Privacy Policy

1. Information We Collect

We collect information you provide directly to us, including when you create an account, place an order, book a consultation, subscribe to our newsletter, or contact us. This may include:

• Name, email address, phone number, and shipping/billing address
• Payment information (processed securely by Stripe — we do not store card numbers)
• Account credentials (username and hashed password)
• Order history, preferences, and product reviews
• Communications you send us (emails, chat, bug reports)
• Appointment details and consultation notes

We also collect certain information automatically when you visit our site:

• IP address, browser type, operating system, and device information
• Pages viewed, time spent on site, and referring URLs
• Approximate geographic location (country/region, inferred from IP)
• Cookie data and local storage values (see Section 4)

2. How We Use Your Information

We use the information we collect to:

• Process and fulfill your orders, including payment and delivery
• Send order confirmations, shipping updates, and appointment reminders
• Provide customer support and respond to your inquiries
• Send promotional emails and newsletters (with your consent; unsubscribe anytime)
• Personalize your shopping experience and recommend relevant products
• Detect fraud and protect the security of our platform
• Comply with legal obligations and enforce our terms
• Improve our website, products, and services through analytics

We process your personal data on the following legal bases: performance of a contract (to fulfill your orders), legitimate interests (fraud prevention, analytics, service improvement), legal obligation (tax and regulatory compliance), and consent (marketing communications).

3. Information Sharing & Third Parties

We do not sell, rent, or trade your personal information. We may share your data with the following categories of service providers who assist us in operating our business:

• Stripe — Payment processing. Your payment data is transmitted directly to Stripe and subject to their privacy policy.
• Uber Direct — Same-day delivery services for qualifying New Jersey addresses.
• Twilio — SMS delivery notifications and WhatsApp communications.
• Resend — Transactional email delivery (order confirmations, appointment reminders).
• Supabase — Secure database hosting and file storage.
• Railway — Cloud hosting and infrastructure provider.

We may also disclose your information when required by law, in response to legal process, to protect the rights and safety of Rivky Wigs and others, or in connection with a business transfer such as a merger or acquisition.

4. Cookies & Tracking Technologies

We use cookies and similar technologies (such as local storage) to enhance your experience on our site. These include:

• Essential cookies — Required for the site to function, including authentication sessions and cart data.
• Preference cookies — Remember your language, currency, and display preferences.
• Analytics cookies — Help us understand how visitors interact with our site so we can improve it.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our site. By accepting our cookie banner, you consent to our use of non-essential cookies.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy, comply with our legal obligations, resolve disputes, and enforce our agreements.

Account data is retained while your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except for data we are required to retain for legal or regulatory purposes (such as order records for tax compliance, which may be retained for up to 7 years).

6. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate or incomplete data.
• Erasure — Request deletion of your personal data ("right to be forgotten").
• Portability — Receive your data in a structured, machine-readable format.
• Restriction — Request that we limit how we process your data in certain circumstances.
• Objection — Object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — Withdraw consent at any time where processing is based on consent (e.g., unsubscribe from marketing emails).

EU/EEA residents have these rights under the General Data Protection Regulation (GDPR). California residents have rights under the California Consumer Privacy Act (CCPA). To exercise any of these rights, please contact us at legal@rivkywigs.com. We will respond within 30 days.

If you believe we have not adequately addressed your privacy concerns, EU residents have the right to lodge a complaint with your local Data Protection Authority.

7. Children's Privacy

Our website is not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it promptly.

8. Data Security

We implement commercially reasonable technical and organizational security measures to protect your personal information from unauthorized access, use, alteration, or disclosure. These include encrypted data transmission (HTTPS/TLS), hashed password storage, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.