Privacy Policy

1. The Information We Collect

For the purpose of this Policy, personal information is any information about an identifiable individual. We collect the following types of personal information:

Information You Provide

When using our Platform or our services, you may provide us with your personal information when you do any of the following:

Create an Account. If you create an account with us, you may provide us with some or all of the following information: your full name, email address, mailing/billing address, phone number, birth date, and/or a password for future logins.

Book an Appointment. When you book a service, we collect appointment information including services requested, dates, times, party size, provider preferences, and any special requests.

Messages. The Platform includes a direct messaging feature that allows consumers and businesses to communicate. Messages sent through the Platform are stored in our database and accessible to the sender, the recipient, and Lacy. Do not share sensitive personal or financial information through the messaging feature.

Reviews and Ratings. Feedback you submit about businesses or services, including any photos you attach to a review.

AI Chat Messages. When you use the AI-powered support chat, your messages are transmitted to and processed by Anthropic, Inc. using their Claude AI model solely to generate a response. Do not submit sensitive personal, financial, or medical information through the AI chat. Your use of the AI chat is also subject to Anthropic's usage policies.

Customer Service. If you contact our customer service department, you may need to provide us with additional information so that we can respond to your questions or concerns as completely and thoroughly as possible.

Subscribe to Our Newsletter. If you subscribe to our newsletter, you will provide us with your email address.

Loyalty Program. If you sign up for our loyalty program, you will provide us with your name, email address, and you may choose to provide us with your birth date and gender.

Refer a Friend. To refer a friend, you will provide us with your name and email address, and the email address of the friend you are referring.

Promotions. If you enter a sweepstakes, contest, giveaway, or other promotion (each a "Promotion"), you will provide us with your age or birth date.

Surveys and Quizzes. If you are participating in a survey or a quiz, you may provide your gender and age, income, ethnicity, family size, and marital status.

Business Information. We may collect personal information from business clients or vendors, including company name, physical address, phone number, email address, and credit card or banking information.

Purchases. When you make a purchase, you will provide us with some or all of the following information: your full name, email address, phone number, physical address, billing address and payment method information through third-party credit card processing companies. We generally use third parties to process payments.

Feedback. If you provide design or product feedback or make other submissions to us, we may collect this information.

Information as You Navigate Our Platform

We automatically collect certain personal information through your use of the Platform, such as the following:

• Usage Information: For example, the pages on the Platform you access, the frequency of access, and what you click on while on the Platform.
• Device Information: For example, hardware model, operating system, application version number, and browser.
• Mobile Device Information: Aggregated information about whether the Platform is accessed via a mobile device or tablet, the device type, and the carrier.
• Location Information: With your permission, your precise or approximate geographic location to show nearby businesses. You may disable this at any time in your device settings.
• Push Notification Tokens: We use Expo (Expo, Inc.) to deliver push notifications to your mobile device. To receive push notifications, a device-specific push token is generated and stored. You may disable push notifications at any time through your device's Settings app or through the Platform's notification settings.

Additionally, we may derive information or draw inferences about you based on the other types of personal data we collect. For example, we may infer your location based on your IP address or that you are interested in particular services based on your browsing behavior on our Platform.

Lacy reserves the right to transfer and/or sell aggregate or group data about users on our Platform for lawful purposes. Aggregate or group data is data that describes the demographics, usage and other characteristics of our users as a group, without disclosing personally identifiable information.

Business Analytics

Business account holders may access analytics features that display data about their bookings, client visit history, service performance, and revenue trends. This includes information such as appointment frequency, repeat vs. new client status, service popularity, and time-of-day booking patterns. Consumer information is shared with the relevant Business only to the extent necessary to support the booked appointment and provide these insights. We do not sell individual consumer data to Businesses.

Third Party Information

In some cases, we may receive certain personal information from you about a third party. For example, when you refer a friend, you will provide the email address of a third party. If you submit any personal information about another individual to us, you are responsible for making sure you have the authority to do so and to allow us to use their personal information in accordance with this Policy.

Credit and/or Debit Card Transactions

Lacy utilizes third-party service providers to provide credit and debit card payment processing services. We currently use Stripe, Inc. as our payment processor. If you choose to use the services offered on the Platform, Stripe may collect the information you provide in connection with such purchase, including name, billing address, email address, telephone number, and credit card and/or debit card information. Stripe uses this information solely to process the applicable transaction and as otherwise permitted by their privacy policy. We may also in the future use one or more of the following payment processors:

• Klarna®: https://www.klarna.com/international/privacy-policy/
• Apple® Pay: www.apple.com/legal/privacy/data/en/apple-pay/
• Meta® Pay: https://www.facebook.com/payments_terms/privacy
• PayPal®: https://www.paypal.com/us/legalhub/privacy-full
• Google® Pay: https://policies.google.com/privacy

Lacy requires that its payment processors have in place privacy policies and practices consistent with this Policy; provided, however, that we cannot guarantee the privacy practices of our payment processors.

2. How We Use Your Information

We may use the personal information we collect to improve our Platform and to protect our legal rights. In addition, we may use the personal information we collect to:

• Process your account registration
• Process and fulfill your booking, including sending emails to confirm appointment status and provide related communications
• Send you our newsletter
• Sign you up for our Loyalty Program
• Identify your preferences to customize our communications
• Manage and record your settings, consents, communications and opt-out choices
• Administer a Promotion
• Communicate with you about our Platform or to inform you of any changes to our Platform
• Operate and improve our Platform, including to analyze visits and learn about our visitors so we can improve our products and services and deliver the best user experience
• Facilitate communication between consumers and businesses through in-app messaging
• Provide business owners with analytics and performance insights
• Send push notifications, booking confirmations, reminders, and service updates via Expo, Inc.
• Power AI-assisted features, including the support chatbot and business writing tools, via Anthropic's Claude API
• Export appointment details to third-party calendar apps at your request
• Communicate with you, including responding to your inquiries
• Comply with the law and maintain the integrity and security of our Platform
• Defend our legal rights and the rights of others
• Investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or violations of our Terms of Service
• Fulfill any other purposes for which you provide your information, or any other purpose we deem necessary or appropriate

By submitting your personal information by and through our Platform, you agree that such act constitutes an inquiry and/or application for purposes of the Amended Telemarketing Sales Rule (16 CFR §310 et seq.), as amended from time to time (the "Rule") and applicable state do-not-call regulations. As such, notwithstanding that your telephone number may be listed on the Federal Trade Commission's Do-Not-Call List, and/or on applicable state do-not-call lists, we retain the right to contact you via telemarketing in accordance with the Rule and applicable state do-not-call regulations.

Where you provide "prior express consent" within the meaning of the Telephone Consumer Protection Act (47 USC § 227), and its implementing regulations adopted by the Federal Communications Commission (47 CFR § 64.1200), as amended from time-to-time ("TCPA"), you consent to receive, from Lacy, telephone calls (including text alerts via SMS text messages) delivered via automated technology, to the telephone number(s) that you provided. Please note that you are not required to provide this consent in order to obtain access to our Platform, and your consent simply allows Lacy to contact you via these means. Please be advised that by agreeing to this Policy, you are obligated to immediately inform us if and when the telephone number that you have previously provided to us changes. Without limiting the foregoing, if you: (A) have your telephone number reassigned to another person or entity; (B) give up your telephone number so that it is no longer used by you; (C) port your telephone number to a landline or vice versa; or (D) otherwise stop using that telephone number for any reason (collectively "Phone Number Change"), you agree that you shall promptly notify Lacy of the Phone Number Change via email at support@lacybeauty.com.

You hereby consent to the disclosure of any record or communication to any third-party when we, in our sole discretion, determine the disclosure to be required by applicable law, including sharing your email address with third-parties for suppression purposes in compliance with the CAN-SPAM Act of 2003, as amended from time to time, and other email marketing laws.

3. Sharing Your Information With Third Parties

We may share the personal information that we collect about you in the following ways:

We engage service providers to perform services in connection with the operation of our business. We may share personal information with service providers to the extent necessary for them to provide services to you or us. Our current key service providers include:

• Supabase, Inc. (database and authentication infrastructure) — stores and processes your account information, appointment data, messages, and related Platform data on our behalf under industry-standard security practices
• Stripe, Inc. (payment processing) — processes all payment transactions; we do not store your full card number
• Expo, Inc. (push notifications) — delivers push notifications to your mobile device using your device push token
• Anthropic, Inc. (AI features) — processes the content of your AI chat messages to generate responses; your messages are transmitted to Anthropic solely for this purpose
• Google LLC (calendar export) — when you use the "Add to Calendar" feature to export an appointment to Google Calendar, appointment details (including date, time, service name, business name, and address) are transmitted to Google and are subject to Google's Privacy Policy. Exporting to Apple Calendar creates a file stored on your device only and is not transmitted to any third party

We also engage service providers for payment processing, fraud protection, marketing and promotional material distribution, website evaluation, data analysis, and data cleansing.

Personal information collected through our Platform may be shared between our brands and affiliates, including future affiliates that are owned or operated by Lacy.

We also share personal information with selected third parties for their own marketing purposes (except for your phone number). See the Your Choices section of this Policy for more information.

We may release personal information if we believe in good faith that: (i) the law or legal process requires it; (ii) we have received a valid administrative request from a law enforcement agency; (iii) such release is necessary or appropriate to protect the rights, property, or safety of Lacy, or any of our respective affiliates, service providers, or customers; or (iv) as Lacy deems necessary to resolve disputes, troubleshoot problems, prevent fraud and otherwise enforce the Terms of Service.

We may also share your information with your consent or as otherwise disclosed at the time of data collection or sharing.

As with any business, it is possible that as ours develops, we might go through a business transition, such as a merger, acquisition by another company, or the sale of all or a portion of our assets. In such transactions, information about customers, including your personal information, will likely be transferred. Please note that if Lacy is involved in a bankruptcy proceeding, merger, acquisition or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on our Platform of any change in ownership or uses of your personal information, as well as any choices that you may have regarding your personal information.

We may use non-personal information to analyze visits to the Platform and learn about the interests of our visitors in aggregate and to better understand your interests and needs, so we can improve our products and services and deliver to you the type of content, features and promotions in which you are most interested. We may share non-personal, aggregate data with our marketing partners or other third parties for research and marketing purposes.

4. Cookies and Other Tracking Technologies

Lacy uses only strictly necessary session cookies on the web version of our Platform. These cookies are set by Supabase, our authentication provider, solely to maintain your logged-in session while you use the Platform. They are not used for advertising, behavioral tracking, or analytics, and do not store personally identifiable information beyond what is necessary to keep you authenticated.

Our native iOS and Android mobile apps do not use cookies.

We do not use performance cookies, targeting cookies, social media cookies, or any other tracking technologies for advertising or marketing purposes.

Managing Session Cookies

You can block cookies by changing your browser settings. Please note that blocking all cookies may prevent you from logging in to the web version of the Platform. Our mobile apps are unaffected by browser cookie settings.

5. Digital Advertising & Analytics / Interest-Based Ads

Lacy does not engage in interest-based advertising or targeted advertising. We do not sell your personal information to advertisers or advertising networks. We do not use tracking pixels, advertising cookies, or third-party behavioral tracking technologies to serve you ads on our Platform or on other platforms.

The Platform is and is intended to remain ad-free. We do not build advertising profiles of our users and do not share personal data with ad networks for marketing purposes.

We may in the future use first-party analytics tools to understand how our Platform is used in aggregate (e.g., which features are most popular, where users encounter difficulty). Any such analytics will be conducted using privacy-preserving methods and will not involve selling your data or serving you targeted ads. We will update this Policy if our practices change.

6. Third-Party Links & Plug-Ins

The Platform may provide links to third-party websites or apps, including our social media pages. We do not control the privacy practices of those websites or apps, and they are not covered by this Policy. You should review the privacy policies of other websites or apps that you use to learn about their data practices.

The Platform may also include integrated social media tools or "plug-ins," such as social networking tools offered by third parties. If you use these tools to share information or you otherwise interact with social media features on the Platform, those social media companies may collect information about you and may use and share such information in accordance with their own policies. We encourage you to read the privacy policies for any social media accounts you create and use.

7. Your State Privacy Rights

Depending on the state in which you reside, you may have certain privacy rights regarding your personal data. Please review the sections below if you are a California, Colorado, Connecticut, Nevada, Utah or Virginia resident. For other state residents, your privacy rights may include (if applicable):

• The right to confirm whether or not we are processing your personal data and to access such personal data
• The right to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format
• The right to delete personal data that we collected from and/or about you, subject to certain exceptions
• The right to correct inaccurate personal data that we maintain about you, subject to certain exceptions
• The right, if applicable, to opt out of the processing of your personal data for purposes of targeted advertising or the "sale" of your personal data
• The right not to receive discriminatory treatment by us for the exercise of your privacy rights

Important Note on Targeted Advertising: Lacy does not engage in targeted advertising and does not sell personal data to advertisers. Where state law provides the right to opt out of targeted advertising or sale of personal data, you may contact us at support@lacybeauty.com, though these practices are not currently conducted by Lacy.

California Residents

Notice at Collection

We may collect the following categories of personal information (as defined in the CCPA), including sensitive personal information:

• Identifiers, such as name, email address, username and password, postal address, telephone number, IP address, and other similar identifiers
• Characteristics of protected classifications and demographic information, such as gender, age, and national origin
• Commercial information, including transaction information when you book, request information, or contact customer service, including payment information
• Internet or other electronic network activity information, including information regarding your interactions with us online
• Geolocation data, including precise or approximate location information provided by a mobile device, where we are permitted by law to process this information
• Inferences based on the above

We collect this information to provide and manage our Platform, products, and services, and for other business or commercial purposes as further described in the How We Use Your Information section.

We do not sell or share personal information for cross-context behavioral advertising purposes. We do not sell or share the personal information of known minors under 16 years of age. We do not use or disclose sensitive personal information for purposes other than those specified in Section 7027(m) of the CCPA regulations.

Your California Privacy Rights

Right to Know. You have the right to request that we disclose the categories of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom such personal information is shared.

Right to Access. You have the right to request, up to two times each year, access to categories and specific pieces of personal information about you that we collect, use, disclose, sell, and share.

Right to Delete. You have the right to request that we delete personal information that we collect from you, subject to applicable legal exceptions.

Right to Correct. You have the right to request that we correct inaccurate personal information that we maintain about you, subject to applicable legal exceptions.

Right to Opt Out of Sale or Sharing. You have the right to opt out of the sale or sharing of your personal information. As noted above, Lacy does not currently sell or share personal information for targeted advertising purposes.

Removal of Content. If you are a California resident under the age of 18, and a registered user, California Business and Professions Code Section 22581 permits you to request and obtain removal of content or information you have publicly posted.

Shine the Light. California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information to third parties for the third parties' direct marketing purposes. Lacy does not share personal information with other companies outside Lacy for those parties' direct marketing use unless a user elects that we do so.

Right Not to Receive Discriminatory Treatment. You have the right not to receive discriminatory treatment for the exercise of your privacy rights.

Exercising Your California Privacy Rights

To make a request to know, access, delete, or correct your personal information, please email us at support@lacybeauty.com. Before completing your request, we may need to verify your identity. We will send you a link to verify your email address and may request additional documentation solely for the purpose of verifying your identity.

To submit a request on behalf of another individual as an authorized agent, please email support@lacybeauty.com. An authorized agent must have your signed permission or provide proof of power of attorney in accordance with applicable law.

To request removal of content posted by a California resident under 18, email a detailed description of the specific content to support@lacybeauty.com.

If you have a question about our privacy policies and information practices, please send an email to support@lacybeauty.com.

Colorado Residents

Colorado law provides Colorado residents with the rights listed below.

Right to Access. You have the right to know and see what personal data we have collected about you in a usable format.

Right to Delete. You have the right to request that we delete the personal data we have collected about you, subject to applicable legal exceptions.

Right to Correct. You have the right to request that we correct inaccurate personal data.

Right to Opt Out of Targeted Advertising and Sale of Personal Data. You have the right to opt out of targeted advertising and the sale of your personal data as defined under Colorado law. Lacy does not currently engage in targeted advertising or sell personal data.

To make an access, deletion, or correction request, or to exercise any opt-out right, please email support@lacybeauty.com. Before completing your request, we may need to verify your identity.

To appeal our decision regarding a request related to these rights, you may email us at support@lacybeauty.com.

Connecticut Residents

Connecticut law provides Connecticut residents with the rights listed below.

Right to Access. You have the right to know and see what personal data we have collected about you in a usable format.

Right to Delete. You have the right to request that we delete the personal data we have collected about you, subject to applicable legal exceptions.

Right to Correct. You have the right to request that we correct inaccurate personal data.

Right to Opt Out of Targeted Advertising and Sale of Personal Data. You have the right to opt out of targeted advertising and the sale of your personal data as defined under Connecticut law. Lacy does not currently engage in targeted advertising or sell personal data.

To make an access, deletion, or correction request, or to exercise any opt-out right, please email support@lacybeauty.com. Before completing your request, we may need to verify your identity.

To appeal our decision regarding a request related to these rights, you may email us at support@lacybeauty.com.

Nevada Residents

Nevada law allows Nevada residents to opt out of the sale of certain types of personal information. We currently do not sell personal information as defined in Nevada law. However, if you are a Nevada resident, you still may submit a verified request to opt out of sales and we will record your instructions and incorporate them in the future if our policy changes. You may send opt-out requests to support@lacybeauty.com.

Utah Residents

Utah law provides Utah residents with the rights listed below.

Right to Access. You have the right to know and see what personal data we have collected about you in a usable format.

Right to Delete. You have the right to request that we delete the personal data we have collected about you, subject to applicable legal exceptions.

Right to Opt Out of Targeted Advertising. You have the right to opt out of targeted advertising as defined under Utah law. Lacy does not currently engage in targeted advertising. We do not sell personal data as defined under Utah law.

To make an access or deletion request, or to exercise any opt-out right, please email support@lacybeauty.com. Before completing your request, we may need to verify your identity.

Virginia Residents

Virginia law provides Virginia residents with the rights listed below.

Right to Access. You have the right to know and see what personal data we have collected about you in a usable format.

Right to Delete. You have the right to request that we delete the personal data we have collected about you, subject to applicable legal exceptions.

Right to Correct. You have the right to request that we correct inaccurate personal data.

Right to Opt Out of Targeted Advertising. You have the right to opt out of targeted advertising as defined under Virginia law. Lacy does not currently engage in targeted advertising. We do not sell personal data as defined under Virginia law.

To make an access, deletion, or correction request, or to exercise any opt-out right, please email support@lacybeauty.com. Before completing your request, we may need to verify your identity.

To appeal our decision regarding a request related to these rights, you may email us at support@lacybeauty.com.

8. Your Choices

To opt out of our email marketing or to unsubscribe from our email newsletters, you can contact our customer service department at support@lacybeauty.com, or you can use the link provided at the bottom of each marketing message or newsletter. If you choose to opt out, you will continue to receive all email communications related to our transactions with you.

If you would like to update your mailing information or want your name and address removed from our direct mailing list, you can contact our customer service department at support@lacybeauty.com.

You can control the tools on your mobile devices. For example, you can turn on and off the GPS locator or push notification on your phone. Please consult your mobile device's user guide for instructions on enabling and disabling location services and disabling push notifications.

You may revoke any previously provided consent at any time by contacting us at support@lacybeauty.com. Message and data rates may apply for SMS communications. We will retain your personal information for the period necessary to fulfill the purposes of your personal information collection, unless a longer retention period is required or permitted by law.

Account Deletion. You may delete your account at any time directly within the app: go to Profile → Delete Account (for consumers) or Settings → Account → Delete Account (for businesses). Deletion is immediate and permanent. We will delete or anonymize your information within 30 days, except where required for legal, tax, or fraud prevention purposes. You may also request deletion by contacting us at support@lacybeauty.com.

9. Children's Privacy

We understand the importance of protecting children's privacy, especially in an online environment. Our Platform is not intentionally designed for or directed at children less than 13 years of age. We do not knowingly collect personal information from children under the age of 13 without the consent of the child's parent or guardian. We encourage parents and guardians to provide adequate protection measures to prevent minors from providing information unwillingly on the internet. If we are aware of any personal information relating to children that we have collected, we will take steps to securely remove it from our systems.

10. Updating Your Information

You may request to view, update, or correct your personal information by contacting our privacy team at support@lacybeauty.com. In order to protect your privacy, we will take steps to verify your identity before granting you access to the information or enabling you to make corrections. You may also update your account information directly within the app's profile or account settings.

11. Security

We endeavor to safeguard and protect your personal information. When you make personal information available to us, your personal information is protected both online and offline. Access to your personal information is strictly limited, and we take reasonable measures to ensure that your personal information is not accessible to the public. Only employees or third party agents who need personal information to perform a specific job are granted access to personal information.

We use encrypted data transmission (TLS/SSL), secure cloud infrastructure (Supabase), and access controls to protect your data. Our API keys and server-side credentials are never exposed to client-side code.

Please be advised, however, that while we take every reasonable precaution available to protect your data, no storage facility, technology, software, security protocols or data transmission over the Internet or via wireless networks can be guaranteed to be 100% secure. Any transmission of data at or through our Platform or otherwise via the Internet or wireless networks is done at your own risk.

In compliance with applicable federal and state laws, we shall notify you and any applicable regulatory agencies in the event that we learn of an information security breach with respect to your personal information. You will be notified via email in the event of such a breach.

12. Do Not Track Signals

Your browser settings may allow you to automatically transmit a "Do Not Track" signal to online services you visit. Because Lacy does not engage in behavioral tracking or interest-based advertising, a "Do Not Track" signal has no material effect on your experience on our Platform. We do not track users across third-party websites for advertising purposes regardless of whether a Do Not Track signal is present.

To find out more about "Do Not Track," you can visit www.allaboutdnt.com, but we are not responsible for the completeness or accuracy of this third-party information.

13. Tracking Across Time and Technologies Disclosure

Some information about your use of the Platform and certain third-party services may be collected by us or by third parties using tracking technologies across time and services and used by us and third parties for purposes such as to associate different devices you use and deliver relevant content to you on the Platform.

14. Consumers With Disabilities

We are committed to ensuring this Policy is accessible to individuals with disabilities. To request this Policy in an alternative format, please reach out to us at support@lacybeauty.com.

15. Contact

If you have questions or wish to contact us about this Policy, please direct inquiries to:

Privacy Officer — Lacy Ventures LLC
30 N Gould St Ste N, Sheridan WY 82801
Email: support@lacybeauty.com