Privacy Policy | Yoja Hair Lounge

1. Introduction

Yoja Hair Lounge (“Yoja Hair Lounge,” “the Salon,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what personal information we collect, how we use and share it, how we protect it, and what choices and rights you have.

This policy applies to our website (yojahairlounge.com), our online booking through Square, our social media pages, and our in-person and telephone services at:

📍 Trenton — 1000 S Clinton Ave, Trenton, NJ 08611
📍 Hamilton — 1450 S Olden Ave, Hamilton Township, NJ 08610
📍 Yoja Brows (permanent makeup and brow services), operated within our Hamilton location

By using our website, booking an appointment, or receiving our services, you acknowledge that you have read this policy. If you do not agree with it, please do not use our website or services.

2. Information We Collect

Information you give us

Contact details: name, phone number, and email address, when you book online, call, text, or message us.
Appointment details: the services you request, your preferred stylist and location, appointment dates and times, and your booking, cancellation, and no-show history.
Service and health-related information: hair and skin history, allergies, sensitivities, medications, skin conditions, pregnancy or nursing status, and previous chemical or cosmetic treatments that you share during a consultation. This is especially relevant for color, keratin, and permanent makeup and brow procedures.
Payment information: card details and transaction records. Card details are entered directly into our payment processor, Square. We do not store full card numbers.
Photos and videos: images of your results, taken with your consent (see Section 6).
Communications: messages, reviews, and feedback you send us by phone, text, email, or social media.

Information collected automatically

When you visit our website, our hosting provider (Vercel) and, when you book, Square may automatically receive technical data such as your IP address, browser type, device type, operating system, pages viewed, referring page, and date and time of access. This data is used to deliver the site, keep it secure, and diagnose problems.
Our website stores one small item in your browser session (a note that you have already seen the location-selection window). It is deleted when you close your browser. We do not use advertising or tracking cookies, and we do not run third-party analytics on this website at the time of this policy.
Third-party services linked from our site, such as Square, Google Maps, and Instagram, may set their own cookies or collect their own data under their own policies.

Information we do not collect

We do not knowingly collect Social Security numbers, government ID numbers, biometric identifiers, or precise geolocation data through this website.

3. How We Use Your Information

To schedule, confirm, change, and manage your appointments.
To provide and personalize our services safely, including avoiding products or procedures that could cause an adverse reaction.
To process payments, deposits, cancellation fees, and refunds.
To send appointment confirmations, reminders, and service-related messages.
To respond to your questions, requests, and feedback.
To send promotions or news, only where you have opted in (see Section 8).
To publish photos of our work on our website and social media, only with your consent (see Section 6).
To keep our website, systems, and premises secure, and to prevent fraud and abuse.
To comply with legal, tax, health, safety, and licensing obligations, and to establish or defend legal claims.

4. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only in these limited situations:

Service providers. Companies that act on our behalf and only under our instructions, including Square (online booking, appointment reminders, client records, and payment processing), Vercel (website hosting), and telephone, email, and messaging providers. These providers may use your information only to perform services for us.
Our staff. Stylists and technicians who need your information to serve you.
Legal and safety reasons. When required by law, subpoena, court order, or government request, or when needed to protect the rights, property, or safety of the Salon, our clients, our staff, or others.
Business transfers. If the Salon is sold, merged, or reorganized, client information may be transferred to the successor, which must honor this policy.
With your consent or at your direction. For example, when you ask us to share information with someone or agree to appear in our photos.

We may also share information that has been de-identified or aggregated so that it can no longer reasonably be linked to you.

5. Payments and Square

Online bookings, deposits, and card payments are handled by Square, Inc. Square collects and processes the information you enter under its own privacy policy, available at squareup.com/legal/privacy. Square is responsible for meeting the Payment Card Industry Data Security Standard (PCI DSS) for card data it processes. Please review Square's policy before booking.

6. Photos, Video, and Social Media

We may photograph or film your results for our website, Instagram, and other marketing, as described in our Terms & Conditions.
You may opt out at any time, including at the start of your appointment, and we will not use images of you. You may also ask us to remove images we have already posted; we will do so within a reasonable time, though we cannot control copies already shared by others.
We will not publish your name, or images showing your face, without your permission.
Anything you post publicly on social media, such as tagging us or leaving a review, is visible to others under that platform's policies.

7. Health-Related Information

Information you share about allergies, skin conditions, medications, and similar matters is used only to deliver services safely. We treat it as sensitive, limit access to the staff who need it, and do not use it for marketing. The Salon is not a healthcare provider and is not a “covered entity” under the federal Health Insurance Portability and Accountability Act (HIPAA), so HIPAA does not govern this information. It is protected by this policy and by applicable New Jersey law. Providing health information is voluntary, but we may be unable to safely perform certain services without it.

8. Text Messages, Calls, and Email

Service messages. When you book, you may receive appointment confirmations, reminders, and updates by text or email. These are sent through Square.
Marketing messages. We send promotional texts or emails only with your prior express consent, as required by the federal Telephone Consumer Protection Act (TCPA) and the CAN-SPAM Act. Consent to marketing is never a condition of purchasing services.
Opting out. Reply STOP to any text to stop messages, and use the unsubscribe link in any marketing email. Message and data rates may apply. You may also call us to opt out.
We do not share phone numbers or opt-in consent with third parties for their own marketing.

9. Cookies and “Do Not Track”

Our website uses only the minimal browser storage described in Section 2. Because we do not track visitors across other websites, we do not respond differently to browser “Do Not Track” signals. We do honor opt-out preference signals such as the Global Privacy Control, in the sense that we do not sell or share your data for advertising in the first place. You can clear or block cookies and site storage in your browser settings; the website will still work.

10. How Long We Keep Information

We keep personal information only as long as needed for the purposes in this policy, including to provide services, resolve disputes, and meet legal, tax, and recordkeeping requirements. Appointment, payment, and client-profile records are generally kept for as long as your client profile remains active and for up to seven (7) years afterward for tax and legal reasons, unless the law requires longer or you ask us to delete records that we are not required to keep. Records related to permanent makeup procedures may be kept longer where required by New Jersey or local health and safety rules.

11. Data Security

We use reasonable administrative, technical, and physical safeguards appropriate to the nature of the information, including encrypted connections (HTTPS) on our website, access controls on our booking system, and reliance on PCI-compliant payment processing. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a security breach affects your personal information, we will notify you and the appropriate authorities as required by law, including the New Jersey Identity Theft Prevention Act (N.J.S.A. 56:8-161 to 56:8-166), which requires disclosure to affected New Jersey residents and reporting to the New Jersey State Police in advance of that disclosure.

12. Your Privacy Rights

All clients

Whatever state you live in, you may contact us to ask what personal information we hold about you, to correct it, to ask us to delete it, or to opt out of marketing. We will respond within a reasonable time and in any event within the time required by law.

New Jersey residents

The New Jersey Data Privacy Act (N.J.S.A. 56:8-166.4 et seq., effective January 15, 2025) gives New Jersey residents rights over their personal data, but it applies only to businesses that meet certain size and data-volume thresholds. Yoja Hair Lounge is a small local business and may not currently meet those thresholds. Even so, we choose to honor the following rights for New Jersey residents:

Right to know and access the personal data we hold about you and, where feasible, to receive a copy.
Right to correct inaccurate personal data.
Right to delete personal data we hold about you, subject to legal and recordkeeping exceptions.
Right to opt out of the sale of personal data, targeted advertising, and profiling in furtherance of decisions with legal or similarly significant effects. We do none of these things.
Right to non-discrimination. We will not deny you services or charge different prices because you exercised a privacy right.

New Jersey law also requires that businesses obtain consent before processing “sensitive data,” which includes certain health information. We collect health-related details only when you choose to provide them for your service, as described in Section 7.

Residents of other states

Residents of California and other states with comprehensive privacy laws may have similar rights. We extend the rights above to any client who asks. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

How to make a request

To exercise a right, call or visit either salon (contact details in Section 17). For your protection, we may need to verify your identity, for example by confirming details on your booking record, before acting on a request. You may use an authorized agent, who must provide written proof of authority. If we deny a request, we will explain why and tell you how to appeal by contacting us again; if you remain unsatisfied, you may contact the New Jersey Division of Consumer Affairs or the Attorney General's Office (see Section 15).

13. Children's Privacy

Our website and online booking are not directed to children under 13, and we do not knowingly collect personal information online from children under 13, in line with the federal Children's Online Privacy Protection Act (COPPA). Minors receiving in-salon services must be accompanied or authorized by a parent or legal guardian, who provides information on the minor's behalf. Permanent makeup and brow procedures are available only to clients who meet the legal minimum age in New Jersey. If you believe a child has given us personal information online, contact us and we will delete it.

14. Third-Party Links

Our website links to third-party services, including Square, Google Maps, and Instagram. We do not control and are not responsible for their content or privacy practices. Please read their privacy policies before providing them with information.

15. Laws That Apply to This Policy

This Privacy Policy is governed by the laws of the State of New Jersey and applicable United States federal law. The laws that inform our practices include, among others:

Federal Trade Commission Act, Section 5 (15 U.S.C. § 45), which prohibits unfair or deceptive practices, including failing to honor privacy promises.
CAN-SPAM Act (15 U.S.C. § 7701 et seq.), governing commercial email.
Telephone Consumer Protection Act (47 U.S.C. § 227), governing calls and text messages.
Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506).
Fair and Accurate Credit Transactions Act (FACTA), which requires truncating card numbers on receipts.
New Jersey Data Privacy Act (N.J.S.A. 56:8-166.4 et seq.).
New Jersey Identity Theft Prevention Act (N.J.S.A. 56:8-161 to 56:8-166), including breach notification.
New Jersey Consumer Fraud Act (N.J.S.A. 56:8-1 et seq.).
New Jersey Truth-in-Consumer Contract, Warranty and Notice Act (N.J.S.A. 56:12-14 et seq.).

You may also contact regulators directly: the Federal Trade Commission or the New Jersey Division of Consumer Affairs (Office of the Attorney General).

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or the law. The “Last updated” date at the top shows the most recent revision. If we make a material change, we will post a notice on this page. Your continued use of our website or services after an update means you accept the revised policy.

17. Contact Us

For questions about this policy or to exercise any privacy right, please contact us:

📞 Trenton: (609) 396-0606
📞 Hamilton: (609) 960-5599
📞 Yoja Brows: (640) 999-1236
📍 Trenton — 1000 S Clinton Ave, Trenton, NJ 08611
📍 Hamilton — 1450 S Olden Ave, Hamilton Township, NJ 08610