GlamOps Privacy Policy

Effective date: October 9, 2026 Last updated: October 28, 2026

1. About this policy

1.1. This Privacy Policy explains how GlamOps LLC ("GlamOps," "we," "us," or "our") collects, uses, shares and protects personal information when you use glamops.net, the GlamOps web app, Booking Sites and Client Portals hosted by GlamOps, our mobile apps (when available), and our emails and text messages (together, the "Services").

1.2. GlamOps is an Oregon limited liability company. Our mailing address is GlamOps LLC, 11918 SE Division Street #2046, Portland, OR 97266. You can reach us about privacy at admin@glamops.net.

1.3. GlamOps is offered only in the United States, and we store the data we hold in the United States.

1.4. Some words we use. "Business," "Client," "Team Member," "Account Owner," "Booking Site," "Client Portal," "Customer Data," "Aggregated Data," "Platform" and "Services" have the meanings in our Terms of Service at https://glamops.net/legal/terms. In short:

• "Business" means the business entity or sole proprietor (for example, an esthetician) that signs up for the Services and accepts our Terms of Service. Where the context requires, it includes the Business's Team Members acting on its behalf.
• "Client" means any individual who books with, buys from, signs a form for, receives messages from, or otherwise interacts with a Business through the Services. Clients are customers of the Business, not of GlamOps.
• "Team Member" means an individual the Business invites to use its account, in any role (for example owner, manager or staff).
• "Visitor" means anyone who visits glamops.net or our help pages without signing in.
• "Personal information" means information that identifies, relates to, or could reasonably be linked to a particular person or household. Some state laws call this "personal data."

1.5. We also publish:

• our Consumer Health Data Privacy Policy at https://glamops.net/legal/health-data-privacy, which covers health-related information on intake and consent forms;
• our Cookie & Tracking Notice at https://glamops.net/legal/cookies;
• our Subprocessor List at https://glamops.net/legal/subprocessors; and
• our Terms of Service at https://glamops.net/legal/terms and Data Processing Addendum at https://glamops.net/legal/dpa, which govern our relationship with Businesses.

2. Our two roles

GlamOps handles personal information in two different roles. Which role applies affects who makes decisions about the information and whom you should contact.

2.1. When GlamOps decides how information is used ("controller" or "business")

GlamOps decides why and how personal information is used, and is responsible for it, when it comes to:

• Business account holders: owners and Team Members who sign up for and use GlamOps, including billing, support and account security information;
• Visitors to glamops.net and our help pages;
• GlamOps's own marketing, such as our newsletter, product updates and trial emails sent to Businesses and prospects; and
• information we need to run, secure and improve the Services as a whole (for example, security logs and aggregated, de-identified usage statistics).

2.2. When GlamOps works on behalf of a Business ("processor" or "service provider")

Each Business decides what information it collects about its Clients and how that information is used. GlamOps processes Client information on behalf of and under the instructions of the Business, under our Terms of Service and Data Processing Addendum. This includes Client names and contact details, appointment history, notes, intake and consent forms, photos, payment records, email and text consent records, Client Portal sign-in information, and booking-site visit analytics.

If you are a Client, the Business you booked with is responsible for your information, and its own privacy notice applies. This policy explains what GlamOps does with that information when acting for the Business. If you want to see, correct or delete your information, or you have a question about how a Business uses it, please contact the Business first. See Section 18.6.

GlamOps does not use Client information for its own purposes, such as its own marketing, building profiles of Clients across Businesses, or training AI models. We use it only to provide the Services to the Business and for the limited operational purposes described in Section 5.3.

3. Information we collect

3.1. Business account holders

3.2. Visitors to glamops.net

• Information you choose to give us, such as your name and email when you join a waitlist, request a demo, contact us or subscribe to our newsletter.
• Device and usage information, such as IP address, browser type, referring page, pages viewed and approximate location derived from IP address (city or region level, not precise location).
• Information from essential cookies and similar technologies. See Section 10 and our Cookie & Tracking Notice.

3.3. Clients (information we process on behalf of Businesses)

When a Business uses GlamOps, we process the following about its Clients, as directed by the Business:

Health-related information on intake forms is also covered by our Consumer Health Data Privacy Policy at https://glamops.net/legal/health-data-privacy.

3.4. Mobile apps (planned)

If you use a GlamOps mobile app, we may also collect or use:

• Push-notification token: a device identifier used to send you notifications you have turned on, such as new bookings or cancellations.
• Camera and photo library: only when you choose to take or upload a photo (for example, a before-and-after photo or a business logo). The app asks for permission first, and you can change this in your device settings.
• Face ID, Touch ID or Android biometric unlock: if you turn this on, your device checks your face or fingerprint. Your biometric data stays on your device. GlamOps never receives, sees or stores it. We receive only a yes-or-no result from your device's operating system.
• Device and diagnostic information: app version, device model, operating system version, and crash reports.

The mobile apps do not track you across other companies' apps or websites, and do not use advertising identifiers for tracking.

3.5. Sources of information

We collect information:

• directly from you, when you create an account, fill in forms, upload content or contact us;
• from Businesses, about their Team Members and Clients (for example, when a Business adds or imports a client list);
• from Clients, when they book, fill in intake forms, reply to texts or sign in to a Client Portal powered by GlamOps;
• automatically, from your browser or device when you use the Services; and
• from service providers, such as Stripe (payment and payout status), Twilio (message delivery status and replies, once text messaging launches) and Resend (email delivery, bounce and unsubscribe events).

4. How we use information (as controller)

We use information about Business account holders and Visitors to:

1. Provide the Services: create and manage accounts, host Booking Sites, process bookings, send appointment confirmations and reminders, and run the features the Business uses.
2. Process subscriptions and payments: bill for GlamOps plans and support Stripe-powered payments to Businesses.
3. Register text-messaging numbers: submit Business details to our text-message provider and mobile carriers so the Business can send texts.
4. Provide support: answer questions and fix problems.
5. Keep the Services secure: verify sign-ins, prevent fraud, spam and abuse (including rate limits on public forms), enforce our Terms and Acceptable Use Policy, and investigate security incidents.
6. Improve the Services: understand which features are used, fix bugs and plan new features, mostly using aggregated or de-identified information.
7. Communicate with you: send service and account messages (such as security alerts, billing notices and changes to our terms), and, if you have opted in, product news and marketing emails about GlamOps.
8. Comply with law and protect rights: meet legal, tax and accounting obligations, respond to lawful requests, and establish or defend legal claims.

We do not use personal information for targeted advertising, and we do not sell it. See Section 8.

5. How we use Client information (as processor)

5.1. We use Client information only to provide the Services to the Business that the information belongs to, following that Business's instructions and our Data Processing Addendum. For example, we use it to show the Business its calendar and client records, send the Business's confirmations, reminders and campaigns, process payments through Stripe, collect intake forms, run the Client Portal, show booking-site analytics to the Business, and, if the Business turns it on, answer questions from the Business's owners and managers through Concierge (Section 7).

5.2. We do not:

• sell Client information or share it for targeted advertising;
• use it to market GlamOps or anyone else to Clients;
• combine it across different Businesses to build profiles of Clients;
• use it, or allow our AI provider to use it, to train AI models; or
• send texts or marketing emails to Clients on our own behalf.

5.3. We may also use Client information, as service-provider laws allow, to keep the Services secure and working (for example, to detect fraud and abuse, fix errors, keep backups and maintain message-consent records), to comply with law, and to create aggregated or de-identified information that cannot reasonably be linked to any person, which we will not attempt to re-identify. We create aggregated or de-identified information only to run and improve the Services, never from intake or health form information, and never for marketing.

6. Legal basis and consent

6.1. US privacy laws do not generally require a "legal basis" in the way some other countries do. In plain terms, we use personal information because:

• it is necessary to provide the Services you or your Business asked for;
• we have a legitimate business need, such as security, fraud prevention and improving the Services;
• the law requires it; or
• you have given consent, where consent is required.

6.2. We ask for opt-in consent before:

• sending you GlamOps marketing emails, marketing texts or marketing push notifications;
• sending information to our AI provider through Concierge (Section 7);
• using your device's camera, photo library, notifications or biometric unlock in our apps; and
• any other use of sensitive information that the law requires consent for.

6.3. For Client information, the Business is responsible for giving Clients any required notices and obtaining any required consents, including consent for text messages and, where required, separate consent to collect and share health-related information on intake forms. GlamOps provides tools to help, such as consent checkboxes, double opt-in for texts, and consent records.

6.4. Withdrawing consent. You can withdraw consent at any time, for example by replying STOP to texts, clicking "unsubscribe" in emails, turning off Concierge or notifications in settings, or contacting us. Withdrawing consent does not affect anything we did before you withdrew it.

7. AI features (Concierge)

7.1. What it does. Concierge is an optional assistant inside GlamOps that helps Business owners and managers get answers about their own business, such as "Who hasn't booked in 90 days?" or "What were my busiest days last month?" It is read-only: it does not change records, send messages or make decisions about Clients.

7.2. Who provides it. Concierge is powered by Anthropic, PBC, through Anthropic's commercial API.

7.3. What is sent. When an owner or manager asks a question, GlamOps sends Anthropic the question and the records relevant to answering it, which may include Client names, appointment history, notes and payment records. Concierge does not send intake or health form answers or Client photos to Anthropic. Intake and health form answers are permanently excluded from Concierge.

7.4. Consent first. Concierge is available only to a Business's owners and managers. It is off until the Account Owner turns it on for the Business. Before each owner's or manager's first use, that user sees a screen explaining that information will be sent to Anthropic and must choose to allow it. Concierge can be turned off at any time in Settings.

7.5. How Anthropic handles it. Under Anthropic's commercial terms, Anthropic does not train its models on this data. Anthropic deletes API inputs and outputs within 30 days by default, except that content flagged for violating Anthropic's usage policies may be kept longer (up to 2 years) for safety review.

7.6. What GlamOps keeps. GlamOps does not store Concierge questions or answers. We keep only a monthly count of questions asked, to apply the limit of 100 questions per month.

7.7. Limits. AI answers can be wrong. Businesses should check important answers against their records. Concierge is designed not to diagnose skin conditions, recommend medical treatment, or interpret health information on intake forms.

7.8. No automated decisions. GlamOps does not use AI or other automated processing to make decisions that produce legal or similarly significant effects about anyone.

8. We do not sell or "share" personal information

8.1. GlamOps does not sell personal information, and has not sold it in the past 12 months.

8.2. GlamOps does not "share" personal information for cross-context behavioral advertising (the California term) or process it for targeted advertising (the term used in Oregon and other states), and has not done so in the past 12 months.

8.3. We do not sell, or use for targeted advertising or profiling, the personal information of anyone we know to be under 16.

8.4. We do not sell precise geolocation data, and we do not collect it. We do not use geofencing.

8.5. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share" link. If this ever changes, we will update this policy first and give you a way to opt out.

9. Global Privacy Control and Do Not Track

9.1. Global Privacy Control (GPC). We honor GPC signals. If your browser or extension sends a GPC signal, we treat it as a request to opt out of the sale of your personal information and its use for targeted advertising, for that browser or device and, if you are signed in, for your account. Because we already do not sell or share personal information, honoring GPC does not change how the Services works for you.

9.2. Do Not Track. Some browsers send a "Do Not Track" signal. There is no common standard for how websites should respond to it. GlamOps does not track Visitors or users across other companies' websites over time, and does not allow third parties to do so on our sites, so Do Not Track signals do not change our practices.

10. Cookies and similar technologies

10.1. We use only a small number of essential cookies and similar technologies (such as local storage) that are needed to sign you in, remember which business you are working in, keep the Services secure, and remember your light or dark appearance preference. We also use first-party, cookieless analytics to understand how glamops.net and Booking Sites are used. These analytics do not store an identifier in your browser and are not shared with advertising networks.

10.2. We do not use advertising cookies, third-party analytics cookies or cross-site tracking, and we do not allow third-party advertising pixels on Booking Sites or intake forms.

10.3. Our payment provider, Stripe, may set its own cookies on payment pages to prevent fraud. Our bot-check provider, Cloudflare Turnstile, processes device and browser information on sign-up, sign-in, booking and other public forms to tell people from bots.

10.4. See our Cookie & Tracking Notice at https://glamops.net/legal/cookies for details and how to control cookies.

11. How we share information

We share personal information only as described below.

11.1. Service providers (subprocessors)

We use carefully selected companies to help run the Services. They may process personal information only to provide services to us, under written contracts that require them to protect it and use it only as we instruct. Categories include:

We do not use any error-monitoring or third-party analytics provider.

The current list, including what data each provider receives and where it is located, is on our Subprocessor List at https://glamops.net/legal/subprocessors. We give Businesses advance notice of changes as described there.

Stripe. For payments to Businesses, Stripe also has its own direct relationship with each Business and with cardholders, and uses some information under its own privacy policy, available at https://stripe.com/privacy.

11.2. With Businesses

• If you are a Client, your information is available to the Business you booked with, and to the Team Members that Business has authorized.
• If you are a Team Member, your name, role, schedule and activity in the account are visible to the Business owner and to other Team Members as the owner's settings allow.

11.3. When you ask us to

We share information when you direct us to, for example when a Business connects another app or exports its data.

11.4. Legal reasons and safety

We may disclose information if we believe in good faith it is reasonably necessary to:

• comply with a law, regulation, subpoena, court order or other legal process;
• respond to a lawful request from a government authority (where legally allowed, we will tell the affected Business first so it can respond);
• enforce our Terms or Acceptable Use Policy, including cooperating with mobile carriers or our text and email providers when investigating messaging complaints;
• protect the security of the Services; or
• protect the rights, property or safety of GlamOps, our users, Clients or the public.

11.5. Business transfers

If GlamOps is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal information may be transferred as part of that transaction. We will require the recipient to honor this policy for information it receives, and we will tell affected Businesses before their information becomes subject to a materially different privacy policy.

11.6. Aggregated or de-identified information

We may share information that has been aggregated or de-identified so that it cannot reasonably be linked to any person or Business, only to run and improve the Services and never for marketing. We never create it from intake or health form information. We will not try to re-identify it and we contractually require recipients not to.

12. Text messaging privacy

12.1. Text messaging is not yet available in GlamOps; this section applies when it launches. GlamOps lets Businesses send appointment texts and, where Clients have opted in, marketing texts. GlamOps may also send account texts (such as sign-in codes) to Business users.

12.2. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service, is permitted. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

12.3. Text messages from a Business identify the Business by name. Message frequency varies. Message and data rates may apply. Reply HELP for help or STOP to opt out at any time. We also treat other common opt-out words, such as "quit," "cancel," "unsubscribe," "end," "revoke" and "opt out," as opt-out requests.

12.4. We keep records of text-message consent and opt-outs (including the date, time, method of consent, wording shown, and confirmation replies) on behalf of each Business, so that opt-outs are honored and consent can be shown to carriers and regulators. We keep these records for the period stated in Section 14.

12.5. Clients who opt out of a Business's texts stop receiving texts from that Business through GlamOps. Opting out of one Business's texts does not affect texts from a different Business, except for the GlamOps appointment texts program described in 12.6.

12.6. GlamOps appointment texts. For Businesses that don't have their own texting number, GlamOps sends appointment confirmations, changes, cancellations and reminders from one GlamOps number, on behalf of the Business the Client booked with (the "GlamOps appointment texts" program, terms at glamops.net/sms). Each text starts with "GlamOps:" and names the Business. GlamOps collects the Client's consent itself, with an unticked box on the booking form or in the Client Portal, and keeps the record (the date, time, wording shown and the number). These texts are never marketing. Up to 4 texts per booking; message and data rates may apply. Replying STOP to that number stops all GlamOps appointment texts to that phone, from every Business, and turns appointment texts off at each Business where the Client had chosen them; replying START turns them back on. Mobile numbers and text opt-in information collected for this program are never sold or shared with third parties for their marketing. For help, reply HELP or contact support@glamops.net.

13. Email marketing

13.1. GlamOps marketing to Businesses and prospects. If you opt in to marketing emails (for example, when you sign up for a trial, create an account or join our newsletter), we may send you emails about GlamOps features, tips and offers. Every marketing email includes an unsubscribe link, and we process unsubscribes immediately, and in any case within 7 days. You will still receive service emails, such as receipts, security alerts and notices of changes to our terms.

13.2. Business emails to Clients. Businesses can use GlamOps to send booking confirmations, reminders and marketing emails to their Clients. These emails come from the Business, and the Business is responsible for their content and for having permission to send them. Businesses may send marketing emails only to Clients who opted in (for example, by checking the email opt-in box at booking or in the Client Portal). Every marketing email sent through GlamOps includes the Business's name and postal address and an unsubscribe link, and GlamOps automatically stops marketing emails to Clients who unsubscribe.

13.3. We use technology that may tell us whether an email was delivered, opened, or a link was clicked, to measure delivery and spot problems.

14. How long we keep information

14.1. We keep personal information only as long as needed for the purposes described in this policy, unless a longer period is required or allowed by law. In general:

14.2. Deleting your account. Business owners can delete their GlamOps account in the app or on the web at Settings → Account → Delete account, without needing to reopen the mobile app. Deleting the account deletes the Business's Client records as well (after the 30-day export window, unless the Business chooses immediate deletion), so the Business should export anything it needs to keep first. We also instruct our subprocessors to delete the data in line with their own deletion schedules.

14.3. What we keep after deletion. After account deletion we keep only what we must keep for legal, tax, security, fraud-prevention or dispute purposes (for example, billing records, consent and opt-out records, and records of acceptance of our Terms), for the periods above.

14.4. Client deletion requests. Clients can ask the Business to delete their information. If a Client contacts GlamOps directly, see Section 18.6.

15. How we protect information

15.1. We use administrative, technical and physical safeguards designed to protect personal information, appropriate to our size and the sensitivity of the information. These include:

• encryption of data in transit (HTTPS/TLS) and at rest;
• access controls that limit who at GlamOps can access personal information, based on job need;
• database-level row security that keeps each Business's data separate from every other Business's data;
• multi-factor authentication as an option for Business users;
• private storage for photos and intake forms, accessed through time-limited links;
• regular backups;
• rate limits on public forms;
• monitoring, logging and alerting for errors and security events;
• keeping software and dependencies up to date; and
• written contracts requiring our service providers to protect personal information.

15.2. A designated person at GlamOps is responsible for our security program, which includes periodic risk assessments and testing of key controls.

15.3. No method of transmission or storage is completely secure. If you have reason to believe your account is no longer secure, contact us right away at admin@glamops.net.

16. Security incidents and breach notification

16.1. If we discover a security breach affecting personal information:

• For Client information we hold for a Business, we will notify the affected Business without undue delay (our target is within 72 hours) and never later than 10 days after discovering the breach, and give the Business the information it reasonably needs to notify its Clients and regulators. The Business is responsible for notifying its Clients, and we will help.
• For information we control (for example, Business account information), we will notify affected individuals and, where required, regulators and consumer reporting agencies, as required by law.

16.2. Where Oregon law requires it, we will also notify the Oregon Attorney General.

17. Children and minors

17.1. The Services are meant for businesses and is not directed to children under 13. Business account holders must be at least 18.

17.2. We do not knowingly collect personal information directly from children under 13. A Client under 18 may be booked by a parent or guardian, and Businesses should have a parent or guardian complete and sign intake and consent forms for minors. GlamOps processes that information on the Business's behalf.

17.3. We do not sell the personal information of anyone under 16, or use it for targeted advertising or profiling.

17.4. If you believe a child under 13 has given us personal information directly, contact us at admin@glamops.net and we will delete it.

18. Your privacy rights

18.1. Rights we offer everyone in the US

Several US states give residents privacy rights, and the details differ from state to state. To keep things simple, GlamOps offers the following rights to all US users, wherever they live, subject to the limits in Section 18.7:

1. Access / know: confirm whether we process your personal information, and get a copy of it, including the categories of information, sources, purposes, and the categories of third parties we disclose it to.
2. Third-party list: get a list of the specific third parties (other than individuals) to which we have disclosed your personal information.
3. Correct: ask us to fix inaccurate information.
4. Delete: ask us to delete your information.
5. Portability: get your information in a commonly used, machine-readable format.
6. Opt out: of the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. (We do not do any of these, but you can still submit a request and we will record it.)
7. Limit use of sensitive information: where we use sensitive personal information beyond what is needed to provide the Services. (We do not.)
8. Withdraw consent: where we rely on your consent.
9. Appeal: our decision on your request (Section 18.5).

Many of these rights can also be used directly in the app: Business users can view and edit their account details in Settings, export their data at Settings → Export, and delete their account at Settings → Account → Delete account.

18.2. How to submit a request

Email admin@glamops.net with the subject "Privacy request".

Tell us what you are asking for and how we can reach you.

18.3. Verifying your identity

To protect your information, we must confirm that a request comes from you. If you have an account, we will usually ask you to confirm the request while signed in or from the email address on the account. Otherwise, we may ask for information that matches what we already hold. We will use the information you give us for verification only for that purpose. We do not need to verify opt-out requests, but we may deny one we believe is fraudulent.

18.4. Our response

We will respond within 45 days of receiving your request. If we need more time, we will tell you why and may extend by up to 45 more days where the law allows. We do not charge for requests, unless a request is clearly unfounded or excessive, or you make more than two requests in 12 months where the law allows a fee. If we cannot fully meet your request, we will explain why.

18.5. Appeals

If we decline to take action on your request, in whole or part, you can appeal by emailing admin@glamops.net with the subject "Privacy appeal" within a reasonable time of our decision. A person who was not involved in the original decision will review it. We will tell you in writing what we decided and why within 60 days of receiving your appeal. If we deny your appeal, you may contact your state Attorney General; for Oregon residents, that is the Oregon Department of Justice.

18.6. If you are a Client of a Business

GlamOps processes Client information on behalf of Businesses (Section 2.2). If you are a Client, please send your request to the Business you booked with. The Business decides how to respond, and GlamOps will help the Business fulfill it.

If you contact GlamOps directly, we will (a) tell you which Business or Businesses we process your information for, where we can do so without disclosing another person's information, (b) forward your request to the Business where appropriate, or tell you to contact the Business directly, and (c) act on the request when the Business instructs us to or where the law requires us to act ourselves. We may not be able to delete Client information without the Business's instruction.

18.7. Limits on rights

We may decline or limit a request where the law allows, for example if we cannot verify your identity, if fulfilling it would reveal another person's personal information, if we must keep the information to comply with law, complete a transaction, detect security incidents or fraud, or defend legal claims, or if the information is held only on behalf of a Business (Section 18.6).

18.8. Authorized agents

You can have an authorized agent make a request for you. We may ask the agent for written, signed permission from you, and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney. A parent or legal guardian may make a request for a child.

18.9. No discrimination

We will not deny you service, charge you a different price, or give you a lower quality of service because you used your privacy rights. We do not offer financial incentives for personal information.

19. State-specific disclosures

19.1. California

Notice at Collection. This section is GlamOps's Notice at Collection for California residents whose personal information GlamOps collects as a "business" (Business account holders, Team Members and Visitors). For Clients, GlamOps acts as a "service provider" to the Business, which is responsible for giving its own notice.

In the past 12 months we have collected the following categories of personal information. We collected each from the sources described in Section 3.5, used each for the purposes in Section 4, and disclosed each for a business purpose to the categories of recipients shown. We have not sold or shared any of these categories.

We use sensitive personal information only for purposes permitted by California law (such as providing the Services and keeping it secure), not to infer characteristics about you, so we do not offer a "Limit the Use of My Sensitive Personal Information" link.

Client information we hold as a service provider. For transparency, the Client information we process for Businesses (Section 3.3) includes identifiers, customer records, commercial information (appointments and payments), internet activity (booking-site analytics), visual information (photos), and sensitive personal information, namely health information on intake forms, and client-portal sign-in details. We process it only to provide the Services to the Business.

Your California rights are described in Section 18. California residents may also use an authorized agent (Section 18.8).

Shine the Light. California Civil Code § 1798.83 lets California residents ask for information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

CalOPPA. This policy describes the categories of information we collect, the third parties we share it with, how you can review and correct it (Section 18), how we notify you of changes (Section 20), its effective date, and how we respond to Do Not Track signals (Section 9.2).

19.2. Oregon

Oregon residents have the rights described in Section 18 under the Oregon Consumer Privacy Act, including the right to get a list of the specific third parties to which we have disclosed their personal information (other than individuals). You can appeal our decision on a request as described in Section 18.5 and contact the Oregon Department of Justice if you are not satisfied.

We honor universal opt-out signals such as Global Privacy Control (Section 9). We do not sell personal information, use it for targeted advertising, or profile people in ways that have legal or similarly significant effects. We do not sell precise geolocation data and do not process the personal information of known under-16s for targeted advertising, sale or profiling.

Under Oregon law, information about a person's mental or physical condition or diagnosis is "sensitive data." When GlamOps processes this type of information on intake forms, it does so as a processor for the Business, which is responsible for obtaining any required consent.

19.3. Nevada

Nevada residents may ask us not to sell certain personal information. GlamOps does not sell personal information. If you are a Nevada resident and want to submit a request anyway, email admin@glamops.net with the subject "Nevada opt-out request."

Health-related information on intake forms is covered by our Consumer Health Data Privacy Policy at https://glamops.net/legal/health-data-privacy, which addresses Nevada's consumer health data law (SB 370).

19.4. Washington, Connecticut and other states with health-data laws

Health-related information on intake forms is covered by our Consumer Health Data Privacy Policy at https://glamops.net/legal/health-data-privacy.

19.5. Other states

Residents of other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas, Indiana, Kentucky, Rhode Island and others) have rights similar to those in Section 18, which we offer to all US users.

20. Changes to this policy

20.1. We may update this policy from time to time. We will post the new version here with a new "Last updated" date.

20.2. If we make a material change, such as using personal information in a new way or sharing it with a new type of third party, we will tell Business account holders by email or in-app notice at least 30 days before the change takes effect, and, where the law requires, ask for your consent before applying the change to information we already have.

20.3. Changes to our Subprocessor List follow the notice process described on that page.

21. Contact us

If you have questions about this policy or our privacy practices, contact us:

• Email: admin@glamops.net
• Mail: GlamOps LLC, Attn: Privacy, 11918 SE Division Street #2046, Portland, OR 97266

If you are a Client and your question is about how a Business uses your information, please contact that Business directly.