Luxe LA Head Spa
Privacy Policy
Last updated: June 15, 2026
LUXE LA Head Spa (“we”) respects your privacy. This policy explains what we collect, why, and your rights under California law (CCPA/CPRA).
What we collect
When you book: name, email, phone, appointment notes you provide.
When you pay: Stripe processes your payment; we receive a transaction confirmation, not your full card.
When you use the Scalp Scan: the photo you upload, plus the AI-generated wellness recommendations.
Automatic: standard web analytics (browser, device, pages visited). We do not use ad-tracking cookies.
How we use it
- To schedule and deliver your appointment
- To process payments
- To generate Scalp Scan recommendations
- To send you appointment confirmations and reminders
- To improve our services (anonymized analytics only)
Who we share with
- Stripe — payment processing
- Anthropic / OpenAI — Scalp Scan photo analysis (photos are sent to the AI provider's API for processing; per their published policies, they do not use customer API data to train models)
- Supabase — booking and account database (hosted in U.S.)
- We do NOT sell or rent your personal information.
Sensitive personal information (CCPA/CPRA)
Scalp Scan photos may qualify as biometric or health-adjacent information under California law. We:
- Only collect them with your explicit consent (the consent screen before upload)
- Use them only for the Scalp Scan you requested
- Delete them within 30 days of the scan unless you ask us to keep them
- Never sell, share for cross-context behavioral advertising, or use for any other purpose
Your CCPA rights
You have the right to:
- Know what we've collected about you
- Request deletion of your information
- Correct inaccurate information
- Opt out of any “sale” or “sharing” (we don't do either)
- Limit use of sensitive personal information
To exercise any of these, email businesswiman@gmail.com. We respond within 45 days.
Cookies
We use only essential cookies (session, auth). No third-party advertising cookies.
Children
LUXE LA services and this website are not intended for users under 18 without a parent/guardian.
Security
We use industry-standard encryption (TLS in transit, encrypted-at-rest in Supabase). No system is 100% secure; you use the service at your own risk.
Updates
Current version always at https://luxelaheadspa.com/privacy. Material changes will be emailed to active members.
Questions? Email businesswiman@gmail.com.
See also our Terms of Service and Studio Policies.