We maintain transparent data rights and strict consent gates.

Effective Date

This privacy policy took effect on October 13, 2026 and governs all data interactions on chippennailsedwardsinc.com from that date forward. Any subsequent modifications will be published directly on this URL with an updated timestamp.

Data Controller Identity

The data controller responsible for the processing of personal data collected through this website and through studio communications is:

Chippennailsedwardsinc, trading at chippennailsedwardsinc.com.
Postal Address: 56 Edwards Village Blvd, Edwards, Colorado 81632, Edwards, Colorado, United States.
Direct Telephone: 970-926-1909.
Email: [email protected].

Categories of Data Collected

Our web platform records only data intentionally submitted by visitors or automatically generated as technical operational metadata:

• Inquiry Form Data: When submitting an appointment inquiry via kuzo501.php, the system records your full name, telephone number, email address, physical address or Colorado lodging details, requested service kind (such as regular manicure, gel manicure, dipping with removal, or signature pedicure), appointment notes, desired service specifications, and affirmative consent checkbox.
• Automated Request Metadata: Alongside form inputs, our server records the submitter's IP address, browser user-agent string, referring URL, the exact timestamp when the form was rendered on screen, and the exact timestamp when the submission was transmitted.
• Support Desk Chat Transcripts: When engaging our live desk chat powered by dubibc9.php, we collect the conversation transcript, optional name, contact details provided during intake, and issue a temporary browser token stored in localStorage so returning visitors can view their active thread.
• Consent Record: When you accept or decline cookies in our docked banner, your preference is saved locally in your browser storage under the key site_consent_v2. No other preference cookies are written.
• Advertising Click Identifiers: Inbound advertising traffic appends platform parameters to landing URLs: gclid from Google Ads, msclkid from Microsoft Advertising, and fbclid from Meta Ads.

What We Do Not Collect: We maintain no user accounts and no online payment card intake. We never ask for or store credit card numbers online; all service balances are settled in person at our studio station at 56 Edwards Village Blvd.

Purposes of Data Processing

The data collected is processed exclusively for defined operational and communication purposes:

• To review nail service requests, verify technician chair availability, and reply with confirmed booking times or service consultations.
• To transmit appointment notifications, directions to Edwards Village Blvd, and preparation instructions (such as previous acrylic removal needs).
• To secure our infrastructure against automated spam, denial-of-service attempts, and form injection bots.
• To evaluate advertising campaign effectiveness and landing page conversion rates across Google Ads, Microsoft Advertising, and Meta Ads strictly when user consent is active.

Legal Bases for Processing

Under applicable state and international data protection regulations, we process data under three distinct legal bases:

• Consent: Storing non-essential cookies, recording advertising identifiers (gclid, msclkid, fbclid), and initiating promotional marketing touchpoints occur solely when the visitor provides affirmative opt-in consent.
• Contractual Necessity: Processing inquiry form submissions, contact phone numbers, and chair specifications is necessary to take preliminary steps toward entering an agreed service contract for nail care.
• Legitimate Interest: Maintaining 60-day server access logs and evaluating IP network headers is required to secure our digital property, investigate security faults, and ensure operational availability.

Paid Advertising Platforms & Click Identifiers

Chippen Nails Edwards Inc runs paid traffic campaigns to bring mountain visitors and local residents to our Edwards studio. We actively receive paid clicks today from:

• google ads — Google LLC / Google Ireland Ltd. When a prospective client clicks our search or display placement, Google attaches the unique click identifier gclid to the destination URL.
• microsoft advertising — Microsoft Ireland Operations Ltd / Microsoft Corporation. Clicks originating from Bing search queries append the unique click identifier msclkid.
• Meta Ads — Meta Platforms Ireland Ltd. Inbound traffic from Instagram or Facebook campaigns appends the unique parameter fbclid.

Neither Google Ads, Microsoft Advertising, nor Meta Ads has endorsed, reviewed, approved, or verified our studio or treatments. We publish this disclosure to maintain complete operational candor regarding how traffic arrives at our website.

Google Consent Mode v2 Architecture

Our website implements consent mode v2 directly within client-side script architecture. Prior to any visitor interaction with our consent banner, the four foundational advertising and measurement signals are held denied:

• ad_storage — denied
• ad_user_data — denied
• ad_personalization — denied
• analytics_storage — denied

These four signals remain strictly denied until the visitor clicks the affirmative "Accept" button in our docked banner. If a visitor selects "Decline", closes the notice without accepting, or subsequently revokes consent via our settings control, all four parameters are immediately commanded back to denied. When set to denied, no marketing cookies are written, and advertising platforms receive only anonymized, cookieless pings without persistent device markers.

Third-Party Data Processors

We share personal data only with specified infrastructure providers required to operate our web presence and communications:

• Google Ireland Ltd / Google LLC: Receives measurement signals and Google Ads conversion events in accordance with Consent Mode v2 status.
• Microsoft Ireland Operations Ltd: Receives Microsoft Advertising measurement data via Bing Universal Event Tracking (UET). Microsoft's data protection practices are detailed in full at privacy.microsoft.com.
• Meta Platforms Ireland Ltd: Processes Meta Ads conversion events when campaigns are active and consent has been affirmed.
• Digital Ocean / Web Hosting Facility: Hosts our secure web server, application scripts, and inquiry database located within the United States.
• Mail Route Relay Provider: Encrypts and relays inquiry submission notification emails from kuzo501.php directly to our administrative inbox at [email protected].

International Data Transfers

Chippen Nails Edwards Inc operates its servers and nail studio within the United States. If you access our website from the European Economic Area, the United Kingdom, or other international regions, your information will be transferred to, stored, and processed in the United States. Where personal data is transferred across international boundaries to global infrastructure partners (such as Google or Microsoft), transfers are executed under standard contractual clauses (SCCs) approved by the European Commission or equivalent adequacy determinations.

Deterministic Data Retention Windows

We do not hold personal data indefinitely. Data is purged according to strict operational timetables:

• Customer Inquiries & Email Notifications: Retained for 24 months from the date of receipt to maintain client service histories and handle follow-up appointment queries, after which records are permanently deleted.
• Support Desk Chat Transcripts: Retained for 12 months in server database storage before automated purging.
• Web Server & Access Logs: Retained for 60 days before automatic rotation and permanent overwriting.
• Browser Consent Choice: Retained locally on your device under site_consent_v2 for 12 months, after which the banner re-prompts for your preference.
• Data Rights Inquiries: Any data subject access request submitted to us is investigated, documented, and answered within 14 days.

Technical & Organizational Security Measures

We implement industry-standard safeguards to protect data transmitted to our studio:

• All web traffic between your browser and our server is encrypted using Transport Layer Security (TLS 1.3) with modern cryptographic cipher suites.
• Server endpoints feature rate-limiting defenses against brute-force intrusion and automated bot attacks.
• Form inputs pass through server-side sanitization routines before storage, rejecting executable scripts and payload strings.
• Administrative email access requires strong multi-factor authentication (MFA) restricted solely to authorized studio operators.

European Data Subject Rights (GDPR)

If you reside within the European Union, European Economic Area, or United Kingdom, the General Data Protection Regulation (gdpr) grants you specific enforceable rights regarding your personal information:

• Right of Access: You may request a complete copy of any personal data we hold concerning you.
• Right to Rectification: You may request the prompt correction of inaccurate or incomplete contact details.
• Right to Erasure ('Right to be Forgotten'): You may demand the permanent deletion of your inquiry records where retention is no longer justified.
• Right to Restriction of Processing: You may restrict how we use your data while an accuracy dispute is being verified.
• Right to Data Portability: You may receive your data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object at any time to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Where processing relies on consent, you may revoke your permission at any time without affecting prior lawful processing.

United States Privacy Rights (CCPA / CPRA & State Laws)

Under United States state privacy laws — including the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa), the Colorado Privacy Act (CPA), and complementary state statutes — residents possess specific rights:

• Right to Know & Access: The right to request disclosure of the specific categories of personal data collected, sources, business purposes, and third parties with whom data was shared over the preceding twelve months.
• Right to Delete: The right to demand the deletion of personal information collected directly from the consumer.
• Right to Correct: The right to rectify inaccurate personal information maintained in our studio databases.
• Right to Opt Out of Sale or Sharing: We do not sell your personal data for monetary compensation. To the extent that targeted advertising tracking across Google Ads or Meta Ads is categorized as "sharing" under California law, you may opt out instantly via our cookie settings or by enabling browser-level signals.
• Right to Non-Discrimination: We will never deny services, alter chair pricing, or degrade service quality because you exercised your statutory privacy rights.

Global Privacy Control (GPC)

Our website programmatically recognizes and honours the global privacy control signal (the Sec-GPC HTTP header) transmitted by compatible browsers. When our application detects an active GPC signal, all non-essential marketing, analytics storage, and advertising click identifier synchronization are automatically treated as opted out, holding advertising consent denied without prompting for confirmation.

Children's Privacy Protection

Our website and online inquiry mechanisms are intended strictly for adults and individuals aged eighteen and older. We do not market to or solicit personal information from children under sixteen years of age. If we become aware that personal data of a child has been collected through an inquiry submission without verified parental consent, we will purge that record immediately from our systems.

Supervisory Authority Complaints

If you believe our processing of your personal data violates applicable privacy laws, you have the right to file a formal complaint with the relevant regulatory authority:

• In Colorado, you may file with the Office of the Colorado Attorney General (Consumer Protection Section).
• In California, you may submit complaints directly to the California Privacy Protection Agency (CPPA) or the California Attorney General.
• In other US jurisdictions, complaints may be lodged with your respective State Attorney General's Consumer Protection Division.
• In Europe, you may lodge a complaint with the Data Protection Authority (DPA) in your EU member state of residence.

Submitting a Data Subject Access Request (DSAR)

To exercise any of the rights described above — including access, deletion, rectification, or opting out — contact our data protection desk directly:

Accessibility Commitment & Standards

Chippen Nails Edwards Inc is committed to digital accessibility for individuals with visual, auditory, motor, and cognitive disabilities. We engineer this website to conform with Level AA standards of the Web Content Accessibility Guidelines (WCAG 2.1).

Key accessibility provisions implemented across our markup include:

• A skip-to-content link positioned at the very top of each page for keyboard users.
• Semantic HTML5 structural landmarks with exactly one descriptive <h1> per page.
• Text contrast ratios exceeding 4.5:1 against slate grounds across all body and display typefaces.
• Visible keyboard focus outlines with 3px offsets on all interactive buttons, links, and form fields.
• Touch targets engineered with a minimum 44px by 44px dimension for mobile and assistive touch users.
• Respect for the prefers-reduced-motion operating system setting, which halts smooth transitions and headline animations.

If you encounter an accessibility barrier or require assistance booking a service, please contact our desk at 970-926-1909 or email [email protected]. We will accommodate your inquiry promptly.

Modifications to This Privacy Policy

We may update this privacy statement periodically to reflect changes in our studio practices, regulatory statutes, or advertising integrations. Any update will be posted immediately to this page with an amended effective date. Where modifications significantly alter how we process previously submitted contact details, we will notify affected individuals via their registered email address prior to implementing the changes.

Direct Operator Contact

For questions regarding this policy, our Consent Mode v2 implementation, or our sanitation practices, contact our studio desk: