Privacy policy, advertising platform tracking disclosures, and visitor data subject rights under United States and GDPR regulations.

Effective Date and Document Validity

This Privacy Policy took effect and was published on October 17, 2026. It governs all personal data, telemetry signals, and appointment inquiries submitted through cosmetiva.click or processed in connection with our physical studio practice.

Data Controller Identification

The data controller responsible for the processing of personal data described in this statement is:

Child Privacy & 18+ Adult Service Restriction

Cosmetiva strictly serves adult clients. In compliance with Meta Ads and Google Ads policies governing cosmetic procedures and adult skincare treatments, our services and this website are intended solely for individuals who are 18 years of age or older. We do not knowingly solicit, collect, or retain personal data from children under the age of 18. If a parent or guardian becomes aware that a minor has submitted personal data or an appointment inquiry without authorization, contact us immediately at office@cosmetiva.click and we will permanently delete the record within 10 days.

Notification of Changes to Policy

Any future modifications to this Privacy Policy will be published directly to this URL with a revised effective date header. Where changes materially expand how we process previously collected contact information, we will notify affected individuals via email notification 14 days prior to implementation.

Categories of Personal Data Collected

Cosmetiva operates on an inquiry-only model. We do not maintain client user accounts, store login passwords, or process credit card numbers on this website. Our systems collect only what is strictly necessary to arrange esthetic services:

• Inquiry Form Data: When you submit an intake request via fagiaf2.php, we collect your full legal name, phone number, email address, physical address or Austin neighborhood, selected protocol category, service specification, free-text clinical notes, and affirmative consent verification.
• Automated Telemetry & Server Logs: The server automatically logs your public IP address, browser user-agent string, HTTP referring URL, page render timestamp, and form transmission timestamp.
• Live Support Chat Records: Messages exchanged through our reception chat widget (keno424.php) are logged alongside a pseudonymous session token stored in your local browser storage.
• Consent Preference State: Your cookie preference is persisted locally under the key site_consent_v2.
• Paid Advertising Click Identifiers: Inbound query string parameters including Google Ads click identifier (gclid), Microsoft Advertising click identifier (msclkid), and Meta Ads click identifier (fbclid).

Purposes of Data Processing

We process collected data exclusively for the following operational purposes:

• To evaluate treatment candidacy, verify service duration, and confirm appointments at our 1301 Barton Springs Road studio.
• To send operational appointment confirmations, protocol preparation guidelines, and SMS schedule updates.
• To provide live chat customer service regarding procedure indications, contraindications, and pricing schedules.
• To defend against spam submissions, automated bots, and abusive query attacks using hidden honeypot validation fields (agency, url).
• To evaluate advertising campaign efficiency across search engines and social platforms when optional analytics storage is approved.

Legal Bases for Processing

Under United States and international data frameworks, our processing activities rely upon explicit lawful bases:

Advertising Platforms & Click Identifiers

Cosmetiva receives paid visitor traffic from commercial search engine and social advertising networks. Google Ads, Microsoft Advertising, and Meta Ads run paid campaigns directed to this website. When you click an advertisement sponsored by Cosmetiva, the platform attaches a unique query parameter to the landing page URL:

• Google Ads: Passes the Google Click Identifier (gclid) or gbraid / wbraid attribution token.
• Microsoft Advertising: Passes the Microsoft Click Identifier (msclkid) for Bing, Yahoo, and MSN network attribution.
• Meta Ads: Passes the Meta Click Identifier (fbclid) for Facebook and Instagram network attribution.

Cosmetiva does not maintain an advertising relationship that implies any platform endorsement. Nothing on this website shall be construed as stating that Google, Microsoft, or Meta has reviewed, approved, or verified our esthetic studio, procedures, or credentialing.

Consent Mode v2 Integration

We implement Google Consent Mode v2 to ensure marketing attribution strictly respects your privacy selections. By default, before any user action is taken, the four operational consent parameters are initialized in a denied state:

These four parameters remain denied until the visitor explicitly clicks "Allow Storage" on our consent banner. If the visitor clicks "Decline Optional", all four parameters remain held in the denied state, and no marketing or analytics cookies are set.

Global Privacy Control (GPC) Compliance

Our web server and frontend scripts inspect browser request headers for the Global Privacy Control signal (Sec-GPC: 1). If your browser transmits an active GPC header, Cosmetiva automatically treats this signal as an immediate, binding request to opt out of non-essential tracking, sale, or sharing of personal information. Consent Mode v2 signals are locked in the denied state without requiring you to open the cookie configuration dialogue.

Third-Party Data Processors

We disclose personal information only to trusted service vendors providing core communications, hosting, and advertising measurement. Each third-party processor operates under strict data protection agreements:

• Hosting Infrastructure Provider: Hosts our Apache server environment and encrypted MySQL database repository located within the United States.
• Transactional Email Relay Provider: Delivers intake notification emails to our reception desk inbox at office@cosmetiva.click.
• Google LLC / Google Ireland Ltd: Operates Google Ads measurement and Consent Mode v2 signal routing.
• Microsoft Advertising (Microsoft Ireland Operations Ltd): Processes conversion tracking and click attribution. Review their corporate terms in the Microsoft Privacy Statement at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Evaluates Instagram and Facebook ad engagement where active campaigns run.

International Cross-Border Data Transfers

Cosmetiva's studio operations, servers, and primary records are located within the State of Texas in the United States. If you access our website from the European Economic Area, United Kingdom, or Switzerland, your information is transferred directly to the United States. Where transfers involve global service providers such as Google or Microsoft, transfers are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission and participation in the EU-U.S. Data Privacy Framework.

Defined Data Retention Periods

We do not retain information indefinitely. Personal data is scheduled for permanent automated purging according to real calendar limits:

Information Security Measures

We safeguard personal data through layered organizational, physical, and technical controls:

• 256-bit Transport Layer Security (TLS 1.3) encryption enforced across all website endpoints.
• Encrypted storage of inquiry database records with access restricted to authorized esthetic staff via dual-factor authentication.
• Daily automated vulnerability sweeps and rapid patch management on web server hosts.
• Physical workstation locking and zero paper file storage of prospective client contact lists.

United States State Privacy Rights (CCPA / CPRA & Texas DPDPA)

Residents of California under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), as well as residents of Texas under the Texas Data Privacy and Security Act, have specific statutory rights regarding their personal data:

• Right to Know & Access: You may request the categories and specific pieces of personal information we have collected about you over the preceding 12 months.
• Right to Deletion: You may request that we permanently erase personal data collected from you, subject to legal recordkeeping exemptions.
• Right to Correction: You may request that we correct inaccurate personal data retained in our appointment ledger.
• Right to Opt-Out of Sale or Sharing: We do not sell personal data for monetary consideration. We do not share data for cross-context behavioral advertising without affirmative consent. You may opt out at any time.
• Right to Non-Discrimination: We will never deny services, charge different prices, or provide a lesser quality of treatment if you exercise your statutory privacy rights.

European Data Subject Rights (GDPR)

If you access our website from the European Union, United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) guarantees the following rights:

• Access: The right to obtain confirmation as to whether your personal data is being processed and a copy of that data.
• Rectification: The right to obtain without undue delay the rectification of inaccurate personal data.
• Erasure (Right to be Forgotten): The right to obtain the erasure of your personal data where it is no longer necessary.
• Restriction of Processing: The right to restrict processing where accuracy is contested or processing is unlawful.
• Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Objection: The right to object at any time to processing based on legitimate interests or direct marketing.
• Withdrawal of Consent: The right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Supervisory Authority Complaints

If you believe our data processing infringes your statutory rights, you have the right to lodge a formal complaint with a competent regulatory authority:

• Texas Residents: Office of the Attorney General of Texas, Consumer Protection Division.
• California Residents: California Privacy Protection Agency (CPPA) or California Attorney General.
• European Residents: The data protection supervisory authority in your country of residence or place of alleged infringement.

How to Exercise Your Data Rights (DSAR)

To submit a verified Data Subject Access Request (DSAR) to access, correct, export, or delete your personal records:

Privacy Officer Contact Information

For questions regarding this policy, Consent Mode v2 implementation, or appointment security:

• Email: office@cosmetiva.click
• Phone: +1 (307) 555-3072
• In Person: 1301 Barton Springs Road, Austin, Texas 78704 (Tue–Sat 09:00–19:00)