Privacy notice

What this website records

A page visit may record a randomly generated event identifier, the site domain supplied by our web server, server time and limited security metadata. The browser does not send a claimed domain or customer identity with that visit.

The local sky uses device time by default. If you choose precise sunrise, this site uses browser-provided coordinates only in the open page to calculate sunrise and sunset; it does not send or store those coordinates. Your browser or operating system handles the permission request and may process location under its own terms.

Private-beta or portfolio waitlists record the email, selected experience, explicit email consent and consent-policy versions. Email ownership remains unverified until a separate confirmation step exists.

Audit, payment and communications

The salon audit intake collects only public business links, project context and the two separate email choices shown before submission. The clinic assessment intake collects clinic business and workflow information only; it rejects patient names, phone numbers, symptoms, diagnoses, treatment details, prescriptions, case notes and health records. For either offer, the first choice permits one pre-payment founder email about fit and, only if approved, an individual checkout. The paid-service choice activates only after captured-payment evidence for an accepted project and permits the delivery emails necessary for that project. A captured-payment capacity exception is not an accepted project and does not start report delivery or review scheduling. Neither choice permits marketing, calls, WhatsApp or unrelated follow-up. Razorpay handles payment-card entry on its own checkout; we receive provider records needed to verify an accepted order or reconcile a capacity exception and initiate and track its required full refund. We do not describe the refund as processed or credited, or the payment as settled, refunded or complete, until provider or bank evidence supports the relevant state.

A waitlist choice or purchase does not authorise WhatsApp messages, sales calls, profiling, contact enrichment or unrelated marketing. Those purposes require a separate, specific choice.

Use, retention and requests

Information is used for the purpose stated at collection, security, service delivery and applicable legal or accounting duties. Identifying audit-intake content and its email authority are deleted after 180 days and are not reused for marketing. Identifying clinic-assessment intake content and its email authority follow the same deletion and non-marketing rule. If a provider checkout, partial-payment or refund authority is still unresolved then, the name, contact email, business links and goal text are replaced with non-contact placeholders while only the minimal provider identifiers, status and amount evidence needed to cancel, reconcile or refund remain under restricted access until terminal resolution and applicable payment or legal retention duties. Once terminal, the intake shell and raw provider identifiers are deleted; only non-contact SHA-256 provider fingerprints and lifetime capacity counts remain to prevent duplicate authority or overselling after disaster recovery. Encrypted, provider-controlled rolling VPS backups may retain residual identifying copies only for disaster recovery until their bounded provider retention expires; any restored backup is quarantined and the same redaction, purge and provider-history checks run before the service returns.

We do not sell personal information. You may request access, correction or deletion through the listed support and rights address ceo@dacartel.io, subject to legal and fraud-prevention exceptions.