Privacy Policy

01. Information We Collect

02. How We Use Information

We may use personal information to:

• Provide, administer, and improve our services
• Process bookings, consultations, purchases, payments, deposits, subscriptions, and orders
• Deliver artwork and coordinate shipping or pickup
• Provide tattoo, restorative, educational, consulting, agency, website, marketing, CRM, automation, and other services
• Create and administer accounts, portals, courses, communities, and client workspaces
• Communicate about appointments, purchases, projects, billing, support, and account activity
• Send marketing, educational, promotional, and transactional communications where legally permitted
• Manage lead generation, CRM, email, SMS, appointment reminders, workflows, pipelines, and automation
• Measure website, advertising, and campaign performance
• Perform analytics, attribution, fraud prevention, security, debugging, and service improvement
• Customize content and marketing where permitted
• Use AI-assisted tools for business operations, drafting, analysis, transcription, workflow automation, and creative development, subject to applicable restrictions
• Protect rights, safety, property, and the integrity of our systems
• Comply with legal obligations and enforce agreements

We do not sell personal information for money. However, certain advertising, analytics, cross-context behavioral advertising, or similar activities may constitute “sharing” or another regulated disclosure under California law. Where required, we provide applicable opt-out mechanisms.

03. Website Forms, Lead Magnets, Email, and SMS

Submitting a form permits us to contact you regarding the request you made. Marketing communications are sent only where permitted by law and, where consent is required, after the appropriate consent is obtained.

Marketing email:

• We comply with applicable federal and state marketing-email requirements, including CAN-SPAM.
• Marketing emails include required identification and a valid physical postal address and provide an unsubscribe mechanism.
• Unsubscribing from marketing does not stop necessary transactional or service communications.

SMS/text:

• If you affirmatively opt in to receive marketing or informational texts, we may send appointment reminders, project communications, promotions, educational content, or other messages consistent with the consent you provided.
• Message frequency and applicable carrier fees will be disclosed at the point of consent where required.
• You may opt out by replying STOP and may request assistance by replying HELP.
• We will not condition a purchase on consent to receive marketing texts where prohibited by law.
• Consent to marketing texts is not transferred to unrelated third parties except as permitted by law and the applicable consent.

You may withdraw marketing consent at any time. Withdrawal of consent does not affect processing already performed lawfully before withdrawal.

04. Cookies and Tracking Technologies

We may use cookies, pixels, web beacons, scripts, local storage, SDKs, and similar technologies.

Categories may include:

• Strictly necessary technologies for security, login, booking, checkout, forms, and site functionality
• Analytics and performance technologies
• Functional technologies
• Advertising, attribution, and remarketing technologies

Our Website and marketing systems may use Google Analytics, Google Ads, Meta Pixel/Conversions tools, and comparable services. We may also use tracking and automation functionality provided through GoHighLevel/HighLevel and its integrated services.

Where required by applicable law, we will provide a cookie consent or preference mechanism before placing non-essential technologies. You may also control cookies through your browser and applicable platform settings.

Our Website does not currently promise to respond to every browser “Do Not Track” signal. California law separately provides privacy rights that may apply regardless of DNT functionality.

05. GoHighLevel / HighLevel Operating System

AriCléa uses GoHighLevel/HighLevel as a business operating system and technology platform for AriCléa studio operations and AriCléa OS Agency services. Depending on the workflow, HighLevel may support our website, landing pages, forms, CRM, pipelines, appointment scheduling, communications, email, SMS, automation, workflows, client portals, payments or payment integrations, analytics, reputation-management tools, and related business functions.

HighLevel may process personal information on our behalf as a service provider/processor when we use its processor services. HighLevel’s current documentation states that customers control customer data submitted to the platform and that HighLevel acts as a processor for customer personal data in applicable processor relationships. HighLevel also maintains a Data Processing Addendum and subprocessor framework. We configure and use HighLevel subject to its current terms, privacy documentation, security controls, and data-processing terms.

Agency clients using AriCléa OS Agency services may have their own customers’ personal information processed within HighLevel. Those agency clients remain responsible for their own privacy notices, lawful collection, consent, retention, and consumer-rights obligations unless the parties expressly agree otherwise in writing.

06. Payment Processors and Financial Data

We do not intentionally store complete payment-card numbers or banking credentials on our own servers. Payment and financial transactions may be processed by Square, Stripe, Kajabi, HoneyBook, Venmo, Zelle, HighLevel-connected payment providers, or other processors selected for a particular transaction.

Third-party processors maintain their own privacy policies and security practices. We encourage you to review those policies before using their services.

07. How We Share Information

We may disclose personal information:

• To vendors and service providers that perform services for us
• To payment, booking, CRM, website, hosting, analytics, advertising, communications, and automation providers
• To GoHighLevel/HighLevel and its relevant subprocessors
• To agency clients where we are processing information on their behalf
• To professional advisors, insurers, accountants, attorneys, and auditors where appropriate
• To government authorities, courts, regulators, or law enforcement when legally required
• In connection with a merger, financing, acquisition, sale, restructuring, or other business transfer
• With your direction or consent
• To protect rights, safety, security, or property

We require vendors that process personal information on our behalf to use it only for authorized purposes and to maintain appropriate protections where required by law.

08. Artificial Intelligence

AriCléa may use AI-assisted tools for website development, copywriting, marketing strategy, transcription, summarization, business planning, workflow automation, research, design exploration, and other business functions.

We do not intentionally submit identifiable client health information or confidential agency-client information to public AI systems unless specifically authorized, contractually permitted, or otherwise lawful and appropriately safeguarded.

AI output may be reviewed by a human before publication or use. We do not rely solely on automated processing to make decisions about you that produce legal or similarly significant effects unless permitted by law and subject to applicable rights.

Agency clients are responsible for identifying any restricted data, regulated information, or contractual limitations that apply to their business. AriCléa may decline to process information through an AI-enabled feature where the risk or legal requirements make the use inappropriate.

09. User-Generated Content, Testimonials, and Media

If you submit content, your rights and our permitted uses are governed by the consent, release, agreement, or Terms and Conditions presented to you.

For client and student photographs, videos, testimonials, and likeness, we distinguish between service delivery, portfolio documentation, educational use, and promotional use. Where a separate release or consent is required, we will obtain it according to the applicable agreement.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including legal, tax, accounting, contractual, safety, dispute-resolution, and operational requirements.

Retention periods may vary by category:

• Client and service records: retained according to applicable professional, business, safety, tax, and legal requirements
• Transaction records: retained as required for tax, accounting, fraud-prevention, and legal purposes
• Agency client data: retained according to the agency agreement, client instructions, and applicable law
• Marketing suppression records: retained as needed to honor opt-out requests
• Application materials: generally retained only as long as reasonably necessary unless a longer period is required or authorized
• Analytics and advertising data: retained according to the applicable platform settings and our legitimate business needs, subject to applicable law

We may retain information that cannot lawfully be deleted because it is necessary to comply with law, establish or defend legal claims, prevent fraud, maintain suppression records, or complete an active transaction.

11. California Privacy Rights

California privacy law, including the California Consumer Privacy Act as amended, applies to businesses that meet its statutory applicability requirements. If the law applies to AriCléa for a particular processing activity, California residents may have rights that include:

• Right to know/access
• Right to delete, subject to exceptions
• Right to correct
• Right to opt out of sale or sharing
• Right to limit certain uses and disclosures of sensitive personal information
• Right to non-discrimination
• Additional rights that become applicable under California law

AriCléa does not sell personal information for money. However, certain advertising or cross-context behavioral advertising activities may constitute “sharing” under California law. Where applicable, you may opt out through our designated privacy mechanism or by contacting us.

Requests may be submitted to info@almaarthouse.co with the subject line “California Privacy Request.” We may need to verify your identity before completing a request. Authorized agents may submit requests as permitted by law.

We will not discriminate against a consumer for exercising applicable privacy rights.

12. Other U.S. State Privacy Rights

If you reside in another U.S. state with an applicable comprehensive consumer privacy law, we will handle rights requests according to the law applicable to the relevant processing activity. Depending on the state, rights may include access, correction, deletion, portability, opt-out of targeted advertising, opt-out of certain profiling, or appeal rights.

13. European Economic Area, United Kingdom, and Other International Users

If you are located in the EEA, UK, Switzerland, or another jurisdiction with a comprehensive privacy law, additional rights and obligations may apply where AriCléa offers goods or services to you, monitors behavior, or otherwise falls within the jurisdiction of that law.

Where applicable, AriCléa will identify a lawful basis for processing, provide required notices, honor applicable access/correction/deletion/objection/portability rights, use appropriate safeguards for international transfers, and provide required mechanisms for withdrawing consent.

Where consent is the legal basis, you may withdraw it at any time. Withdrawal does not affect processing already performed lawfully before withdrawal.

International users should understand that information may be processed in the United States and other countries where our vendors operate. Where required, we use appropriate transfer mechanisms and contractual safeguards.

14. Sensitive Information and Paramedical Services

AriCléa may receive sensitive personal information in connection with restorative or paramedical services. We limit access to personnel and vendors who need the information to perform authorized services, protect safety, administer the business, or comply with law.

Do not submit more medical or sensitive information than requested. Where a third-party medical provider, surgeon, insurer, or other professional is involved, separate privacy rules may apply to that provider.

AriCléa is not a hospital, medical practice, or insurer merely because it provides paramedical tattoo services. We do not represent that all of our services are subject to HIPAA. If AriCléa enters into a written Business Associate Agreement for a specific engagement, that agreement controls the applicable HIPAA obligations for that engagement.

15. Security

We use commercially reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information we process. These may include access controls, authentication, encryption in transit, secure vendor platforms, limited access, contractual controls, and security monitoring.

No system is completely secure. We cannot guarantee absolute security.

If a security incident occurs, we will provide notifications required by applicable federal, state, or international law.

16. Data Breaches

California and other jurisdictions impose specific requirements concerning certain data breaches. If we determine that a legally reportable breach has occurred, we will provide notices within the time and in the manner required by applicable law. Nothing in this Policy promises a particular notice deadline where the law provides a different standard.

17. Accessibility - ADA / WCAG

AriCléa is committed to digital accessibility and aims to make ariclea.co and our digital experiences substantially conform to WCAG 2.1 Level AA, using generally recognized accessibility practices.

Accessibility is an ongoing process. Some third-party content, embedded services, or platform interfaces may not be fully controlled by AriCléa.

If you encounter an accessibility barrier, contact info@almaarthouse.co with “Accessibility Request” in the subject line. We will make reasonable efforts to identify the barrier and provide the requested information or service through an accessible alternative where appropriate.

18. Third-Party Links and Embeds

Our Website and services may link to or embed third-party services including GoHighLevel/HighLevel, Square, Stripe, Kajabi, HoneyBook, Google, Meta, YouTube, Instagram, TikTok, Pinterest, Zoom, payment providers, scheduling platforms, and advertising platforms. Those providers maintain their own terms and privacy policies. AriCléa does not control their independent processing practices.

19. Children

Our services are intended for adults unless a specific service expressly states otherwise and applicable consent requirements are satisfied. We do not knowingly collect personal information from children in violation of applicable law.

20. Do Not Track and Global Privacy Control

Our Website may not respond to all browser Do Not Track signals. Where required by California law, we will treat a valid Global Privacy Control or comparable legally recognized opt-out signal as required by applicable law and our technical implementation.

21. Changes to This Policy

We may update this Policy to reflect changes in law, technology, services, vendors, or business practices. The updated version will be posted with a revised Last Updated date. Where legally required, we will provide additional notice or obtain consent.

22. Contact

AriCléa, DBA Alma Art House LLC
940 W Chapman Ave, Suite 202
Orange, CA 92868
Website: ariclea.co and aricleaagency.co
Email: info@almaarthouse.co
Phone: (714) 497-0106

For privacy requests, accessibility requests, data-rights requests, or opt-outs, contact us using the information above.

By using a digital property on which this Policy is posted or linked, you acknowledge that you have reviewed this Policy. Where applicable law requires affirmative consent, we will obtain that consent through the relevant form, checkbox, cookie banner, SMS opt-in, contract, or other mechanism.