports stay accurate.
• Our automation's run logs are deleted automatically within 30 days.
• Meta may keep what it receives for up to two years.

How to see, correct or delete your information

You can ask us to show you, correct or delete the information we hold about you. Anyone can ask, wherever you live.

1. Email admin@hairplayspa.co with the subject "Privacy request", or call (405) 494-0560.
2. Tell us what you would like us to do. We may ask you to confirm from the email address or phone number we have on file, so we know it is you.
3. We will reply within 30 days. We delete your information from our records, our contact list and our automation, and ask our service providers to do the same.

We may keep what the law requires (such as tax records) and a record that you opted out, so we never text you again. You can also delete information Meta holds about you through your Facebook or Instagram settings.

Security

We use administrative, technical and physical safeguards to protect your information from unauthorized access, disclosure, change or destruction.

Children

Our services and ads are for adults. We do not knowingly collect information from children under 13. You must be 18 or older to join our text messages.

Changes to this policy

We may update this policy. When we make an important change, we will update the "Last Updated" date at the top of this page.

Contact us