Privacy Policy

Effective date: August 9, 2026

1. Who this policy covers

I am Carmen Machado, an individual hair stylist working under the name Hair by Carmen Machado. In this policy, "I," "me," and "my" mean Carmen Machado.

This policy covers two things only:

• This website — the pages you are reading right now.
• My own direct communications with you — the phone number and WhatsApp account I use to talk to clients, +1 972 565 5700.

What this policy does not cover: I work at Lucy's Salon, which is a separate business. Lucy's Salon is not owned or controlled by me, and it has its own privacy practices and its own records. Nothing in this policy describes, speaks for, or applies to Lucy's Salon. If you have questions about how the salon handles information, ask the salon directly.

This policy also does not cover other companies' websites or apps that you may reach from here, such as Google Maps or WhatsApp. Those companies act under their own privacy policies.

2. The short version: this website collects nothing

This website does not collect personal information about you.

That is the plain fact, not a simplification:

• There are no forms on this site. No contact form, no booking form, no newsletter signup, no search box, no comment box. There is nowhere to type anything.
• There are no accounts and no logins.
• There is no analytics software of any kind — no Google Analytics, no Meta Pixel, no tag manager, no heatmaps, no session recording, no A/B testing.
• There are no advertising or marketing trackers, no ad networks, no retargeting, no customer relationship management (CRM) tool, and no mailing list.
• This website sets no cookies of its own. See the separate Cookie Policy for details.

If you never contact me, I do not learn who you are from this website.

3. What is actually processed, and why

There are only three categories of information involved anywhere in this site, and they are described below in full.

3.1 Your language choice (stored in your own browser)

The site has an English / Spanish toggle. When you choose a language, your browser saves that choice in its session storage under the key carmen_lang, with a value of either en or es.

• Purpose: so the page stays in the language you picked while you browse.
• This is not a cookie, and it is never sent to me or to anyone else. It stays inside your browser.
• It contains nothing personal — just the two letters en or es.
• Browsers clear session storage when you close the tab. Closing the tab erases it.

3.2 Your IP address, as seen by the companies that deliver files to your browser

Whenever any browser loads any web page, it has to ask a server for the files. To send those files back, the server necessarily sees the requesting IP address, along with basic technical information your browser sends automatically (such as browser type and version).

This site loads three animation files from two public content delivery networks, and it embeds a Google map on the contact section. Those companies therefore see your IP address and basic browser information. This is a technical consequence of serving files — it is not something I ask them to collect, and none of it comes back to me. Details are in section 4.

• Purpose: to deliver the page and its scroll animation to your browser, and to show a map of where I work.
• I do not receive, see, store, or have access to your IP address from any of this.

3.3 What you send me if you start a WhatsApp or phone conversation

Nothing is sent to me until you decide to contact me. The WhatsApp buttons on this site are ordinary links — clicking one opens WhatsApp; it does not send a message by itself, and it does not tell me you visited.

If you do message or call me, I receive whatever you choose to send. In practice that is usually:

• your name (or whatever name your WhatsApp profile shows),
• your phone number,
• photos of your hair or reference photos you want to show me,
• what you want done, and any scheduling details you mention.

Purposes: to answer your question, to discuss what you want done, to agree on a time, and to keep enough context to serve you well at your next appointment.

I do not use your messages or photos for advertising. I do not add you to a mailing list. I do not build a profile of you, and I do not make automated decisions about you.

If you want a photo of you posted publicly, I will ask you first. I do not post client photos without asking.

4. Third parties, and the categories they fall into

I do not sell your personal data. I have never sold it. I do not share it for targeted advertising, and I do not use it for profiling in furtherance of decisions that produce legal or similarly significant effects.

Below is the complete list of third parties that can receive anything at all, what they receive, and what category of recipient they are. This list is written to match the notice contents described in the Texas Data Privacy and Security Act, Tex. Bus. & Com. Code § 541.102.

Categories of personal data shared with third parties: internet or device identifiers (IP address), basic browser and device information, and — for the map and for links you click — the address of the page you were on. Nothing else. No name, no phone number, no photo, and no message content is shared with any of these companies by the website itself.

The Google map embed uses no API key and no Google account of mine, so nothing Google sees is linked back to me or reported to me. The animation libraries are loaded from ordinary public addresses with no identifier attached. I get no reports, dashboards, or visitor data from any of these companies.

Hosting: this site is a set of static files hosted with Hostinger. Like most web hosts, Hostinger's own privacy policy states that it automatically logs technical request data — IP address, browser and device information, referring/exit pages, and a date/time stamp — for visitors to sites it hosts. Hostinger's policy does not publish a fixed retention period for that data; it says only that it keeps it as long as needed to provide the service and meet its own legal obligations. I do not have access to those logs myself, and none of it is reported back to me. If you want the specifics, Hostinger's own privacy policy is the authoritative source. Hostinger's Privacy Policy

5. Your rights under Texas law, and how to use them

The Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code ch. 541, gives Texas consumers certain rights over their personal data.

Does the TDPSA apply to me? The TDPSA contains an exemption for a 'small business' as defined by the U.S. Small Business Administration (§ 541.004). I am one stylist working alone, with revenue and headcount far below the SBA size standard for the industry, so on the facts as they stand today, I appear to qualify as a small business and to be exempt from most of the TDPSA's obligations. That exemption does not cover one thing: even a small business must get a consumer's consent before selling their sensitive personal data. I do not sell any personal data, sensitive or otherwise, so that carve-out does not change anything here.

A note on honesty: the paragraph above is my own practical read of the facts, not a legal conclusion, and it is not legal advice to you either. I am providing the notice below and honoring these requests voluntarily, as good practice, because I think you should have them regardless.

5.1 The rights

You may ask me to:

• Confirm and access — tell you whether I am processing your personal data, and let you see it.
• Correct — fix inaccuracies in personal data you have given me, taking into account the nature of the data and the purpose.
• Delete — delete personal data you provided or that I have about you.
• Get a portable copy — receive a copy of the personal data you gave me, in a portable and readily usable format, where it is technically feasible.
• Opt out of the processing of your personal data for (a) targeted advertising, (b) sale of personal data, and (c) profiling in furtherance of decisions that produce legal or similarly significant effects.
• Not be discriminated against for exercising any of these rights — I will not deny you service, charge you a different price, or give you a different standard of service because you asked me to confirm, correct, delete, or opt out.

On that last point, so it is clear: I do none of those three things, so there is nothing to opt out of. You are still welcome to send the request, and I will confirm that in writing.

5.2 How to submit a request

Send your request to me by either of these channels:

• WhatsApp or phone: +1 972 565 5700 — this is the working channel and the fastest one.
• Email: cathimachado11@gmail.com

Please say clearly that you are making a privacy request, tell me which right you are exercising, and give me enough detail to find your information — normally the phone number you messaged me from. If I cannot reasonably verify that the request is really yours, I may not be able to act on it, and I will tell you why.

You may use an authorized agent to submit an opt-out request on your behalf.

Submitting a request is free. If a request is manifestly unfounded, excessive, or repetitive, I may charge a reasonable fee or decline to act, and I will explain why if I do.

5.3 Response time

I will respond within 45 days of receiving your request. If I genuinely need more time because the request is complex or there are several of them, I may extend that once by another 45 days, and I will tell you about the extension and the reason before the first 45 days are up.

5.4 If I refuse — how to appeal

If I decline to act on your request, I will tell you why within 45 days, and I will explain how to appeal.

To appeal, reply through the same channel you used (WhatsApp/phone at +1 972 565 5700, or cathimachado11@gmail.com) and say that you are appealing the decision. I will review the appeal and give you a written answer within 60 days, with a plain explanation of my reasons.

If I deny your appeal, I will give you a way to submit a complaint to the Office of the Attorney General of Texas, Consumer Protection Division, which accepts consumer complaints through its website at texasattorneygeneral.gov. You may complain to the Attorney General whether or not you appeal to me first.

5.5 People outside Texas

These rights are written around Texas law. As a courtesy, I will handle the same kinds of requests from people outside Texas the same way, without promising to apply any other state's or country's law.

6. How long I keep things, and how to have them deleted

The website keeps nothing. There is no database, no visitor log I control, and no stored profile. Your language choice lives only in your browser and disappears when you close the tab.

WhatsApp conversations and photos you send me stay in my WhatsApp account and on my phone. I keep them while you are an active client, so I can remember your history — your formula, what we did last time, what you liked and did not like — and for a reasonable period afterwards in case you come back.

I want to be straightforward about this: deletion is manual. I delete conversations and photos by hand, when you ask me to. There is no automated retention schedule and no software that purges old messages on a fixed timetable.

To have it deleted: message me at +1 972 565 5700 or email cathimachado11@gmail.com and ask me to delete our conversation and your photos. I will do it and confirm when it is done, within the timeframes in section 5.3.

Two honest limits: (a) deleting a WhatsApp conversation on my side does not delete the copy on your own phone, and it does not control anything Meta holds on its own systems — that is between you and Meta; (b) if I have a legal reason to keep something (for example, a dispute or a legal obligation), I will tell you.

7. Security

I am one stylist with a website made of static files. Here is a proportionate and truthful description of what that means.

• The website itself has no database, no accounts, and no stored personal data, so there is nothing on the site for anyone to steal.
• This site is built to be served over HTTPS, the standard encrypted connection between your browser and the server, and whoever hosts it should keep it configured that way.
• Your conversations with me on WhatsApp are protected by WhatsApp's own end-to-end encryption, which is provided by Meta, not by me.
• On my side, I take reasonable steps appropriate to a solo business to protect the messages and photos on my phone — a device lock, keeping the phone with me, and not forwarding client photos to people who do not need them. This is consistent with the duty in Tex. Bus. & Com. Code § 521.052 to use reasonable procedures to protect sensitive personal information and to destroy records containing it when they are no longer needed.

I want to be equally clear about what I am not claiming: I have no security certification, no SOC 2 report, no security team, and no formal information security program. No system is perfectly secure, and I will not pretend otherwise.

8. Children

This website and my services are not directed to children under 13, and I do not knowingly collect personal information from children under 13. Consistent with the U.S. Children's Online Privacy Protection Act (COPPA), if I learn that a child under 13 has sent me personal information without a parent's or guardian's involvement, I will delete it.

If a minor is coming in for an appointment, I expect a parent or guardian to be the one arranging it and communicating with me.

9. Accessibility

Lucy's Salon, the physical business where I work, is a place of public accommodation and is expected to be accessible under Title III of the Americans with Disabilities Act (ADA). I do not own, operate, or control the building, so I cannot make representations about it here — if you have questions about physical access, please contact the salon directly.

For this website: I have not run a formal accessibility audit against WCAG or any other standard, and I am not claiming full compliance. If you use assistive technology and run into a problem reading or using this site, tell me — WhatsApp/phone at +1 972 565 5700, or cathimachado11@gmail.com — and I will do what I reasonably can to fix it.

10. If there is a data breach

If personal information I hold is compromised, I will notify affected people as required by Tex. Bus. & Com. Code § 521.053: without unreasonable delay, and no later than 60 days after I determine that a breach occurred, unless a law enforcement agency asks me to delay. If a breach affects 250 or more Texas residents, I will also notify the Office of the Attorney General of Texas within that same period, as the statute requires.

11. Changes to this policy

If my practices change — for example, if I ever add a booking form or start using an analytics tool — I will update this policy before or when that change goes live, and I will change the effective date at the top. Material changes will be flagged on this page rather than made quietly.

12. How to contact me

Hair by Carmen Machado — Carmen Machado

• Phone / WhatsApp: +1 972 565 5700 (the fastest and preferred channel for privacy requests)
• Email: cathimachado11@gmail.com
• Business mailing address: 4300 Main St, Ste 600, The Colony, TX 75056-2802

The mailing address above is the address of Lucy's Salon, the separate business where I work. Mail sent there reaches me. It does not make Lucy's Salon a party to this policy, and the salon has no responsibility for it.