Last updated: July 2026
This policy is a working draft prepared for Nirvana Permanent Makeup. It describes our actual data practices in plain language, but it has not yet been reviewed by an attorney and should not be treated as final until the studio owner has reviewed it and filled in the following:
Nirvana Permanent Makeup (“Nirvana,” “we,” “us”) is a solo-operator permanent-makeup studio. This policy explains what information we collect about clients in the course of booking appointments and providing services, and what information is collected about the studio owner when she signs in to the software used to run the business. Clients do not have their own accounts or sign in to this application — the information below describes how client information is handled by the studio through this system, not a client-facing account relationship.
Appointment and contact information. When you book an appointment, your name, email, phone number, and appointment history are collected through our scheduling platform, Acuity Scheduling, and read into this system so we can keep one accurate record of your visits.
Health and intake information.Before certain services, we collect health-related information — allergies, medications, medical and skin conditions, an emergency contact, and your consent to treatment. This is collected either through an in-studio intake form or through Acuity's own intake questions attached to your appointment, and we treat it as sensitive information under this policy.
Service and package history.We keep a record of the services you've received and any prepaid packages or gift certificates associated with your visits, so we can track what you're due for and honor remaining balances. We do not process or store full payment card numbers in this system.
Mailing address.If you'd like to receive handwritten note reminders, we ask for and verify a mailing address for that purpose only.
We use your information to schedule and provide services, maintain an accurate health and service history, and track when you're due for a touch-up or annual refresher. If — and only if — you've opted in to marketing communications, we also use your contact information to send appointment reminders and thank-you notes by email or physical mail. We do not use your information for any purpose unrelated to running the studio, and we do not sell your information.
We use a small number of outside services to run the studio and this application. Each one receives only the information it needs to do its job:
Health and intake information — allergies, medications, medical or skin conditions, and similar details — is never sent to Resend, Handwrytten, or Sentry, and is never included in an outreach message. Our system is built so that outreach messages and error reports can only ever carry your name and contact details (email or mailing address), never your health information. This boundary is enforced in how the software itself is built, not just by policy, and is checked automatically every time the software is tested.
Your information is stored in a managed database (Neon Postgres) that encrypts data at rest. Access to studio records is limited to the studio owner, who signs in through Clerk; there is no client-facing login to this application. Error-tracking data sent to Sentry has personal information disabled by default, and health/intake fields are actively removed before anything is sent, even if an error occurs on a page handling that data.
We keep your appointment, health, and service history for as long as you remain a client of the studio, so we can maintain an accurate record for your care and track package or gift-certificate balances correctly. This application does not yet have a self-service tool to export or delete your information — if you'd like a copy of what we hold, or would like it deleted, contact us using the details below and we will handle your request directly.
Outreach emails and handwritten notes are sent only if you've opted in, and only to a verified email address or mailing address. You can opt out, ask what information we hold about you, or ask us to correct or delete it, at any time by contacting us directly.
We may update this policy as the studio's tools and practices change. We'll update the “Last updated” date above whenever we do.
Questions about this policy, or requests to access, correct, or delete your information, can be sent to:
[BUSINESS LEGAL NAME][BUSINESS MAILING ADDRESS][PRIVACY CONTACT EMAIL]
This policy is governed by the laws of [GOVERNING LAW STATE].