Privacy Policy

Last updated: 2026-04-25

Annette Brow Studio ("we", "us", "our") operates annettebrowstudio.ca (the "Site") and provides eyebrow and eyelash services from our studio in Calgary, Alberta. This policy explains what personal information we collect, how we use it, who we share it with, and your rights under Canadian privacy law (PIPEDA — the Personal Information Protection and Electronic Documents Act).

If you do not agree with this policy, please do not use the Site or book appointments with us.

1. What we collect

When you book an appointment with us through Square Appointments, we collect:

- Your name

- Your email address

- Your phone number

- The service(s) you book and the appointment date and time

- Any notes you add to the booking

- Payment information you enter at booking (processed and stored by Square — we do not store full card numbers)

When you visit annettebrowstudio.ca, we and our service providers collect:

- Standard web analytics (pages visited, time spent, browser type, approximate location)

- Cookies and similar identifiers

- If you arrived from a Google Ads advertisement, the Google Click Identifier ("GCLID") associated with that click. The GCLID is a Google-issued anonymous identifier that allows us to attribute a booking back to the specific advertisement that brought you to our Site. It does not contain personally identifying information on its own.

2. Why we collect it and how we use it

We use this information to:

- Confirm, schedule, and deliver the services you booked

- Contact you about your appointment (reminders, changes, follow-up)

- Process payment for the services

- Understand which marketing efforts result in actual bookings, so we can spend our advertising budget responsibly and show our advertisements to people who are likely to find them useful

- Comply with our legal and tax obligations

We do not sell your personal information.

3. Who we share it with — third-party service providers

We share specific, limited information with the following providers strictly for the purposes described:

Square (Block, Inc.)

We use Square Appointments to manage bookings and Square to process payment. Square receives all booking and payment information you provide. Square's privacy policy: https://squareup.com/legal/privacy

Google Ads (Google LLC)

When you book an appointment after arriving from one of our Google Ads advertisements, we send the following to Google Ads to confirm that the advertisement led to a real booking:

- The GCLID associated with your original click

- The fact that a booking occurred and the date/time it occurred

- A one-way cryptographic hash (SHA-256) of your email address and, where available, a hash of your phone number, normalized per Google's published specification

Google uses this to confirm the conversion to its advertising algorithms and improve ad relevance for future visitors. The hashes are not reversible: Google cannot recover your email address or phone number from the hash. Google's data handling practices for advertiser-supplied data are described at https://privacy.google.com/businesses/adsservices/

We do not send your name, your service, the contents of your booking notes, your payment information, or your appointment time to Google Ads.

4. Where your information is stored

- Booking and payment data: stored by Square (United States and global infrastructure as described in Square's privacy policy)

- Web analytics, GCLID, and conversion data: stored by Google (United States and global Google Cloud infrastructure)

By providing your information, you consent to it being processed in those jurisdictions, which may have different data-protection standards than Canada.

5. How long we keep it

- Booking records: 24 months from the appointment date, then deleted (matches Alberta business-records retention norms)

- Web analytics + GCLID + conversion logs in our internal system: 120 days, then deleted

- Hashed identifiers sent to Google Ads: governed by Google's retention policies (currently 540 days for conversion-attribution use)

- Square retains data per its own retention policies

You may request earlier deletion at any time using the contact information below.

6. Your rights

Under PIPEDA you have the right to:

- Access the personal information we hold about you

- Correct information you believe is inaccurate

- Withdraw consent at any time (this may mean we cannot deliver some services)

- Request deletion of your information, subject to legal record-keeping requirements

- Complain to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/) if you believe we have not handled your information appropriately

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

7. Security

We protect personal information using industry-standard practices including encrypted transmission (HTTPS/TLS), encrypted storage of sensitive identifiers (AES-256-GCM), access controls, and audit logging. No system is completely secure; if we ever become aware of a breach affecting your information, we will notify you and the Privacy Commissioner promptly as required by law.

8. Cookies

annettebrowstudio.ca uses cookies for site functionality (Squarespace), analytics (Google Tag Manager / Google Analytics), and to remember the GCLID associated with your visit. You can clear cookies in your browser at any time. Disabling cookies may affect the booking experience.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be announced on the Site.

10. Contact

For privacy questions, requests, or complaints:

Annette Brow Studio

Privacy Inquiries

508 24 Ave SW #342, Calgary, AB T2S 0K4, Canada

Email: annettebrowstudio@gmail.com