Privacy policy
1. Who we are and what this policy covers
Effective 9/22/2026. Updated 9/25/2026.
Carasoin LLC ("Carasoin", "we", "us") operates Carasoin Day Spa & Skin Clinic at 8474 Santa Monica Blvd, West Hollywood, CA 90069, and the website www.carasoin.com (the "Site").
This Privacy Policy explains what personal information we collect, how we use and disclose it, and the choices you have. It applies when you visit the Site, shop our online store, request or book an appointment, buy or redeem a gift card, join our rewards program or mailing list, visit the spa, or contact us by phone, email, text or social media.
By using the Site after seeing our cookie notice, or by submitting information to us, you acknowledge the practices described here. If you do not agree, please do not use the Site or submit information through it. You can always reach us by phone at 310 855 0105 instead.
2. Information we collect
We collect information from you directly, automatically from your device, and from service providers that work for us.
Category |
Examples |
Source |
|---|---|---|
Contact and account details |
Name, email, phone, billing and shipping address, account login, communication preferences |
You |
Order and payment details |
Products and services purchased, gift card purchases and balances, rewards activity. Our payment processors handle card numbers; we do not store full card numbers |
You, payment processors |
Appointment and treatment information |
Requested services and times, appointment history, intake and consent forms, skin concerns, allergies, medications, contraindications and treatment notes you choose to share so we can treat you safely |
You, your provider's notes |
Communications |
Messages, emails, texts, form submissions, reviews, and calls with us |
You |
Device and usage data |
IP address, approximate location derived from IP, browser and device type, pages viewed, links clicked, referring site, cart activity, and cookie or pixel identifiers |
Your device, our technology providers |
In-spa information |
Video from security cameras covering the building exterior, parking lot and front entrance (there are no cameras inside the spa), and photos of treatment results only with your written consent |
Our premises, you |
Treatment information. We treat information about your skin, health and treatments as sensitive. We use it only to provide and document your services, keep you safe, and meet legal and insurance requirements. We do not use it for advertising and we do not send it to advertising or social media companies. Please do not enter health details into general website forms; share them with your provider, on our intake forms, or by phone.
If you give us information about another person (for example a gift recipient), you confirm you have their permission.
3. Cookies, pixels and similar technologies
The Site uses cookies, pixels, tags, software development kits and embedded third-party tools (together, "tracking technologies"). Some are operated by us and some by other companies. When a page loads, these companies may receive your IP address, device and browser details, the address of the page you are viewing, and your interactions with their feature, at the moment those interactions happen.
Purpose |
What it does |
Who operates it |
|---|---|---|
Essential |
Runs the store, cart, checkout, login, fraud prevention, language and currency settings, and remembers your cookie choice |
Shopify, Shop Pay, PayPal and other payment providers |
Site features |
Rewards program, gift cards, appointment request and contact forms, signup pop-ups, promotions, page layout, social media feed displays |
Smile.io, ShopKeeper Tools, POWR, EcomSend, Discounty, Kite, Timesact, PageFly, Avada, LookThru, Instafeed, Tagembed |
Analytics |
Measures visits, traffic sources and store performance |
Shopify |
Advertising |
Measures our ads and shows Carasoin ads to people who visited the Site, using cookie and device identifiers and purchase events |
Meta (Facebook and Instagram) |
This vendor list changes as we add or remove tools. We update it when we update this policy.
Your consent and choices.
- Cookie banner. When you first visit, a banner asks you to accept or decline non-essential tracking. Analytics and advertising technologies managed through our store platform stay off unless you accept. You can change your choice at any time through the "Cookie preferences" link in the Site footer.
- Global Privacy Control. We treat a Global Privacy Control browser signal as a request to opt out of advertising tracking for that browser.
- Do Not Track. Browsers send "Do Not Track" signals in a way no standard defines, so the Site does not respond to them. Use the cookie banner or Global Privacy Control instead.
- Browser and platform controls. You can block or delete cookies in your browser settings, and manage ad personalization in your Facebook and Instagram ad settings.
- Forms and embedded tools. Forms and embedded features on the Site are provided by the vendors listed above, who receive what you submit on our behalf at the time you submit it. By using a form or embedded feature, you consent to that vendor processing your submission for us.
Other companies may collect information about your online activity over time and across different websites when you use the Site. Blocking all cookies may break the cart, checkout or login.
4. How we use and disclose information
We use personal information to:
- provide, schedule, document and follow up on spa and skin clinic services;
- process orders, payments, gift cards, rewards, shipping and returns;
- answer questions and send service messages such as confirmations, reminders and receipts;
- send marketing by email or text where you have agreed, and measure how it performs;
- run, secure, debug and improve the Site and our services;
- prevent fraud, abuse and discount misuse;
- comply with law, tax, licensing, insurance and recordkeeping duties, and establish or defend legal claims.
We disclose personal information to:
Recipient |
Purpose |
|---|---|
Service providers under contract |
Store and checkout (Shopify), salon booking and client records software (Phorest), exterior security cameras (Ring), payment processing, shipping carriers, email and text delivery, rewards and gift card tools, form and website tools, IT, accounting, payroll, legal and insurance providers |
Advertising partners |
Cookie and device identifiers and Site events go to Meta for ad measurement and retargeting, only as described in Section 3. We never send treatment information |
Authorities and other parties |
When the law, a subpoena or a court order requires it, or to protect the safety, rights or property of clients, staff, Carasoin or others |
A successor business |
In a merger, financing, sale or transfer of all or part of the business, subject to this policy |
Anyone else |
With your direction or consent |
We do not sell personal information for money. We do not disclose personal information to other companies for their own direct marketing.
5. Your privacy rights and California notices
We extend the following choices to California residents, and to other clients where practical:
- Know and access. Ask what personal information we hold about you and receive a copy.
- Correct. Ask us to fix inaccurate information.
- Delete. Ask us to delete your information. We do not delete treatment records, consent forms or appointment history, for the safety and legal reasons in Section 7, and we keep what tax rules, licensing boards, our insurers or an open transaction require. We will delete or anonymize marketing and account data on request.
- Opt out of advertising sharing. Decline the cookie banner, use the "Cookie preferences" link, or turn on Global Privacy Control. Some privacy laws call our use of the Meta pixel "sharing" or a "sale" of identifiers, even though no money changes hands.
- Limit sensitive information. We already limit treatment information to the uses in Section 2.
- No retaliation. We will not deny service, change prices or lower quality because you made a privacy request.
How to make a request. Email info@carasoin.com with the subject "Privacy request", call 310 855 0105, or write to the address in Section 8. We verify identity by matching your request to the contact details on file, and may ask for more if the request is sensitive. We respond within 45 days. An authorized agent may act for you with your signed permission.
Information collected in the past 12 months. We collected every category in Section 2, from the sources listed there, for the purposes in Section 4, and disclosed them to the recipients in Section 4. We disclosed identifiers and internet activity data to Meta for advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
Shine the Light (Civil Code 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.
Do Not Track (Business and Professions Code 22575). See Section 3 for how the Site responds to browser signals and for third-party tracking on the Site.
Other states and countries. If the privacy law of your state or country gives you additional rights, contact us the same way and we will honor the rights that apply to us. You may appeal a denied request by replying to our decision.
6. Email and text messages
Service messages. When you book or buy, we send confirmations, reminders, receipts and follow-up care messages by email or text to the contact details you gave us.
Marketing email. We send marketing email only if you signed up or are a client, and every message has an unsubscribe link.
Marketing texts. We do not send marketing text messages. Any text you receive from us relates to an appointment or order you made.
We do not sell, rent or share phone numbers or email addresses with third parties for their marketing. The providers that deliver our messages process contact details only on our behalf.
7. Retention, security, children and international visitors
Retention. We keep personal information only as long as we need it for the purposes in Section 4. Order and tax records are kept for at least 7 years. Treatment records, intake and consent forms and appointment history are kept for as long as we operate, so that any provider who treats you in future can see your full history, contraindications and reactions, and so we can meet licensing, insurance and legal-claim obligations. If we change booking or client-record software, we transfer these records to the new provider under the same protections. Marketing data is kept until you unsubscribe or ask us to delete it. Device data is kept under each provider's standard retention period, generally 26 months or less. Exterior camera footage is kept for the short period set by our camera provider's plan, then deleted automatically, unless we need it for an incident, claim or law enforcement request.
Security. We use reasonable administrative, technical and physical safeguards, including encrypted connections, access limits and reputable payment processors. No system is perfectly secure, and we cannot guarantee security. If a breach affects your information, we will notify you as the law requires.
Children. The Site and our services are for adults. We do not knowingly collect personal information online from anyone under 18. Minors receive spa services only with a parent or guardian's consent, given in person. If you believe a minor gave us information online, contact us and we will delete it.
Visitors outside the United States. We operate in California and store information in the United States and in other countries where our providers operate, including Canada and Ireland. Those countries may have different data protection rules than yours. Our online store ships to the United Kingdom, the European Economic Area, Switzerland and other countries; if you are in one of those places, Section 7A also applies to you.
Links. The Site links to other websites and social platforms. Their privacy practices are their own.
7A. Additional information for the UK, EEA and Switzerland
This section applies if you are in the United Kingdom, the European Economic Area or Switzerland. Carasoin LLC is the controller of your personal information. We have no establishment or representative in those places; contact us at the address in Section 8.
Why we may process your information (legal bases).
- To perform a contract with you: orders, shipping, gift cards, returns and customer service.
- With your consent: marketing email, non-essential cookies and the Meta pixel. You may withdraw consent at any time by unsubscribing, using the "Cookie preferences" link, or contacting us. Withdrawal does not affect processing that already took place.
- For our legitimate interests: securing the Site, preventing fraud, improving our products, keeping business records and defending legal claims, where those interests are not overridden by your rights.
- To comply with legal obligations: tax, accounting and consumer-protection law.
Your rights. You may ask us to give you access to your personal information, correct it, erase it, restrict or object to its processing, or provide it to you in a portable format. You may object at any time to processing for direct marketing. Contact us as described in Section 8; we respond within one month and may ask you to verify your identity. You also have the right to complain to your data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), in Switzerland the Federal Data Protection and Information Commissioner, and in the EEA the authority in your country.
International transfers. Your information is transferred to and processed in the United States, which has not been found to provide the same level of data protection as the UK, EEA or Switzerland. Where required, we rely on the standard contractual clauses approved by the European Commission and the UK International Data Transfer Addendum in our contracts with providers such as Shopify, or on your explicit consent for the transfer. You may request a copy of the relevant clauses.
Retention. The periods in Section 7 apply. Treatment records concern in-person services in California and are not created for online orders.
Automated decisions. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
8. Changes and contact
Changes. We may update this policy. We will post the new version here with a new effective date, and for material changes we will add a notice on the Site or email clients before the change takes effect.
Contact. Carasoin LLC, Attn: Privacy, 8474 Santa Monica Blvd, West Hollywood, CA 90069. Email info@carasoin.com. Phone 310 855 0105.
Accessibility. If you need this policy in another format, contact us and we will provide it.