Cookie Policy

Effective date: August 9, 2026

This site sets no cookies of its own

That is the whole headline. Hair by Carmen Machado does not set a single cookie on this website. Not for analytics, not for advertising, not for "preferences," not for anything. The site's code never touches cookies at all.

The rest of this page explains what cookies are, the one small thing this site does store in your browser (it is not a cookie), and the third-party companies that can set their own cookies when their content loads on the site.

1. What cookies and similar technologies are

A cookie is a small text file that a website asks your browser to save, so that the site can recognize your browser later. Cookies are how sites remember logins, shopping carts, preferences — and, on many sites, how advertising networks follow you around.

"Similar technologies" means other ways of storing data in your browser that are not technically cookies, such as local storage and session storage. They store data on your device, but unlike cookies they are not automatically attached to every request your browser sends to a server.

2. The one thing this site stores: your language choice

This site has an English / Spanish toggle. When you pick a language, the site saves that choice in your browser's session storage under the key:

carmen_lang — value: en or es

That is the entire contents. Two letters.

• It is not a cookie. It is session storage, which behaves differently: it is never sent to a server automatically, and it is not shared with any other site.
• It contains nothing personal. No name, no identifier, no visitor number, nothing that could be used to recognize you.
• It is never transmitted anywhere. Not to me, not to any third party. It stays in your browser.
• It dies when the tab closes. Session storage is scoped to the browser tab. Close the tab and it is gone — that is standard browser behavior, not something the site has to do.
• Purpose: so the page stays in the language you chose while you browse. That is its only job.

3. Third-party cookies I do not control

I do not set cookies. But the home page of this site loads a few files and one embedded map from other companies, and those companies can act on their own once their content is running in your browser. (This particular Cookie Policy page is simpler than that — it does not load any of them itself.) Here is exactly what is involved on the site as a whole — nothing else is.

3.1 Google Maps (embedded map in the Contact section)

The Contact section contains a map embedded from Google.

• When that map loads, Google can set its own cookies inside the map frame. Those cookies belong to Google, are set by Google, and are governed by Google's own privacy and cookie policies. I do not set them, cannot read them, and cannot turn them off from my side.
• Google also receives your IP address, standard browser information, and the address of the page you are on, because the map frame is configured to pass the referring page URL.
• The map is lazy-loaded. Because of that, it generally does not load until you scroll near the contact section. If you never scroll that far, it generally never loads.
• The embed is keyless — there is no Google API key and no Google account of mine attached to it. Nothing Google sees is reported back to me.

3.2 The content delivery networks: Cloudflare and jsDelivr

This site loads three small animation libraries from two public CDNs:

• Cloudflare (cdnjs.cloudflare.com) — the GSAP and ScrollTrigger animation libraries
• jsDelivr (cdn.jsdelivr.net) — the Lenis smooth-scroll library

To be accurate about what they do and do not do:

• These are plain script files. They are not analytics, not tracking, and not advertising code. They only make the page scroll and animate.
• Serving a file to your browser means the CDN necessarily sees your IP address and standard browser request information. That is unavoidable for any file loaded from any server, anywhere.
• Because these files are requested from a different domain than this site, cookies for that domain, if the provider sets any, would be third-party cookies set by that provider, not by me. I have no visibility into and no control over what Cloudflare or jsDelivr do on their own domains, and each is governed by its own privacy policy.
• Neither one sends me anything. I get no reports, no visitor counts, no dashboards.

3.3 WhatsApp links

The WhatsApp buttons on this site are ordinary links to wa.me. They do nothing at all until you click. No cookie, no request, no notification, nothing. If you click, your browser goes to WhatsApp and, from that point, Meta's own policies apply.

3.4 What is not here

No advertising cookies. No analytics cookies. No social media pixels or "like" widgets. No tag manager. No A/B testing. No heatmaps or session recording. No third-party fonts. No consent-management platform. None of these exist on this site.

4. How to control all of this

Because I set nothing, everything above is controlled through your own browser and through the third parties' own settings.

• Block or delete third-party cookies in your browser settings. Chrome, Safari, Firefox and Edge all let you block third-party cookies entirely or clear them at any time. Safari and Firefox block many of them by default.
• Use private / incognito browsing, which discards cookies and session storage when you close the window.
• Block scripts with a content blocker or browser extension if you want to stop the CDN files or the map frame from loading at all.
• Clear session storage by closing the tab. That removes the carmen_lang language key.

What breaks if you block things — and what does not:

• Blocking the Google Maps frame means the map will not appear. The written address and the "Get directions" link still work.
• Blocking the CDN scripts means the scroll animation will not run. The page still loads, still scrolls normally, and still shows everything.
• The content never breaks. Every word, every photo, every price, the phone number and the address are plain HTML and CSS served directly from this site. They do not depend on any third party, any cookie, or any script. If you block all of it, you can still read the entire site and still contact me.

5. Why there is no cookie banner

There is no cookie banner on this site for two straightforward reasons:

1. I set no cookies, so there is nothing of mine to ask you about.
2. Texas law does not require prior consent for cookies. The Texas Data Privacy and Security Act is built around opt-out rights, not opt-in consent before data is processed. It does not mandate a consent banner.

This is a statement of fact about how the site is built and what the law here requires. It is not a claim that you have consented to anything — no consent has been requested or collected on this site, because nothing here needs it. The cookies described in section 3 are set by Google inside its own map frame under its own terms, and your browser settings are the place to control them.

If I ever add something that does require consent, I will ask for it properly and update this page first.

6. Questions and effective date

Questions about this policy: +1 972 565 5700(phone / WhatsApp) or cathimachado11@gmail.com.

See also the Privacy Policy, which covers what happens if you message me directly.

Effective date: August 9, 2026. If the site's third-party components change, this page will be updated and the date changed with it.