PRIVACY POLICY

Effective Date: August 27, 2026
Last Updated: August 27, 2026

Batool Brows & Cosmetics (“Batool
Brows,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains
how we collect, use, disclose, retain, and protect personal information when you
visit

https://batoolbrowsandcosmetics.com/

(the “Site”), book or receive beauty or cosmetic services, purchase products or
gift cards, communicate with us, interact with our social media, or otherwise use
our services (collectively, the “Services”).

This Privacy Policy applies to information collected online and offline. It does
not apply to the practices of third parties that we do not own or control,
including third-party booking, payment, social media, advertising, or delivery
platforms. Those parties’ privacy policies govern their independent processing.

1. NOTICE AT COLLECTION

At or before collection, we may collect the categories of personal information
listed below for the stated purposes. We retain each category only as long as
reasonably necessary for the purposes described, including to provide Services,
maintain business and tax records, resolve disputes, enforce agreements, satisfy
legal obligations, and protect safety and security. Retention periods may vary
based on the nature of the information and applicable law.

Identifiers and contact information

Examples include names, email addresses, telephone numbers, mailing or billing
addresses, account or customer IDs, and IP addresses.

We use this information for booking, orders, customer service, account
administration, security, and marketing with permission. We generally retain it
for the duration of the customer relationship and for the additional period
reasonably needed for legal, tax, fraud-prevention, and dispute purposes.

We do not sell this information for money. Online identifiers may be shared with
advertising partners as described below.

Customer and commercial information

Examples include products or services purchased, booking history, preferences,
returns, payment status, and gift-card activity.

We use this information to fulfill transactions, personalize Services, maintain
records, prevent fraud, and improve our offerings. Transaction records are
generally retained for the legally required accounting and tax period and as
needed to resolve disputes.

We do not sell this information. Related online activity may be shared as
described below.

Payment information

Examples include payment-card tokens, the last four digits of a payment card,
billing details, and transaction details.

We use this information to process payments, refunds, chargebacks, and prevent
fraud. Full payment-card information is primarily processed and retained by our
payment processors. We retain transaction records as legally required.

We do not sell or share payment information for cross-context behavioral
advertising.

Internet or electronic activity

Examples include device and browser information, cookie identifiers, pages
viewed, clicks, referring pages, approximate location derived from an IP address,
and interactions with emails or advertisements.

We use this information to operate and secure the Site, conduct analytics,
troubleshoot problems, personalize experiences, and provide or measure
advertising. Retention depends on cookie settings, vendor terms, and our
legitimate operational needs.

This information may be shared with analytics or advertising partners where
legally treated as “sharing.”

Appointment, service, and consultation information

Examples include requested services, appointment dates, beauty preferences, intake
responses, allergies or sensitivities voluntarily disclosed, contraindications,
service notes, and before-and-after photographs taken with permission.

We use this information to determine service suitability, provide requested
Services, document consent and results, protect health and safety, and handle
complaints. We retain it as reasonably necessary for service, safety, insurance,
legal, and professional-record requirements.

We do not sell or share this information for cross-context behavioral advertising.

Audio, visual, and communications information

Examples include emails, texts, chat messages, photographs, customer-service
communications, and calls recorded after notice and consent.

We use this information to communicate, provide support, document consent, train
staff, and maintain quality and security. We retain it as reasonably necessary
for the communication or service and for legal and dispute purposes.

We do not sell or share this information for cross-context behavioral advertising.

Inferences and preferences

Examples include likely interests, product preferences, preferred appointment
times, and marketing segments.

We use this information to personalize Services and marketing and improve our
offerings. We retain it while relevant to our relationship or until you opt out
or request deletion, subject to legal exceptions.

This information may be shared for advertising where legally treated as
“sharing.”

Sensitive personal information

Examples include account credentials, precise geolocation if enabled, health-related
information voluntarily provided for service safety, and the contents of private
communications sent to us.

We use this information to authenticate users, prevent fraud, provide safe
Services, and respond to communications. We retain it only as long as reasonably
necessary for the disclosed purpose and applicable legal obligations.

We do not sell or share sensitive personal information. We do not use or disclose
sensitive personal information to infer characteristics or for purposes that
trigger a right to limit under the California Consumer Privacy Act.

We will not collect additional categories or use personal information for
materially different, unrelated, or incompatible purposes without providing any
notice or consent required by law.

2. INFORMATION WE COLLECT

Information You Provide

We collect information you provide when you:

Book, reschedule, or cancel an appointment;
Create an account or join a waitlist;
Purchase products, services, or gift cards;
Complete a consultation, consent, allergy, or intake form;
Subscribe to email or text marketing;
Enter a promotion, review a product or service, or submit content;
Contact us by email, telephone, text, chat, social media, or through the Site; or
Visit our location and receive Services.

Please do not send highly sensitive medical, financial, government-ID, or other
confidential information through ordinary email, chat, text, or Site forms unless
we specifically request it through an appropriate channel.

Information Collected Automatically

We and our service providers may use cookies, pixels, software development kits,
local storage, server logs, and similar technologies to collect device, browsing,
and interaction information. Some technologies are necessary for Site operation,
security, shopping-cart functions, and appointment booking. Others support
analytics, personalization, or advertising.

Where required, non-essential technologies will be used only after appropriate
notice and consent. You may manage available choices through our cookie settings
link or browser controls. Blocking cookies may affect Site functionality.

Information From Other Sources

We may receive information from booking platforms, payment processors, shipping
providers, social networks, marketing partners, referrals, fraud-prevention
providers, and publicly available sources.

If you book or buy through another platform, that platform may process your
information independently under its own privacy policy.

3. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

Provide, schedule, personalize, and improve Services;
Process payments, orders, deliveries, returns, refunds, and gift cards;
Conduct consultations and evaluate whether a requested service is appropriate;
Communicate about appointments, orders, account activity, policy changes, and customer support;
Send promotional email or text messages where permitted and honor opt-outs;
Operate, analyze, personalize, and secure the Site;
Detect fraud, misuse, security incidents, and unlawful activity;
Maintain records, enforce agreements, and establish, exercise, or defend legal claims;
Comply with tax, accounting, licensing, safety, regulatory, and other legal obligations; and
Carry out another purpose disclosed when information is collected or with your consent.

We do not use personal information to make decisions producing legal or similarly
significant effects through automated decision-making technology.

4. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information to:

Service providers and contractors, such as website hosting, appointment scheduling, payment processing, shipping, email and text delivery, cloud storage, customer support, analytics, cybersecurity, and professional advisers, subject to appropriate contractual restrictions;
Advertising and analytics partners, which may receive online identifiers and internet activity to measure campaigns or provide interest-based advertising; this may be considered “sharing” under California law even when no money is exchanged;
Business counterparties, in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction;
Government authorities, regulators, courts, and other parties, when reasonably necessary to comply with law, respond to lawful process, protect rights and safety, investigate wrongdoing, or enforce agreements; and
Other parties at your direction or with your consent.

We do not sell personal information for money. We may share identifiers and
internet or electronic activity with advertising partners in a manner that may
constitute “sharing” for cross-context behavioral advertising under the California
Consumer Privacy Act. You may opt out as described in Section 9.

During the preceding 12 months, we may have disclosed for business purposes the
categories described in Section 1 to the service-provider categories above.

During the preceding 12 months, we may have shared identifiers and internet or
electronic activity with advertising or analytics partners for cross-context
behavioral advertising.

We do not knowingly sell or share personal information of consumers under 16
years old.

5. COOKIES, ANALYTICS, ADVERTISING, AND DO NOT TRACK

We may use essential, functional, analytics, and advertising cookies or similar
technologies. Where required, our consent tool will allow you to accept or
reject non-essential technologies.

You may revisit your choices using the “Cookie Settings” or “Your Privacy
Choices” link on the Site.

Some browsers transmit “Do Not Track” signals. Because there is no universally
accepted standard for responding to those signals, the Site may not respond to
all Do Not Track signals.

We process legally recognized opt-out preference signals, including Global
Privacy Control (“GPC”), as described in Section 9.

Third parties may collect information about your activity over time and across
websites or services. Their processing is governed by their own policies and
your settings with those parties.

6. CALIFORNIA INVASION OF PRIVACY ACT AND COMMUNICATION CONSENT

We do not intentionally intercept, eavesdrop on, or record confidential
communications without the notice and consent required by applicable law,
including the California Invasion of Privacy Act (“CIPA”).

If a telephone or video call may be monitored or recorded, we will provide
notice before recording begins and request any consent required by law.

If you do not wish to be recorded, tell us before continuing and we will provide
a reasonable alternative when available.

The Site may offer chat, messaging, analytics, fraud-prevention, or
customer-support functions that process the contents or metadata of interactions.
Where those functions could constitute interception or recording, we will provide
notice and obtain consent before activating them when required.

Please do not enter payment-card data, government identifiers, medical records,
or other highly sensitive information into chat or free-text fields unless
specifically requested through a secure channel.

Consent described in this section is limited to the disclosed purpose and does
not authorize unrelated use of communications.

We require vendors handling communications to use information only for
contracted services and subject to applicable law.

7. MARKETING COMMUNICATIONS

You may unsubscribe from marketing emails by using the unsubscribe link in the
message. You may opt out of marketing texts by replying STOP.

Consent to marketing is not a condition of purchase.

We may still send non-marketing messages, such as appointment reminders,
receipts, safety notices, and responses to your requests.

Message and data rates may apply.

8. DATA SECURITY AND RETENTION

We use reasonable administrative, technical, and physical safeguards appropriate
to the nature of the information.

No transmission or storage system is completely secure, and we cannot guarantee
absolute security.

We retain personal information only for as long as reasonably necessary and
proportionate for the purposes described in this Policy, including the length of
our relationship, warranty or service needs, recordkeeping requirements,
limitation periods, legal holds, safety and insurance requirements, and
prevention of fraud or abuse.

We delete or deidentify information when it is no longer reasonably necessary,
unless law permits or requires continued retention.

Health, Allergy, and Service-Safety Information

We may ask you to disclose limited information about allergies, sensitivities,
medications, pregnancy or nursing status, skin conditions, recent procedures,
or other contraindications when reasonably necessary to evaluate whether a
cosmetic service can be performed safely.

Please provide only information relevant to the requested service.

We treat this information as confidential and sensitive. We use it for
consultation, service safety, documentation, responding to an adverse event,
complying with law, and establishing or defending legal claims.

We do not use health-related intake information for targeted advertising, sell
it, or share it for cross-context behavioral advertising.

Access is limited to personnel and service providers who reasonably need it for
an authorized purpose.

HIPAA and California Medical-Privacy Laws

The Health Insurance Portability and Accountability Act (“HIPAA”) does not apply
to every business that receives health-related information.

It generally applies to health plans, health care clearinghouses, certain health
care providers that conduct covered electronic transactions, and their business
associates.

Ordinary elective beauty or cosmetic services paid directly by a client generally
do not make a business a HIPAA covered entity by themselves.

If Batool Brows is acting as a HIPAA covered entity or
business associate for a particular service or record, we will handle the
applicable protected health information (“PHI”) in accordance with the HIPAA
Privacy, Security, and Breach Notification Rules and any applicable business
associate agreement.

Where required, we will provide a separate HIPAA Notice of Privacy Practices.

If a separate Notice of Privacy Practices applies and conflicts with this Privacy
Policy regarding PHI, that notice controls for the PHI at issue.

Where the California Confidentiality of Medical Information Act (“CMIA”) or
another medical-confidentiality law applies to particular information or
activity, we will use and disclose that medical information only as authorized
or permitted by that law.

Information outside HIPAA or CMIA may still be protected as sensitive personal
information under the CCPA, contractual confidentiality obligations, California’s
constitutional privacy protections, data-security laws, or other applicable law.

We do not disclose client health or service-safety information to a medical
provider, insurer, family member, employer, or other person unless you direct
or authorize us to do so, the disclosure is reasonably necessary for an
emergency, or law otherwise permits or requires it.

9. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

This section applies to California residents to the extent the California
Consumer Privacy Act, as amended by the California Privacy Rights Act
(collectively, the “CCPA”), applies to us.

We may also choose to honor some requests even when not legally required.

Subject to applicable exceptions, California residents may have the right to:

Know the categories and specific pieces of personal information we collected, sources, purposes, and categories of recipients;
Request deletion of personal information we collected from them;
Request correction of inaccurate personal information;
Opt out of the sale or sharing of personal information;
Limit certain uses or disclosures of sensitive personal information;
Access information about qualifying automated decision-making technology and opt out of qualifying uses; and
Receive equal service and price and not be retaliated against for exercising privacy rights.

How to Submit a Request

Submit a request by either:

Emailing browsbybatool@gmail.com with the subject “California Privacy Request”

You may also use any privacy-request form or “Your Privacy Choices” link
displayed on the Site.

Describe the right you wish to exercise and provide enough information for us
to locate relevant records.

We will verify requests by matching information you provide with information we
maintain and may request additional information.

We will not request more information than reasonably necessary. If we cannot
verify a request, we will explain the result where permitted.

An authorized agent may submit a request on your behalf. We may require proof
of signed permission and may ask you to verify your identity directly, unless
the agent has a valid power of attorney.

Opt Out of Sale or Sharing

To opt out of sharing for cross-context behavioral advertising, select
“Your Privacy Choices” or
“Do Not Sell or Share My Personal Information” in the Site
footer and disable advertising technologies.

We also process legally valid opt-out preference signals such as GPC.

A signal generally applies to the browser or device sending it and, if you are
signed in and we can associate the signal with your account, may also apply to
that account.

We will not require you to create an account to opt out.

We do not use or disclose sensitive personal information for purposes that
require a “Limit the Use of My Sensitive Personal Information” link.

If our practices change, we will provide the required notice and choice.

10. CALIFORNIA “SHINE THE LIGHT”

California Civil Code section 1798.83 permits certain California customers to
request information about disclosures of personal information to third parties
for those third parties’ own direct-marketing purposes.

We do not disclose personal information to third parties for their own direct
marketing without consent.

Requests may be sent once per calendar year to
browsbybatool@gmail.com with the subject “Shine the Light Request.”

11. EUROPEAN ECONOMIC AREA, UNITED KINGDOM, AND SWITZERLAND

This section applies when the European Union General Data Protection Regulation,
United Kingdom GDPR, or similar Swiss data-protection law applies to our
processing.

Batool Brows & Cosmetics is the controller of
personal data covered by this section. Our legal bases include:

Contract, to provide booked Services, process purchases, and administer accounts;
Legitimate interests, to operate and secure our business, communicate with customers, prevent fraud, improve Services, and pursue or defend legal claims, where those interests are not overridden by your rights;
Consent, for optional cookies, certain marketing, photographs, or sensitive information where required; and
Legal obligation, to satisfy tax, accounting, safety, regulatory, and law-enforcement requirements.

Where we process health-related or other special-category data you voluntarily
provide for service safety, we rely on explicit consent or another lawful
condition when required.

You may withdraw consent at any time, without affecting processing already
performed.

Depending on the law and circumstances, you may request access, correction,
erasure, restriction, portability, or objection; withdraw consent; and object
to direct marketing.

You may lodge a complaint with your local supervisory authority.

We do not use solely automated decision-making that produces legal or similarly
significant effects.

Our Services are operated from the United States. If personal data is
transferred internationally, we use a lawful transfer mechanism where required,
such as adequacy regulations or approved contractual safeguards.

To exercise GDPR rights, contact browsbybatool@gmail.com

Our EU or UK representative, if legally required, is
“NOT CURRENTLY REQUIRED”.

12. CHILDREN’S PRIVACY

The Site and online Services are not directed to children under 13, and we do
not knowingly collect personal information online from a child under 13 without
verifiable parental consent.

If you believe a child provided information contrary to this section, contact
us so we can review and delete it as appropriate.

Services for minors may require a parent or legal guardian’s consent, presence,
and identification, depending on the service and applicable law.

We do not knowingly sell or share personal information of anyone under 16
without the affirmative authorization required by law.

California users under 18 who have an account and publicly post content may
request removal by contacting us.

Removal may not be complete where the law permits retention or others have
copied the content.

13. THIRD-PARTY LINKS AND SOCIAL MEDIA

The Site may link to third-party websites, booking services, payment services,
maps, social networks, or embedded content.

We are not responsible for third parties’ privacy, security, or content. Review
their policies before providing information.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically. We will post the updated
version and change the “Last Updated” date.

If changes are material, we will provide additional notice or obtain consent
when required by law.

15. CONTACT US

For questions, privacy requests, or complaints, contact:

Batool Brows & Cosmetics
Location: 45 San Clemente Dr #B110
Corte Madera, California 94925
Email: browsbybatool.com
Telephone: (415) 272-8248