Privacy Policy

This Privacy Policy describes how MAMITA’S LLC, doing business as Ipnosi Professional (“Ipnosi Professional,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information when you visit ipnosiprofessional.com/us and any related pages (the “Site”), create an account, apply for a professional account, place an order, subscribe to our communications, contact us, or otherwise interact with us. It also explains the privacy rights that may be available to you under applicable United States federal and state law, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the “CCPA”).

By using the Site, you acknowledge that you have read this Privacy Policy. If you do not agree with it, please do not use the Site. This Privacy Policy does not apply to information we collect offline or to the practices of third-party websites, services, or applications that the Site may link to.

1. Who We Are and How to Contact Us

The business responsible for your personal information is MAMITA’S LLC, doing business as Ipnosi Professional, 6130 West Flamingo Road, Suite 137, Las Vegas, Nevada 89103. We sell professional and retail hair color and hair care products online. Our orders are prepared and shipped from a fulfillment location in California.

You may contact us about this Privacy Policy or about your personal information at info@ipnosiprofessional.com or by telephone at +1 (866) 557-0304. Because we operate online, email is our primary method for receiving privacy requests. Registered customers can also request a copy of their data or the deletion of their account from the “Your data” section of the “My account” page.

2. Personal Information We Collect

Information you provide to us. When you create an account, apply for a professional account, place an order, use a contact or distributor form, or otherwise communicate with us, we collect: your name; email address; telephone number; password (which we store only in hashed, non-reversible form); business name, city, and country; shipping and billing addresses; the contents of your orders and your order history; the content of messages you send us; your choices about marketing emails, including the date and the version of the text you accepted; and, if you apply for a professional account, the type and number of your professional license, tax identification, or equivalent business document, a copy of that document, and any explanation you choose to add.

Payment information. Payments are processed by Stripe, Inc. (“Stripe”). When you pay by card or another payment method, you enter your payment details directly into Stripe’s secure payment fields. We do not receive or store your full card number, expiration date, or security code. We receive from Stripe a confirmation of payment, the last four digits and brand of your card, and related transaction identifiers.

Information collected automatically. When you use the Site, we and our service providers automatically collect your Internet Protocol (IP) address and the approximate location derived from it; browser type and version; device and operating system information; pages viewed, links clicked, and the date and time of your visits; the website that referred you; your selected market and language; and security information such as login attempts and request logs. This information is collected through cookies, server logs, and similar technologies described in Section 7.

Information from other sources. We receive information from our service providers about your order, such as payment confirmation and fraud-prevention signals from Stripe, delivery status and tracking events from our shipping providers, and sales tax calculations. If you contact us through a third-party platform, we receive the information you send us there.

Information we do not intentionally collect. We do not intentionally collect biometric information, precise geolocation, health information, or information about your race, religion, sexual orientation, or similar characteristics, and we ask that you do not include such information in messages or forms you send us. If you report an adverse reaction to one of our products, we collect the information you choose to give us about the reaction, as described in Section 13.

3. Notice at Collection: Categories of Personal Information, Purposes, and Retention

The following describes, for purposes of the CCPA, the categories of personal information we have collected in the preceding twelve months, the purposes for which each is collected and used, and how long we keep it. We do not sell personal information and we do not share it for cross-context behavioral advertising.

Identifiers (such as name, email address, postal address, telephone number, account name, IP address, and online identifiers). Used to create and manage accounts, process and deliver orders, communicate with you, secure the Site, prevent fraud, and comply with law. Retained for as long as your account is active and for up to seven years after your last order where needed for tax, accounting, and legal purposes; unverified customer accounts are deleted after seven days.

Customer records and commercial information (such as billing and shipping addresses, products purchased, order history, and payment confirmation details). Used to fulfill and support orders, calculate shipping and sales tax, handle returns and refunds, keep required business records, and resolve disputes. Retained for seven years after the transaction to satisfy tax and accounting obligations.

Internet or other electronic network activity and device information (such as pages viewed, browser and device type, and request and security logs). Used to operate and secure the Site, diagnose problems, detect abuse, and improve the Site. Retained in server and security logs for up to twelve months.

Approximate geolocation derived from your IP address. Used to select your market and language, detect fraud, and apply the correct shipping and tax rules. Retained with the corresponding logs for up to twelve months.

Professional or employment-related information (such as business name, professional license or tax identification type and number, copy of the verification document, and your stated professional activity). Used only to verify your eligibility for a professional account and to administer that account. Retained while your professional account is active and deleted within thirty days after you ask us to close the account, unless the law requires us to keep it.

Communications and marketing preferences (the content of your messages, and your email opt-in choice with its date and version). Used to respond to you, send the communications you requested, and keep a record of your consent. Messages are retained for up to three years; marketing preferences are retained until you withdraw consent and for a reasonable period afterward to honor your opt-out.

Sensitive personal information, as defined by the CCPA, consisting of your account log-in in combination with your password and, if you choose to submit it as a verification document, a government-issued identification number or document. We use this information only to provide and secure the services you request, to verify your eligibility for a professional account, and for the other purposes the CCPA permits without a right to limit. We do not use or disclose sensitive personal information to infer characteristics about you.

We do not collect inferences drawn to create a profile about you, and we do not use your personal information for automated decision-making. Each professional account application is reviewed by a person.

4. How We Use Personal Information

We use personal information to: create, authenticate, and manage your account; review and decide professional account applications; process payments, calculate shipping and sales tax, and prepare, ship, and deliver orders; provide customer support and respond to your inquiries; handle returns, refunds, and product quality or safety reports; send transactional and service messages such as email verification, order confirmations, shipping updates, and account notices; send news, offers, and product information if you have opted in; keep the Site, our systems, and your account secure and prevent fraud, spam, and abuse; operate, maintain, and improve the Site and our products and services; keep records required by law; comply with legal obligations and respond to lawful requests; and establish, exercise, or defend legal claims.

5. How We Disclose Personal Information

We disclose personal information to service providers and contractors that process it on our behalf under written agreements that restrict their use of the information to providing services to us. These include: Stripe, which processes payments, helps detect fraud, and, through Stripe Tax, calculates sales tax based on your shipping address; Envia.com (operated by Tendencys Innovations) and its technology provider, which provide shipping rate quotes, shipping labels, and tracking, and receive the information needed to ship your order, such as your name, shipping address, telephone number, and email address; the shipping carriers that deliver your order, such as the United States Postal Service, UPS, and FedEx; Cloudflare, Inc., which provides security, network, and bot-protection services, including the Turnstile verification tool used on our forms; Brevo, which delivers our transactional emails and, for people who opt in, our marketing emails; and cloud hosting and infrastructure providers that store and process the Site’s data.

We may also disclose personal information to our professional advisers, such as lawyers, accountants, and auditors; to government authorities, courts, and other third parties when we believe disclosure is required by law, subpoena, or legal process, or is necessary to protect the rights, property, or safety of Ipnosi Professional, our customers, or others; and to a buyer or other successor in a merger, acquisition, financing, reorganization, or sale of all or part of our business, in which case personal information will remain subject to this Privacy Policy unless you are notified of a change.

In the preceding twelve months we have disclosed for a business purpose the following categories of personal information: identifiers; customer records and commercial information; internet or other electronic network activity; approximate geolocation; professional or employment-related information (for professional account applicants only); and sensitive personal information consisting of account log-in credentials (stored only in hashed form).

6. We Do Not Sell or Share Personal Information

We do not sell your personal information for monetary or other valuable consideration, and we do not share your personal information with third parties for cross-context behavioral advertising or targeted advertising. We have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of anyone under 16 years of age. We do not use advertising cookies or third-party advertising trackers on the Site.

Because we do not sell or share personal information, there is no “Do Not Sell or Share My Personal Information” link on the Site. If our practices change, we will update this Privacy Policy, provide the notices and choices the law requires, and obtain consent where required before making any such disclosure.

7. Cookies and Similar Technologies; Do Not Track and Global Privacy Control

Cookies are small text files placed on your device. We use strictly necessary cookies that allow the Site to function, such as cookies that remember your selected market and language, keep your shopping cart and checkout session, keep you signed in, protect forms against abuse, and remember your cookie choice. We use functional cookies to remember preferences you set. Stripe sets cookies and uses similar technologies on pages that include its payment fields in order to process payments and detect fraud. Cloudflare may set cookies as part of its security and bot-protection services. You can find additional details in our Cookie Policy.

Most browsers let you refuse or delete cookies through their settings. If you block strictly necessary cookies, parts of the Site, including the cart, checkout, and account areas, may not work. Where we process opt-out preference signals, such as the Global Privacy Control, we treat a valid signal as a request to opt out of the sale or sharing of personal information for that browser and, where we can associate it with an account, for that account. Because there is no uniform standard for “Do Not Track” browser signals, the Site does not currently respond to them; however, as stated in Section 6, we do not track you across other websites for advertising.

8. Email Communications

We send marketing emails only to people who have opted in. The marketing option is never selected for you, and creating an account does not depend on it. When you opt in, we record the date and the version of the text you accepted. Every marketing email includes a working unsubscribe link and our postal address, and we honor unsubscribe requests within ten business days, as required by the CAN-SPAM Act. You may also withdraw your consent at any time by writing to info@ipnosiprofessional.com. Withdrawing consent does not affect the lawfulness of messages sent before withdrawal.

We send transactional messages, such as email verification, order confirmations, shipping notices, receipts, security alerts, and responses to your requests, regardless of your marketing preferences, because they are necessary to provide the services you requested. We do not send text messages and do not collect mobile numbers for marketing.

9. Professional Account Verification

Some of our products are sold only to approved professional accounts. To apply, you provide business information and a document that demonstrates your professional status, such as a cosmetology or barber license, a business license, a sales tax or resale certificate, or an equivalent document. Each application is reviewed by authorized members of our team, not by automated means. Verification documents are stored in a private location that is not accessible from the public internet, are visible only to the team members who review applications, and are used solely to verify your professional status and administer your account. You may submit an updated document or message if your application is not approved, and you may ask us to close your account and delete your documents at any time, subject to the retention periods described in Section 14.

10. Your Privacy Rights

Depending on the state in which you live, you may have some or all of the following rights with respect to your personal information, subject to the exceptions and limitations in applicable law: the right to know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we disclose it; the right to delete personal information we have collected from you; the right to correct inaccurate personal information; the right to obtain a copy of your personal information in a portable and, where technically feasible, readily usable format; the right to opt out of the sale or sharing of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; the right to limit the use and disclosure of sensitive personal information; the right to be free from discrimination for exercising your rights; and the right to appeal a decision on your request.

These rights are provided by the CCPA to California residents and by comprehensive consumer privacy laws in other states, including, as they take effect, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. We extend the rights described in this Section to all individuals in the United States, to the extent they apply to our practices, regardless of state of residence. We do not sell or share personal information and do not engage in targeted advertising or profiling that produces legal or similarly significant effects, so the corresponding opt-out rights are not currently needed.

We will not discriminate against you for exercising any of these rights. We will not deny you goods or services, charge you different prices or rates, provide a different level or quality of goods or services, or suggest that you may receive a different price or quality, because you exercised a privacy right. We do not offer financial incentives in exchange for personal information.

Nevada residents may opt out of the sale of certain covered information under Nevada Revised Statutes Chapter 603A. We do not sell covered information; you may nevertheless submit a request to info@ipnosiprofessional.com with the subject “Nevada Opt-Out Request.”

11. How to Submit a Request; Verification; Authorized Agents; Appeals

To exercise a right, email info@ipnosiprofessional.com with the subject “Privacy Request” and tell us which right you wish to exercise. If you have an account and are signed in, you may also request a copy of your data or the deletion of your account and data from the “Your data” section of the “My account” page; we will send a confirmation email to the address on the account to complete the request.

We must verify your identity before we fulfill a request to know, access, correct, delete, or port personal information. We will ask you for information that lets us match you to our records, such as confirming the email address on the account or the details of a recent order, and we may ask you to respond from the email address associated with the account. We will use the information you provide only to verify your identity and process your request. We cannot fulfill a request if we cannot verify that you are the person about whom we collected the information, or an authorized representative of that person.

You may designate an authorized agent to submit a request on your behalf. We may require a written authorization signed by you, or a valid power of attorney, and may ask you to verify your own identity directly with us.

We will confirm receipt of your request within ten business days and will respond within forty-five days of receiving it. If we reasonably need more time, we may extend the response period once by an additional forty-five days, and we will tell you the reason and the length of the extension. A request to know or access covers the twelve-month period preceding the request unless you ask for a longer period for information collected on or after January 1, 2022. We provide the information free of charge; if a request is manifestly unfounded or excessive, or is repetitive, we may charge a reasonable fee or decline to act, and we will explain why.

We may deny a request, in whole or in part, where the law permits, for example where the information is necessary to complete a transaction, to detect security incidents, to comply with a legal obligation such as tax record keeping, or to establish or defend legal claims. If we deny a request, we will tell you why. You may appeal our decision by replying to our response, or by emailing info@ipnosiprofessional.com with the subject “Privacy Appeal,” within sixty days of receiving it. We will respond in writing within forty-five days, and, where your state’s law requires, we will tell you how to submit a complaint to your state attorney general.

12. Additional Disclosures for California Residents

Right to Know, Delete, Correct, and Limit. California residents have the rights described in Sections 10 and 11. We use and disclose sensitive personal information only for the purposes permitted by the CCPA and its regulations that do not give rise to a right to limit, so we do not offer a “Limit the Use of My Sensitive Personal Information” link.

Shine the Light. California Civil Code Section 1798.83 permits California residents to request information about the categories of personal information that a business has disclosed to third parties for those third parties’ direct marketing purposes during the preceding calendar year. We do not disclose personal information to third parties for their direct marketing purposes.

Minors. Our Site is not directed to minors, and we do not knowingly collect personal information from anyone under 16. California residents under 18 who are registered users may request removal of content they have publicly posted; the Site does not provide a means to post public content.

California Online Privacy Protection Act. This Privacy Policy identifies the categories of personally identifiable information we collect through the Site and the categories of third parties with whom we disclose it, explains how you can review and request changes to your information, and describes how we notify you of changes to this Privacy Policy. Our response to “Do Not Track” signals is described in Section 7.

California Civil Code Section 1798.100 notice at collection. Sections 2 through 4 of this Privacy Policy constitute our notice at collection, and Section 6 states that we do not sell or share personal information.

13. Product Safety Reports and Adverse Events

If you contact us to report an adverse reaction, injury, or other product complaint, we will collect the information you give us, such as your name and contact details, the product and lot number, a description of the reaction and its treatment, and any photographs you choose to provide. We use this information to investigate the report, to respond to you, to improve product safety, and to meet our obligations under the Federal Food, Drug, and Cosmetic Act, as amended by the Modernization of Cosmetics Regulation Act of 2022, including the duty to keep records of adverse event reports and, for serious adverse events, to report them to the U.S. Food and Drug Administration. We keep these records for the period the law requires, which is at least six years for most businesses and at least three years for qualifying small businesses, and we may disclose the report, with personal identifiers removed where permitted, to the Food and Drug Administration and other regulators.

14. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to satisfy legal, tax, accounting, and reporting requirements, to resolve disputes, and to enforce our agreements. The retention periods in Section 3 are the maximum periods we apply, unless a longer period is required by law or needed to establish, exercise, or defend legal claims, or unless you ask us to delete the information sooner and no exception applies. When we no longer need personal information, we delete it or de-identify it so that it can no longer reasonably be linked to you.

15. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encrypted connections (HTTPS), hashing of passwords, restricted and logged access to verification documents, rate limiting and lockout of repeated failed sign-in attempts, bot protection on forms, two-step verification for team members who can access applications, and the use of payment processors that are certified under the Payment Card Industry Data Security Standard. No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and the relevant authorities as required by applicable law.

16. Children’s Privacy

The Site is intended for adults and for professionals and is not directed to children. We do not knowingly collect personal information from children under 13 in violation of the Children’s Online Privacy Protection Act, or from anyone under 16 without verifiable parental consent. If you believe that a child has provided us with personal information, please contact us at info@ipnosiprofessional.com and we will delete it.

17. Where Information Is Processed

We and our service providers process personal information in the United States and may process it in other countries, including countries in which our service providers or their personnel are located. Where we transfer personal information across borders, we require our service providers to protect it with safeguards consistent with this Privacy Policy and applicable law.

18. Third-Party Websites and Services

The Site may contain links to third-party websites and services, such as carrier tracking pages, social media pages, and payment pages hosted by Stripe. We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy policies before providing personal information to them.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or the law. We will post the updated version on this page with a new “last updated” date. If we make a material change that affects how we use or disclose personal information we have already collected, we will notify you by email or by a prominent notice on the Site before the change takes effect, and we will obtain your consent where the law requires it.

20. Contact Us

MAMITA’S LLC, doing business as Ipnosi Professional, 6130 West Flamingo Road, Suite 137, Las Vegas, Nevada 89103. Email: info@ipnosiprofessional.com. Telephone: +1 (866) 557-0304.