Privacy Policy

Overview

Verdrobe, Inc. (Verdrobe, we, our and/or us) operates verdrobe.com (the Website), where Shanshan offers a personal styling practice and where you can enquire about and book a styling service (together, the Services).

We are committed to handling personal information in accordance with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), applicable U.S. federal and state privacy and consumer-protection laws, and, where they apply, the EU General Data Protection Regulation and UK GDPR.

“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (and includes “personal data” under the GDPR).

You do not need to provide any personal information simply to read the Website. The main personal information we hold is the details you choose to give us when you make a styling enquiry, together with limited technical and usage data we collect automatically. We do not sell or share your personal information.

What personal information we collect

When you make an enquiry or contact us. If you submit the enquiry form or email us, we collect the details you provide — such as your name, email address, the service you are interested in, and the content of your message — so that we can respond and provide the styling service.

Automatically, when you use the Website. We collect limited technical and usage data such as IP address, approximate (city/region-level) location inferred from your IP, browser and device type, pages viewed, links clicked, and the date and time of access, together with identifiers set by cookies and similar technologies. We use a privacy-conscious analytics tool (PostHog) for this; see the Cookies and analytics section and our Cookie Notice.

We do not seek to collect sensitive personal information (such as health, precise geolocation, or racial or ethnic origin). Please do not send it to us.

Summary: categories of personal information we collect

This table is our California “notice at collection” under the CCPA/CPRA. It summarises the statutory categories of personal information we collect, the main purposes, and whether we “sell” or “share” it as those terms are used under California law.

We do not sell personal information, and we do not “share” it for cross-context behavioural advertising, as those terms are used under the CCPA/CPRA. Because the Services are intended only for users aged 16 and over, we do not knowingly collect the personal information of anyone under 16.

How we use your personal information

We use and disclose your personal information to:

• respond to your styling enquiry, arrange and provide the service you book, and send you related messages;
• respond to your other enquiries, feedback and complaints, and provide support;
• operate, maintain, secure, analyse and improve the Website;
• enforce our Terms and protect our legal rights, and comply with our legal obligations; and
• any other purpose disclosed at the time of collection or to which you consent.

We do not use your content to train general-purpose AI models. If that ever changes, we will update this Policy beforehand and, where the law requires, give you notice and the ability to opt out.

Where the GDPR applies, we rely on the following lawful bases: your consent (where we ask for it); our legitimate interests (operating, securing and improving the Website, and basic analytics), balanced against your rights; performance of a contract or steps at your request (responding to and providing a styling service you ask for); and compliance with legal obligations. You may withdraw consent at any time.

Cookies and analytics

We use a small number of cookies and similar technologies to operate the Website and to understand how it is used. Some are strictly necessary; our analytics cookie (PostHog) is used to measure usage so we can improve the site. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings. See our Cookie Notice for detail.

Who we disclose your personal information to

We may disclose your personal information to:

• service providers who help us run the Website (hosting, database storage and analytics) — for example Supabase, which stores enquiry details, and PostHog, which provides analytics — who are bound to use it only for our purposes;
• professional advisers, and any person authorised by law to obtain it;
• a successor entity in connection with a merger, acquisition, financing or sale of assets (see Business transfers); and
• any party where necessary to protect rights, safety or property, or to comply with law.

International data transfers

We are based in the United States and process personal information there. If you access the Services from outside the United States, you understand your information will be transferred to and processed in the United States. Where personal data is transferred out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum / IDTA) or an applicable adequacy decision.

Verdrobe is operated from the United States and these Services are directed to users in the United States. We do not target, market or actively offer the Services to individuals in the European Economic Area (EEA) or the United Kingdom, and we have no establishment in those regions. If you choose to access the Services from the EEA or the UK, you do so on your own initiative. Where the EU or UK GDPR nonetheless applies to our processing of your personal data, the lawful bases, transfer safeguards and data-subject rights described in this Policy apply, and you may contact us using the details below to exercise them.

How we keep personal information secure

We take reasonable technical and organisational steps to protect personal information from misuse, loss and unauthorised access, modification or disclosure, including access controls, encryption in transit and reputable providers. No method of transmission or storage is completely secure. If a data breach occurs that triggers notification obligations, we will notify affected individuals and the relevant authorities as required by applicable U.S. state breach-notification laws (for example California Civil Code §1798.82) and any other applicable law. If you suspect any misuse, loss or unauthorised access to your personal information, please contact us immediately.

How long we keep personal information

We keep personal information only for as long as we need it for the purposes in this Policy, or as required by law. We keep enquiry and correspondence details for as long as needed to respond to you, provide any service you book, and keep reasonable business records; and we keep analytics data for a limited period to understand and improve usage. You can ask us to delete your details at any time, and we will remove or de-identify them within a reasonable period, except where we must retain certain records to meet legal obligations.

Your privacy rights

You can exercise the rights below by contacting us.

California (CCPA/CPRA): subject to conditions, you have the right to know and access the personal information we collect; to delete it; to correct it; to opt out of any “sale” or “sharing” (note that we do not sell or share); to limit the use of sensitive personal information; and to be free from discrimination for exercising your rights. We may need to verify your identity, and you may use an authorised agent.

Other U.S. states: if you reside in a state with a comprehensive privacy law, you may have similar rights to access, delete, correct and opt out; contact us to exercise them.

EEA / UK (GDPR): subject to conditions, you have the rights to access; rectification; erasure; restriction; data portability; objection (including to direct marketing); and to withdraw consent. You may also lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office at ico.org.uk).

Australia (courtesy note): if you are in Australia and believe we hold personal information about you, you may contact us to access or correct it; we will handle your request consistently with this Policy.

Children

The Services are intended for users aged 16 and over. The Services are not directed to anyone under 16, and we do not knowingly collect personal information from anyone under 16 (consistent with the U.S. Children's Online Privacy Protection Act (COPPA), the children's provisions of the CCPA/CPRA, and Article 8 of the GDPR / UK GDPR where applicable). If you believe a child under 16 has provided us personal information, please contact us and we will take reasonable steps to delete it.

Third-party websites and links

This Policy applies solely to personal information we collect through the Services. We are not responsible for the collection of information or the privacy practices of any third parties whose websites may be linked on our Website, our social media accounts or in our email communications. We encourage you to read their privacy policies.

Business transfers

If we are involved in a sale, merger, consolidation, change in control, transfer of substantial assets, reorganisation or liquidation, we may transfer, sell or assign personal information collected by us to one or more relevant third parties, subject to this Policy and applicable law.

Changes to this Policy

We may update this Policy from time to time. The current version will always be available on the Website with the “Last updated” date. If we make material changes, we will take reasonable steps to notify you, for example by email or a notice on the Website.

Questions or complaints

If you have any question about this Policy, wish to exercise a privacy right, or wish to make a complaint, please contact us by email at hello@verdrobe.com, Verdrobe, Inc., 2108 N ST STE N Sacramento, CA, 95816, USA. California residents may also contact the California Privacy Protection Agency or the California Attorney General; EEA/UK residents may contact their local supervisory authority.