Privacy Policy

1. DEFINITIONS AND KEY TERMS

1.1 Momiji Group Inc. and Service Terms

• Hair Stylist App ("we," "us," or "our")
• Service: All features, functionalities, programs, and content available through Hair Stylist App
• Platform: Our website and related services accessible via any device
• User: Any individual accessing or using our services ("you" or "your")

1.2 Data and Privacy Terms

• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation performed on personal data
• Data Controller: Hair Stylist App, determining the purposes and means of processing personal data
• Data Processor: Third parties that process personal data on our behalf
• Cookie: Small text file stored on your device containing data about your platform usage

1.3 Security Terms

• Authentication: Process of verifying user identity
• Encryption: Process of encoding information to prevent unauthorized access
• Token: Unique identifier used for secure authentication
• SSL/TLS: Security protocols for encrypted data transmission

2. INTRODUCTION AND SCOPE

2.1 Policy Overview

This privacy policy explains how Hair Stylist App collects, uses, and protects your personal data. It provides detailed information about your privacy rights and how you can exercise them.

2.2 Policy Application

• All users of Hair Stylist App globally
• All data collection methods
• All service features and functionalities
• All platform versions and updates

2.3 Policy Updates

• We reserve the right to update this policy
• Material changes will be notified via email
• Continued use after changes constitutes acceptance

3. PERSONAL DATA COLLECTION

3.1 Account Information

• Email address (required for authentication)
• Name (collected during payment processing)
• Last sign-in timestamp
• Unique account identifiers
• IP addresses

• Phone number (if provided through payment processors)
• User preferences and settings
• Communication preferences

3.2 Service Usage Data

• Final color analysis results
• Completion timestamps
• Performance metrics

• Features accessed
• Time spent on platform
• Navigation patterns
• Device information

3.3 Payment Information and Processing

• Tokenized payment method identifiers
• Last four digits of payment cards
• Card expiration dates

3.4 Technical and Device Data

• Operating system and version
• Browser type and version
• Screen resolution
• Device type and model
• Language preferences

• IP address
• Network information
• Connection type
• Geographic location (derived from IP)
• Time zone settings

• Load times
• Error messages
• System performance metrics
• Network latency
• Application response times

4. DATA PROCESSING AND USAGE

4.1 Primary Processing Purposes

• Account creation and management
• Authentication and security
• Feature access and customization
• Customer support
• Service optimization

• Subscription management
• Payment authorization
• Fraud prevention
• Transaction records
• Billing support

• Service updates and notifications
• Security alerts
• Product information
• Support responses
• Legal notices

4.2 Secondary Processing Purposes

• Usage pattern analysis
• Feature optimization
• Performance monitoring
• User experience enhancement
• Bug identification and resolution

• Aggregate usage statistics
• Trend analysis
• Platform optimization
• Feature development
• Performance benchmarking

4.3 Legal Bases for Processing

• Account management
• Service provision
• Payment processing
• Feature access
• Support services

• Tax compliance
• Financial records
• Legal requirements
• Regulatory compliance
• Safety and security

• Service improvement
• Fraud prevention
• Security maintenance
• Technical optimization
• Business development

• Marketing communications
• Optional features
• Third-party integrations
• Analytics participation
• Feature testing

5. DATA STORAGE AND SECURITY

5.1 Storage Location and Data Transfers

• All personal data is stored in secure European data centers
• Data is transmitted globally using encrypted channels
• We employ appropriate safeguards for international data transfers
• Continuous compliance monitoring and security measures are in place

5.2 Security Measures

5.2.1 Infrastructure Security

• Multi-factor Authentication capability
• Passwordless authentication via email
• Single-use verification codes
• Session management with automatic termination
• Role-based access control
• Principle of least privilege
• Access logging and monitoring
• Regular access reviews
• Automated access termination

• SOC2 Type 2 compliance
• AES-256 encryption for data at rest
• TLS encryption for data in transit
• Security protocols for all data transmission
• Regular security audits

• DDoS Protection via Cloudflare
• Intrusion detection systems
• Regular security patching
• Infrastructure monitoring

5.2.2 Payment Security

• PCI DSS compliant payment processing
• Tokenized payment information storage
• No access to complete card numbers
• Encrypted payment data transmission
• Immediate security incident response
• Regular compliance monitoring

5.2.3 Backup and Recovery

• Regular automated backups
• Encrypted backup storage
• Disaster recovery planning
• Business continuity measures
• Data restoration procedures
• Geographic redundancy measures

5.2.4 Organizational Security

• Incident response procedures and protocols
• Access control policies and enforcement
• Security incident reporting framework
• Change management procedures

5.2.5 Monitoring and Maintenance

• Real-time system monitoring and security event logging
• Performance tracking and analysis
• Regular security reviews and assessments
• Continuous compliance monitoring
• Regular system updates
• Vulnerability assessments
• Security patch management

5.3 Data Breach Notification Procedures

5.3.1 Definition and Scope

• Unauthorized access to personal data
• Accidental loss or destruction of personal data
• Unauthorized disclosure of personal data
• Any incident compromising data confidentiality, integrity, or availability

5.3.2 Internal Response

• Immediately initiate our incident response plan
• Assess the nature and scope of the breach
• Take immediate steps to contain the breach
• Document all aspects of the incident
• Evaluate the risks to affected individuals

5.3.3 User Notification

• Within 72 hours of breach confirmation
• Through email notification

5.3.4 Notification Content

• Description of the incident
• Types of data affected
• Potential impact on users
• Steps we have taken to address the breach
• Recommended user actions
• Contact information for questions
• Resources for additional support

5.3.5 Regulatory Compliance

• Notify relevant supervisory authorities
• Comply with jurisdiction-specific requirements
• Provide mandatory documentation
• Cooperate with investigations
• Implement required remedial measures

5.3.6 Post-Breach Measures

• Conduct a thorough investigation
• Implement additional security measures
• Update procedures as necessary
• Provide ongoing updates to affected users
• Review and enhance security protocols

6. ANALYTICS, ADVERTISING, AND THIRD-PARTY SERVICES

6.1 Analytics and Infrastructure Partners

6.1.1 Analytics Services

• Google Tag Manager: For managing analytics and marketing tags
• Google Analytics: For user behavior analysis and service optimization
• MixPanel: For user interaction tracking and feature usage analysis
• Google BigQuery: For large-scale data analysis and reporting
• Sentry: For error monitoring, performance tracking, and session recording
• Cloudflare: For performance analytics and security monitoring

6.1.2 Session Recording Details

• Automatic masking of all user inputs
• No collection of personally identifiable information
• Exclusion of all data entry fields
• Anonymization of all user interactions
• Usage limited to bug investigation and performance optimization

6.1.3 Data Collection Scope

• Usage patterns
• Feature interaction data
• Performance metrics
• Error information
• Anonymized user flows
• Aggregate statistics

6.2 Advertising Partners and Data Sharing

6.2.1 Advertising Partners

• Facebook
• Google
• SnapChat
• TikTok
• Taboola
• Outbrain
• AppLovin
• Pinterest

6.2.2 Data Sharing Practices

• Anonymous identifiers
• Email addresses (for advertising purposes)
• Usage data
• Device information
• Interaction metrics

6.2.3 Partner Data Usage

• Track user interactions
• Measure ad performance
• Optimize ad targeting
• Create audience segments
• Analyze campaign effectiveness

6.2.4 Pinterest API Integration

We use the Pinterest API to connect our internal marketing tools with our Pinterest business account. This integration may allow us to read Pinterest advertising data, such as ad accounts, campaigns, ad groups, ads, and performance metrics, and to create or manage Pins that we prepare for advertising purposes.

We do not use the Pinterest API to access personal Pinterest user data from our customers or website visitors. The integration is used only by our internal team for managing our own Pinterest marketing activity.

Data received from Pinterest API is used for reporting, campaign analysis, creative preparation, and advertising workflow automation. We do not sell Pinterest API data or share it with unrelated third parties.

Access to Pinterest API data is limited to authorized internal team members and service providers who help us operate our marketing tools. We retain exported Pinterest advertising reports and related operational logs only as long as needed for business, reporting, debugging, compliance, and security purposes.

You can learn more about Pinterest's own privacy practices here: https://policy.pinterest.com/privacy-policy

6.3 User Control Over Tracking

6.3.1 Tracking Limitations

• Browser cookie settings
• Ad-blocker extensions
• Device settings
• Platform-specific controls

6.3.2 Opt-Out Options

• Digital Advertising Alliance (DAA) opt-out tools
• Network Advertising Initiative (NAI) opt-out platform
• Platform-specific advertising settings
• Individual advertising partner opt-outs

6.3.3 Impact of Tracking Limitations

• Platform functionality
• Service personalization
• Feature availability
• User experience

7. YOUR RIGHTS AND CHOICES

7.1 Universal Rights

• Access their personal data
• Correct inaccurate data
• Request data deletion (see Section 8.2 for procedures)
• Object to processing
• Data portability
• Withdraw consent

7.2 Regional Privacy Rights

7.2.1 European Union and UK Residents (GDPR)

• Right to be informed
• Right to access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object
• Rights regarding automated decision-making

7.2.2 California Residents (CCPA/CPRA)

• Knowledge of personal information collection
• Knowledge of information sharing
• Deletion rights
• Correction rights
• Opt-out rights
• Non-discrimination rights
• Portability rights

7.2.3 Australian Residents

• Collection notification
• Access rights
• Correction rights
• Purpose specification
• Use limitation
• Disclosure transparency

7.2.4 Canadian Residents

• Access rights
• Accuracy rights
• Consent withdrawal
• Use transparency
• Protection expectations

7.3 How to Exercise Your Rights

7.3.1 Submission Methods

7.3.2 Verification Process

• Email verification
• Account authentication (if applicable)
• Identity documentation (if needed for sensitive requests)

• Government-issued ID
• Proof of authority (for agents)
• Additional security checks as needed

7.3.3 Response Timelines

• Initial acknowledgment: Within 72 hours
• Standard response time: 30 days
• Maximum extension period: 45 days (with notification)
• Appeal decisions: 30 days

7.3.4 Data Delivery

• Machine-readable format (CSV or JSON)
• With complete data inventory
• Via encrypted transmission

7.3.5 Appeal Process

• Submit appeal within 30 days
• Include reason for appeal
• Provide any additional information
• Receive decision within 30 days

8. DATA RETENTION AND DELETION

8.1 Retention Periods

• Account data: While account is active
• Payment records: As required by law
• Analytics data: For service improvement
• Communication records: 2 years
• Security logs: 13 months

8.2 Deletion Procedures

• Account deletion: 30-day process
• Data removal: Systematic process
• Backup removal: 90-day maximum
• Verification process: Complete removal check

9. INTERNATIONAL DATA TRANSFERS AND LEGAL JURISDICTION

9.1 International Data Transfers

• Standard contractual clauses for international data transfers
• Technical and organizational security measures
• Regular compliance monitoring and assessments
• Adherence to international data protection requirements
• Continuous evaluation of data protection mechanisms

9.2 Legal Jurisdiction and Dispute Resolution

9.2.1 Escalation Process

• Submit to escalations-leader@Hair Stylist App.com
• Include reference number and prior communication history
• Response provided within 5 business days

• If unsatisfied, escalate to escalations-management@Hair Stylist App.com
• Senior management review
• Final decision within 15 business days

• Following escalation process, parties will attempt informal resolution
• 30-day good-faith negotiation period
• Direct communication to resolve disputes

9.2.2 Formal Legal Proceedings

• This privacy policy is governed by the laws of the State of Delaware, United States
• Any legal proceedings shall be exclusively resolved through binding arbitration as detailed in Section 14 of our Terms and Conditions (as amended for Momiji Group Inc.)
• Arbitration shall be conducted by the Delaware Court of Chancery
• Users expressly consent to the personal jurisdiction of Delaware courts for matters exempt from arbitration
• All claims must be brought within six months of the incident date

10. CHILDREN PRIVACY

10.1 Age Restrictions

• Minimum age: 16 years
• No intentional collection from minors
• Account termination if underage discovered

11. CHANGES TO THIS POLICY

11.1 Modification Rights

11.2 Types of Changes

• Major changes to data sharing with third parties
• Fundamental changes to data processing purposes
• Significant changes to user privacy rights

• Updates to reflect current practices
• Adding new product features or services
• Changes to contact information
• Clarifications of existing terms
• Grammatical or formatting updates
• Security enhancements
• Technical documentation updates
• Service improvement descriptions
• Analytics and tracking updates
• Changes to advertising partners and analytics providers
• Updates to third-party integrations
• Regional compliance updates

11.3 Notice Requirements

• Email notification 5 days before implementation
• Changes effective upon notification date
• Continued use constitutes acceptance

• May be implemented immediately
• No advance notice required
• Updated policy posted on website

11.4 Your Options

• Review current privacy policy on our website
• Discontinue service use if you disagree with changes
• Continued use indicates acceptance of changes

12. LEGAL INFORMATION AND CONTACT DETAILS

12.1 Momiji Group Inc. Information

• Email: support@hair-stylist.app
• Help Center:
• Postal Address: 2604 Whittier Place, Wilmington, DE, 19808, United States