1. Introduction
This Privacy Policy explains how NaileditbyAly LLC collects, uses, stores and protects information when you visit our website, contact our studio, request a consultation or work with us on a systems design project. The website is published under the developer name NailedByAly, and the business is operated by NaileditbyAly LLC at 238 E 100 N, Lehi - 84043-1902, United States (US). We take a plain approach to privacy: we ask for little, we explain why we ask, and we keep information only as long as it serves the purpose for which it was provided.
Our practice is focused on computer integrated systems design for nail studios and beauty service teams. That means most of the information we handle relates to business contacts, studio operations and the technical details needed to plan a system. We do not sell personal information, we do not build advertising profiles, and we do not run behavioral tracking across other websites.
Please read this policy carefully. If you do not agree with the practices described here, please do not use the website or send us information. You are always welcome to contact us first with questions, and we will do our best to answer them in clear language.
Short summary: we collect contact details you choose to send, basic technical information needed to keep the site working, and project information you share with us. We use it to reply, to deliver services and to meet legal duties. We do not sell it.
2. Scope of this policy
This policy applies to the website at nailedbyaly.mom, to email and telephone communications with our team, to consultation forms and to the information we handle while delivering our services. It does not apply to third party websites, booking portals, payment processors or other services that you may reach through a link from our site. Those services publish their own privacy notices, and we encourage you to read them before sharing information.
The policy also does not cover information that a studio collects from its own guests. When we design a booking portal or an appointment ledger for a client, the client remains responsible for the guest information in that system. We act as a service provider or processor for that data, and our handling is governed by the written agreement with the client as well as by this policy.
Where a client agreement conflicts with this policy, the client agreement controls for the client data described in that agreement. For everything else, this policy applies.
3. Information we collect
We collect information in three broad groups. The first group is contact information that you choose to give us, such as your name, email address, telephone number, studio name and role. The second group is project information, such as the services you are interested in, the size of your studio, the tools you already use and the notes you share about your workflow. The third group is technical information generated when you visit the website, such as the pages you view, the type of device and browser you use, and the approximate region from which you connect.
Contact information
We ask for contact details only when you send a message, request a consultation or become a client. The contact form on our website prepares an email in your own mail application, so the message reaches us through your email provider rather than through a web server database. We keep the messages we receive so that we can reply and, where relevant, refer back to the agreed scope of a project.
Project and business information
During a project we may receive service menus, price lists, hardware inventories, network descriptions, staff schedules and similar operational material. This information is used to plan and deliver the engagement. We treat it as confidential business information and restrict access to team members who need it for the work.
Technical information
The website hosting provider records standard server logs, which may include an internet protocol address, the date and time of a request, the requested page, the referring page and a browser user agent string. These logs help us keep the site available, diagnose faults and protect against abuse. They are not used to identify individual visitors for marketing purposes.
4. How we collect information
Most information comes directly from you. You may send an email, call the studio, complete the contact form or speak with us during a consultation. When you write to us, your email provider and ours both process the message as part of normal delivery, and each provider applies its own privacy terms.
A smaller amount of information is generated automatically by the website and the hosting service. Server logs are created whenever a page is requested. If the site uses a content delivery network or a security filter, those services may also record request details to detect attacks and cache pages efficiently. We configure these tools to collect the minimum needed to keep the site fast and safe.
We may also receive information from a client when that client introduces us to a colleague or shares a project brief. In that case we treat the information as having been provided with the client approval, and we use it only for the purpose described in the introduction.
5. Why we use information
We use information to respond to inquiries, to prepare proposals, to deliver the services described on our website, to maintain accurate project records and to meet our legal and accounting obligations. We also use technical information to operate and secure the website, to understand which pages are useful and to improve the clarity of our published content.
We may use contact information to follow up on a consultation, to confirm a scheduled visit or to send a short note about a matter that affects an active project. We do not send bulk marketing email to people who have not asked to hear from us. If we ever introduce a newsletter, it will require a separate and explicit opt in, and every message will include a simple way to stop receiving it.
We do not use personal information to make automated decisions that produce legal or similarly significant effects. Our work is planned and reviewed by people, and any recommendation about a studio system is made in conversation with the client.
6. Legal bases
Where data protection law requires a legal basis for processing, we rely on one of the following. We process information to take steps at your request before entering a contract and to perform a contract with you or with your organisation. We process information for our legitimate interests in operating a professional studio systems practice, provided those interests are not overridden by your rights. We process information to comply with legal obligations, such as tax and record keeping rules. Where we ask for consent, we process on the basis of that consent, and you may withdraw it at any time.
Our legitimate interests include answering inquiries, protecting the website and our systems from misuse, maintaining business records, and improving the quality of our published guidance. We keep those interests narrow and we review them whenever we introduce a new tool or process.
If you have questions about the legal basis for a particular processing activity, contact us and we will explain it in writing.
9. Service providers
Like most small professional practices, we rely on a short list of providers. Our website is hosted by a managed hosting service that stores page files and server logs. Our email is handled by a business mail provider that filters spam and keeps an archive for continuity. Our accounting records are kept in a secure bookkeeping service. Document drafts and project files may be stored in an encrypted cloud folder with access limited to named team members.
We review these providers before we engage them and we prefer services that offer clear security documentation, regional data controls and a written data processing agreement. If a provider suffers a security incident that affects information we control, we will follow the notification terms in the agreement and, where required, inform affected clients and individuals without undue delay.
When a project requires a specific client system, such as a booking portal or a payment processor, the client chooses that provider. We help configure it and document the account ownership, but the provider privacy notice governs the guest data held in that system.
10. Data retention
We keep information only as long as it is needed for the purpose collected, for an active project, or for a legal obligation. Inquiry messages that do not lead to a project are usually deleted within twenty four months. Project records are kept for the duration of the engagement and for a reasonable period afterwards so that we can answer questions, honour warranties and maintain a record of the system we delivered.
Financial records, invoices and tax documents are kept for the period required by applicable law and accounting practice. Server logs are kept for a short rolling window set by the hosting provider, typically no more than ninety days. Backup copies are rotated on a schedule and expire automatically.
When information is no longer needed, we delete it or anonymise it so that it can no longer be linked to a person. If a legal hold applies, we retain the relevant records until the matter is closed and then resume the normal deletion schedule.
11. Security measures
We protect information with a combination of technical and organisational measures. Access to project folders and email is limited to team members who need it, protected by strong passwords and multi factor authentication. Devices are encrypted, kept updated and locked when unattended. Website files are served over a secure connection, and administrative access to the hosting account is restricted.
We keep an inventory of accounts and their owners so that access can be removed promptly when a person leaves a project or a role. Backups are tested periodically. Staff and contractors receive a short briefing on confidentiality and on the steps to take if they suspect a problem.
No method of transmission or storage is completely secure, and we cannot promise that a breach will never occur. If we become aware of an incident that affects personal information, we will investigate, contain the issue, and notify affected parties as required by applicable law and by our client agreements.
12. Your privacy rights
Depending on where you live, you may have the right to request access to the personal information we hold about you, to request correction of inaccurate information, to request deletion, to request a portable copy, to restrict or object to certain processing and to withdraw consent where processing is based on consent. You may also have the right to lodge a complaint with a supervisory authority.
To make a request, email bookings@nailedbyaly.mom or call +12629226167. Please describe the information at issue and the right you wish to exercise. We may ask for reasonable verification so that we do not disclose information to the wrong person. We will respond within the period required by applicable law, and we will explain any lawful reason why a request cannot be fully granted.
You will not be charged for a routine request, and we will not discriminate against you for exercising a privacy right. If your request concerns information held by a client system that we merely configured, we will direct you to the client or help you reach the right contact.
13. California privacy notice
If you are a California resident, the California Consumer Privacy Act, as amended, gives you specific rights. You have the right to know the categories of personal information we collect, the sources of that information, the business purposes for collection and the categories of third parties with whom we share it. You have the right to delete personal information, subject to certain exceptions. You have the right to correct inaccurate personal information. You have the right to opt out of the sale or sharing of personal information, and we confirm that we do not sell or share personal information for cross context behavioral advertising.
The categories we collect are identifiers such as name and email address, commercial information such as service interests and project details, internet or network activity such as server log data, and professional information such as studio name and role. We collect these categories for the purposes described in section five and we retain them as described in section ten. We disclose identifiers and commercial information to service providers for business purposes only.
You may exercise your rights by emailing bookings@nailedbyaly.mom or calling +12629226167. An authorised agent may submit a request on your behalf where the law permits, and we may ask for proof of authorisation. We will confirm receipt and respond within the statutory period.
14. Privacy for Children
Our website and services are intended for businesses and adults. We do not knowingly collect personal information from children under thirteen. If a studio serves younger guests, the studio is responsible for obtaining any consent required by law before collecting information from those guests in its own booking system.
If you believe that a child has sent personal information to us, please contact bookings@nailedbyaly.mom so that we can delete it. We will review the message, remove the information where appropriate and confirm the action in writing.
We do not direct advertising to children, and we do not operate features on this website that are designed to attract children.
15. International transfers
Our team works primarily in the United States, and information we collect is generally stored on servers located in the United States. Some service providers may process information in other countries as part of their global infrastructure. Where that happens, we rely on the provider contractual commitments and, where required, on appropriate transfer safeguards.
If you contact us from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from the laws of your home country. We apply the protections described in this policy regardless of where the information is stored.
Clients with specific residency requirements should raise them at the start of a project so that we can choose providers and storage locations that fit the applicable rules.
16. Third party links
Our website may link to booking portals, mapping services, social profiles or product pages operated by other companies. A link does not mean that we control or endorse the privacy practices of the destination. When you follow a link, the destination site may collect information under its own policy.
We try to link only to services we consider reputable, but we cannot guarantee their practices. Please review the privacy notice of any third party site before submitting personal information, especially on a payment or account creation page.
If you believe a link on our site leads to a harmful or misleading destination, tell us at bookings@nailedbyaly.mom and we will review it promptly.
17. Changes to this policy
We review this policy at least once a year and whenever we change a tool, a provider or a practice that affects personal information. When a change is material, we will update the effective date and, where appropriate, add a short notice on the website or in a client communication.
Because we keep no mailing list for legal notices, the current version on this page is the authoritative version. We encourage returning visitors to check the effective date when they rely on the policy for a decision.
If a change would require new consent under applicable law, we will request that consent before applying the change to information you have already provided.
18. How to reach us
Questions, requests and concerns about this policy can be sent to the studio. We prefer email because it creates a clear written record, but telephone is welcome for urgent matters.
- Company: NaileditbyAly LLC
- Address: 238 E 100 N, Lehi - 84043-1902, United States (US)
- Email: bookings@nailedbyaly.mom
- Phone: +12629226167
We aim to acknowledge every privacy inquiry within two business days and to resolve it as quickly as the circumstances allow. If you are not satisfied with our response, you may contact the relevant supervisory authority in your jurisdiction.
Thank you for taking the time to read this policy. We believe that clear privacy practices are part of good systems design, and we are glad to explain any point in more detail.