Privacy Policy

1. Information We Collect

We collect information you provide directly to us, including when you create an account, place an order, book a consultation, subscribe to our newsletter, or contact us. This may include:

• Name, email address, phone number, and shipping/billing address
• Payment information (processed securely by Stripe — we do not store card numbers)
• Account credentials (username and hashed password)
• Order history, preferences, and product reviews
• Communications you send us (emails, chat, bug reports)
• Appointment details and consultation notes

We also collect certain information automatically when you visit our site:

• IP address, browser type, operating system, and device information
• Pages viewed, time spent on site, and referring URLs
• Approximate geographic location (country/region, inferred from IP)
• Cookie data and local storage values (see Section 4)

2. How We Use Your Information

We use the information we collect to:

• Process and fulfill your orders, including payment and delivery
• Send order confirmations, shipping updates, and appointment reminders
• Provide customer support and respond to your inquiries
• Send promotional emails and newsletters (with your consent; unsubscribe anytime)
• Personalize your shopping experience and recommend relevant products
• Detect fraud and protect the security of our platform
• Comply with legal obligations and enforce our terms
• Improve our website, products, and services through analytics

We process your personal data on the following legal bases: performance of a contract (to fulfill your orders), legitimate interests (fraud prevention, analytics, service improvement), legal obligation (tax and regulatory compliance), and consent (marketing communications).

3. Information Sharing & Third Parties

We do not sell, rent, or trade your personal information. We may share your data with the following categories of service providers who assist us in operating our business:

• Stripe — Payment processing. Your payment data is transmitted directly to Stripe and subject to their privacy policy.
• Uber Direct — Same-day delivery services for qualifying New Jersey addresses.
• Twilio — SMS delivery notifications and WhatsApp communications.
• Resend — Transactional email delivery (order confirmations, appointment reminders).
• Supabase — Secure database hosting and file storage.
• Railway — Cloud hosting and infrastructure provider.

We may also disclose your information when required by law, in response to legal process, to protect the rights and safety of Rivky Wigs and others, or in connection with a business transfer such as a merger or acquisition.

4. Cookies & Tracking Technologies

We use cookies and similar technologies (such as local storage) to enhance your experience on our site. These include:

• Essential cookies — Required for the site to function, including authentication sessions and cart data.
• Preference cookies — Remember your language, currency, and display preferences.
• Analytics cookies — Help us understand how visitors interact with our site so we can improve it.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our site. By accepting our cookie banner, you consent to our use of non-essential cookies.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy, comply with our legal obligations, resolve disputes, and enforce our agreements.

Account data is retained while your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except for data we are required to retain for legal or regulatory purposes (such as order records for tax compliance, which may be retained for up to 7 years).

Biometric Data, AI Processing, and Location

Some optional features collect or derive sensitive data. You can use the site fully without using any of these:

• Head Profile / SmartMeasure. If you opt into our head-profile wizard, your camera captures a short series of frames and we derive a 468-point face mesh + head circumference + face-shape classification using on-device MediaPipe (Google). Individual frames are not kept. The derived mesh + measurements are stored in your account so wig-fit recommendations stay accurate.
• Face Swap preview. If an admin uploads a customer photo to preview a wig on, that photo is sent over HTTPS to our GPU provider (Modal) for inference using the InsightFace + GFPGAN models. Input photos are not retained by Modal beyond the request, and the resulting swap image is stored only where the admin saved it.
• Wig tag scans (NFC + QR). When you scan a woven NFC or QR tag on a wig, we log the scan (timestamp, approximate location, wig ID) so Rivky can offer wig history + service bookings. Scans are strictly opt-in — your phone prompts before opening the page.
• Driver GPS. For staff drivers delivering locally, the driver portal collects location every ~30 seconds while a route is active. Customers on that route see a live ETA. GPS data is retained for 30 days for dispute / audit purposes.
• Quick Link / private storefront tokens. Quick-link URLs (/shop/[token]) carry a random token so an admin can send a curated selection to a specific client. The token identifies the link, not the recipient; when you log in, your order is attributed to that link.

You may request deletion of your head profile, face-swap images, or scan history at any time via legal@rivkywigs.com. Deletion is irreversible and removes the data from our systems within 30 days.

6. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate or incomplete data.
• Erasure — Request deletion of your personal data ("right to be forgotten").
• Portability — Receive your data in a structured, machine-readable format.
• Restriction — Request that we limit how we process your data in certain circumstances.
• Objection — Object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — Withdraw consent at any time where processing is based on consent (e.g., unsubscribe from marketing emails).

EU/EEA residents have these rights under the General Data Protection Regulation (GDPR). California residents have rights under the California Consumer Privacy Act (CCPA). To exercise any of these rights, please contact us at legal@rivkywigs.com. We will respond within 30 days.

If you believe we have not adequately addressed your privacy concerns, EU residents have the right to lodge a complaint with your local Data Protection Authority.

7. Children's Privacy

Our website is not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it promptly.

8. Data Security

We implement commercially reasonable technical and organizational security measures to protect your personal information from unauthorized access, use, alteration, or disclosure. These include encrypted data transmission (HTTPS/TLS), hashed password storage, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.