Privacy

01Who we are

Essencial Soul U.S.A is a distributor of professional haircare, with a store at 5537 Sheldon Rd, Suite N, Tampa, FL 33615. This notice explains what we do with the personal information that reaches us through this site and the Essencial Soul U.S.A iPhone app.

For anything to do with your data, write to us from the contact page or call (786) 332-1061.

02What we collect

Only what it takes to serve you. Specifically:

• ·Account application: business name, account type, EIN, business type, the reason you write, phone and shipping address.
• ·Professional account documents: the resale certificate, the cosmetology license and a photo ID. All three are required to approve a professional account. They are kept in private storage and only the store owner can open them.
• ·Sign-in: your email and password. The password is handled by our authentication provider and we never see it.
• ·Orders: the products, quantities, prices, total, invoice and dispatch dates.
• ·Messages: the email address and the text you send us from the chat, the footer form or the contact page.
• ·Events, referrals and rewards: your event sign-up, your referral code and any redemptions.
• ·Technical data: the IP address and request data logged by the hosting provider and the database, for security and for debugging.
• ·Card payments, on the site and in the app: you enter your card details in Stripe's form and Stripe processes them. We never see or store them; we only receive the payment result, the amount and the charge reference.
• ·Professional code: if you buy with a salon's code, we store that code with your order to work out what the professional earns. The professional sees their sales by code, not your personal data.
• ·iPhone notifications: if you turn notifications on, we store a notification identifier for your device and your preferences (order updates and, if you choose, promotions). You can turn them off in the app or in iPhone Settings.

03What we do not do

• ·We do not sell or share personal information with anyone.
• ·We do not run targeted advertising or profiling, on or off the site.
• ·We use no analytics, no social pixels and no other tracking tag. The site loads no third-party scripts.
• ·We make no automated decisions about you. Every account application is reviewed by a person.
• ·The app does not track you as Apple defines it: it does not use the advertising identifier (IDFA), does not link your data with other companies' data, and does not share it with ad networks or data brokers.

04In the iPhone app

The app uses the same account as the site and collects the same data described above. In addition, you should know this:

• ·Permissions: the app can only ask for the camera and notifications, and both are optional. The camera is used by Stripe's payment form to read your card number if you choose that option; the image is not stored and never reaches us. The app does not access your location, contacts, microphone, photos or health data.
• ·Files: when you attach your certificate, license or ID, the app only reads the file you pick, and uploads it over an encrypted connection to your private folder.
• ·What stays on your iPhone: your session, encrypted in the iPhone Keychain and tied to that device; the language you choose; a copy of the public catalog, with no prices or personal data, so the app opens offline; and a pending cart change if the connection drops.
• ·Sharing: the buttons to share a product or your code open the iPhone share sheet. You choose who to send it to; the app does not read your contacts.
• ·Referrals: if you invite someone, we do not collect their details from you. That person creates their own account and accepts this notice.
• ·The app has no analytics, no advertising and no third-party tracking SDK.

05What we use it for

• ·Reviewing and approving professional account applications: resale certificate, cosmetology license and photo ID.
• ·Charging your order when you pay by card, and refunding it if the order is cancelled or returned.
• ·Preparing, shipping and invoicing your orders.
• ·Answering your messages.
• ·Meeting tax and accounting obligations, and establishing or defending legal claims.

06Who sees it

Nobody beyond the providers we need in order to operate, and each sees only what it needs:

• ·Supabase, which hosts the database, the authentication and the files you upload: resale certificate, cosmetology license and photo ID.
• ·Stripe, which processes card payments on the site and in the app. Stripe handles card data under its own privacy policy (stripe.com/privacy).
• ·Expo and Apple's push notification service, which deliver notifications to your iPhone. They only receive the device identifier and the text of the notification.
• ·The email provider we use for transactional mail, such as the notice that your account was approved.
• ·The hosting provider for the site.
• ·Carriers, with what they need to deliver your order.
• ·Public authorities, where the law requires it.

07How long we keep it

Account and order records are kept while the account is active and afterwards for as long as tax and accounting rules require. Messages are kept while they are useful for follow-up. If you ask us to delete your account, we delete whatever we are not required to keep.

08Deleting your account

In the app: Account tab → Delete my account, then confirm your password. Deletion happens right away: your sign-in, personal data, documents (certificate, license and ID), favorites and notifications are removed. Order records the law requires us to keep are retained without your identity.

You can also ask for it from the site: write to us from the contact page or call (786) 332-1061.

09Your rights

If you live in Florida, the Florida Digital Bill of Rights gives you the right to confirm whether we process your data and to access it, correct it, ask us to delete it, obtain a portable copy, and opt out of the sale of personal data or of targeted advertising. Neither of those last two happens here, because we do not sell data and we do not run targeted advertising. Wherever you live, we honour the same requests.

To exercise them, write to us from the contact page or call (786) 332-1061. We answer within 45 days at the latest. If we turn a request down we tell you why, and you can ask us to look at it again by replying to that same message.

10Security

The site and the app always communicate over an encrypted connection (HTTPS) and database access is restricted row by row, so an account can only read its own records. Professional account documents are kept in private, not public, storage.

On the iPhone, your session is stored encrypted in the system Keychain and is not copied to other devices. The app never sees your card details.

No system is perfect, so if we detect a breach that affects you, we will tell you.

11Children

The site and the app serve customers, professionals and distributors. They are not intended for anyone under 18 and we do not knowingly collect data from minors. If you believe a minor has given us their data, tell us and we will delete it.

12Changes

If we change this notice we update the date in the header. When the change is significant we also email active accounts.