Privacy
Your information, handled honestly.
The same transparency we bring to pricing and your hair, applied to your data: what we collect, why, and the control you have over it.
Who is responsible
Aprille Louise Atahan, a sole proprietor, operates Hair Extensions by Aprille, and separately Novum Hair Studio, at 5171 Mission Center Rd, Studio 21, San Diego, CA 92108. This policy covers information handled through this website and Hair Extensions by Aprille’s extension services.
Questions or privacy requests: hello@hairextensionsbyaprille.com or 858-727-0619.
What we collect and why
When you request a consultation or take the quiz, we collect what you give us: your name, phone number, email address, requested appointment windows, any question you type, and your quiz answers about hair goals, current hair, lifestyle, the change you want and budget comfort. We use these to respond, arrange your consultation and help Aprille prepare. Quiz answers may be linked to your consultation request, so they are not necessarily anonymous.
Our website system stores consultation records, the messages we send and receive about them, and their delivery status. GlossGenius, our booking system, holds appointment and client contact records, and keeps the card a client gives when booking online — a card is required to book online. Aprille cannot see the full card number, and the card is used only for the late-cancellation fee described in our terms. Necessary technical information, such as short-lived IP-based request limits, helps run and protect the site.
After your consultation, the client service form records your service and quote, your acknowledgments, your signature, the document versions you signed, the optional photo and marketing permissions you selected and any later changes. We use these records to document the agreement and to check permitted photo and communication uses. The signed copy is stored privately with Cloudflare, and you receive your own copy by email or link. The form has no health or card fields.
Scalp conditions, medications and other health concerns are discussed in person at the consultation; the website does not ask for them. Please don’t put medical details in the question field or in messages. If you do, they are stored with that message, but they are never used for marketing or advertising.
Payments
This website doesn’t take payments or ask for card details. Payments are taken in person at the end of a service, by card through Aprille’s U.S. Bank-provided Elavon service (Tap to Pay on iPhone) or through her Venmo business account. Each payment service handles the information needed to process payments, receipts and refunds; a receipt can be sent to you by text or email if you ask for one. Apple provides the contactless technology on the phone, which is separate from the Apple iCloud photo storage described below. Payment and receipt records are used to account for your service and answer payment questions. Please never send card details through website fields, texts or emails.
Photos
Photos are optional. Taking a before-and-after photo and publishing it are separate permissions, and your face is shown only if you specifically agree. With your permission, Aprille keeps photos to follow your previous applications and how your hair changes. Photos are stored on Aprille’s phone and in Apple iCloud; copies used on this website are stored with Cloudflare.
To withdraw a photo permission, email hello@hairextensionsbyaprille.com. We stop new uses when we receive it and remove affected publications on channels we control as soon as practicable, no later than 10 calendar days after receipt, or sooner if legally required. Withdrawing publication permission doesn’t automatically delete the private originals; you can separately ask for deletion, which we assess under applicable law. Independent reposts or copies saved by others are outside our control.
Text messages & consent (TCPA)
Texts are sent by Aprille, Hair Extensions by Aprille, through senderZ using Telnyx infrastructure. Consultation confirmations and reminders are sent because you asked to be contacted about your request. Marketing texts (occasional updates and nudges) are sent only if you separately tick the consent box on the form — it is unchecked by default and never a condition of service. Message frequency varies. Message and data rates may apply. Reply HELP for help, or STOP to opt out at any time; replying STOP stops all texts from us. We keep the limited records needed to honor that choice.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Our messaging providers process your number and message content only to deliver texts and administer the program.
Your email address lets us send your consultation confirmation and calendar invite and reply to your questions; we send these through Resend. We don’t send marketing email without your permission, and any marketing email identifies us, includes our postal address and has a working unsubscribe link we honor promptly. Replies reach Aprille directly.
The analytics identifier
Google Analytics gives your browser a random identifier — an online identifier, not your name — stored in a first-party cookie. If, and only if, you have accepted analytics and you then send a consultation request, we keep that identifier with your request for a short time. Its only purpose is to tell us which page or article brought you to us and how much of the site you read first. We look it up in a copy of our Google Analytics event data that is exported daily to our own Google Cloud (BigQuery) project, write the answer (for example, “arrived from that article”) onto your request, and then delete the identifier from your record — within 30 days at the latest, and straight away if you withdraw analytics permission or ask us to delete your record.
We never send your name, phone, email, message or service records to Google, and we never use the identifier to build an audience, target an ad or make a decision about you. The page-and-source answer stays in your consultation record and is included when you ask to see or delete your information. Google Analytics keeps event data for up to 14 months, and sharing with other Google products is turned off. The daily export in our Google Cloud project is a separate copy of that event data; each day’s export is deleted automatically about 14 months after it is created. You can withdraw analytics permission at any time by selecting “Cookies” in the footer and turning off analytics.
Who receives information
We share information only as needed for the purposes above: Cloudflare (website, database, storage, security and website photos), Apple iCloud (client photos), U.S. Bank / Elavon (card payments, receipts and refunds), Apple Tap to Pay on iPhone (contactless payment technology), Venmo (business payments and refunds), GlossGenius (appointments, client contacts and the card given when booking online), senderZ and Telnyx (texts), Resend (email) and Google (analytics, only with your analytics choice). Provider roles depend on the relevant service terms. We may also disclose information when the law requires it or to deal with a legal claim. We do not sell or rent your information.
Access, corrections, deletion and other choices
Email hello@hairextensionsbyaprille.com to ask about your information, correct it, request deletion or withdraw an optional permission. We may ask for information proportionate to verifying an access or deletion request, so we don’t disclose someone else’s records. Opting out of marketing never requires an account or identity documents. Depending on applicable law, California residents may have rights to access, correct and delete personal information and to opt out of its sale or sharing for targeted advertising. We respond within the timeframe the law requires and explain any exception that applies.
Retention & security
Client photos are kept for up to three years after your most recent appointment with Aprille; a new appointment restarts that period. Other records are kept only as long as their purpose needs — completing your service, documenting what was agreed and permitted, honoring opt-outs, handling claims and meeting legal obligations — and do not automatically follow the photo period or a cookie lifetime.
We use reasonable safeguards and limit access to people who need the information. Data travels over HTTPS. No system is perfectly secure.
Children
This website is intended for adults. A parent or legal guardian should contact Aprille about a service request for a minor; services are not provided to anyone under 16, and a parent or guardian attends both the consultation and the installation for 16- and 17-year-olds. Please don’t submit a child’s medical details through the website.
Changes
We post updates here with the date below. A new policy does not expand a permission you have already given. Last updated: September 2026.