Privacy Policy

A. Information You Provide Directly

We collect personal information you voluntarily provide when you:

• Fill out a contact, inquiry, booking, application, consultation, or lead-magnet form
• Book a consultation or appointment
• Purchase artwork, education, an agency service, or another product or service
• Enroll in an education program, intensive, mentorship, or apprenticeship
• Subscribe to email, SMS, or other marketing communications
• Submit an agency inquiry, onboarding questionnaire, brand information, business information, or campaign materials
• Communicate with us by email, phone, SMS, social media, video conference, or other channels
• Submit testimonials, photographs, videos, artwork, portfolios, case studies, reviews, or other content

Information may include name, email address, telephone number, business name, job title, billing/shipping address, account credentials, transaction information, communications, preferences, professional information, and other information you choose to provide.

For restorative or paramedical services, you may voluntarily provide health, skin, scar, surgical, medication, allergy, or other sensitive information needed for consultation, screening, consent, and service delivery. We use such information only as permitted by applicable law and as reasonably necessary for the service or purpose for which it was provided.

B. Automatically Collected Information

When you use the Website or certain digital services, we may collect IP address, approximate location, browser and operating-system information, device type, referring URL, pages viewed, dates and times, session information, clicks, scrolling, campaign attribution, and similar technical or usage information.

C. Information From Third-Party Platforms

Depending on the service you use, we may receive information from platforms including GoHighLevel/HighLevel, Square, Stripe, Kajabi, HoneyBook, Venmo, Zelle, Google, Meta, Instagram, YouTube, TikTok, Pinterest, Zoom, scheduling platforms, website hosts, analytics providers, advertising platforms, and other vendors.

D. Agency Client and End-Customer Data

When AriCléa OS Agency provides services to a business client, that client may direct AriCléa to collect, store, organize, analyze, communicate with, or otherwise process personal information belonging to the client’s customers, leads, students, patients, or website visitors. In those circumstances, the business client generally determines the purposes and means of processing and AriCléa acts as a service provider/processor to the extent required by applicable law.

Agency clients are responsible for providing lawful notices, obtaining required consents, honoring consumer requests, and ensuring that data they provide to AriCléa may lawfully be processed. AriCléa does not intentionally use agency-client customer data for its own independent marketing purposes except as permitted by the applicable agreement and law.

E. User-Generated Content

If you submit photographs, videos, testimonials, project work, portfolio materials, or other content, we may retain and use that content as described in this Policy and any separate consent or agreement you receive.

We may use personal information to:

• Provide, administer, and improve our services
• Process bookings, consultations, purchases, payments, deposits, subscriptions, and orders
• Deliver artwork and coordinate shipping or pickup
• Provide tattoo, restorative, educational, consulting, agency, website, marketing, CRM, automation, and other services
• Create and administer accounts, portals, courses, communities, and client workspaces
• Communicate about appointments, purchases, projects, billing, support, and account activity
• Send marketing, educational, promotional, and transactional communications where legally permitted
• Manage lead generation, CRM, email, SMS, appointment reminders, workflows, pipelines, and automation
• Measure website, advertising, and campaign performance
• Perform analytics, attribution, fraud prevention, security, debugging, and service improvement
• Customize content and marketing where permitted
• Use AI-assisted tools for business operations, drafting, analysis, transcription, workflow automation, and creative development, subject to applicable restrictions
• Protect rights, safety, property, and the integrity of our systems
• Comply with legal obligations and enforce agreements

We do not sell personal information for money. However, certain advertising, analytics, cross-context behavioral advertising, or similar activities may constitute “sharing” or another regulated disclosure under California law. Where required, we provide applicable opt-out mechanisms.

Submitting a form permits us to contact you regarding the request you made. Marketing communications are sent only where permitted by law and, where consent is required, after the appropriate consent is obtained.

Marketing Email

• We comply with applicable federal and state marketing-email requirements, including CAN-SPAM.
• Marketing emails include required identification and a valid physical postal address and provide an unsubscribe mechanism.
• Unsubscribing from marketing does not stop necessary transactional or service communications.

SMS / Text

• If you affirmatively opt in to receive marketing or informational texts, we may send appointment reminders, project communications, promotions, educational content, or other messages consistent with the consent you provided.
• Message frequency and applicable carrier fees will be disclosed at the point of consent where required.
• You may opt out by replying STOP and may request assistance by replying HELP.
• We will not condition a purchase on consent to receive marketing texts where prohibited by law.
• Consent to marketing texts is not transferred to unrelated third parties except as permitted by law and the applicable consent.

You may withdraw marketing consent at any time. Withdrawal of consent does not affect processing already performed lawfully before withdrawal.

We may use cookies, pixels, web beacons, scripts, local storage, SDKs, and similar technologies.

Categories may include:

• Strictly necessary technologies for security, login, booking, checkout, forms, and site functionality
• Analytics and performance technologies
• Functional technologies
• Advertising, attribution, and remarketing technologies

Our Website and marketing systems may use Google Analytics, Google Ads, Meta Pixel/Conversions tools, and comparable services. We may also use tracking and automation functionality provided through GoHighLevel/HighLevel and its integrated services.

Where required by applicable law, we will provide a cookie consent or preference mechanism before placing non-essential technologies. You may also control cookies through your browser and applicable platform settings.

Our Website does not currently promise to respond to every browser “Do Not Track” signal. California law separately provides privacy rights that may apply regardless of DNT functionality.

AriCléa uses GoHighLevel/HighLevel as a business operating system and technology platform for AriCléa studio operations and AriCléa OS Agency services. Depending on the workflow, HighLevel may support our website, landing pages, forms, CRM, pipelines, appointment scheduling, communications, email, SMS, automation, workflows, client portals, payments or payment integrations, analytics, reputation-management tools, and related business functions.

HighLevel may process personal information on our behalf as a service provider/processor when we use its processor services. HighLevel’s current documentation states that customers control customer data submitted to the platform and that HighLevel acts as a processor for customer personal data in applicable processor relationships. HighLevel also maintains a Data Processing Addendum and subprocessor framework. We configure and use HighLevel subject to its current terms, privacy documentation, security controls, and data-processing terms.

Agency clients using AriCléa OS Agency services may have their own customers’ personal information processed within HighLevel. Those agency clients remain responsible for their own privacy notices, lawful collection, consent, retention, and consumer-rights obligations unless the parties expressly agree otherwise in writing.

We do not intentionally store complete payment-card numbers or banking credentials on our own servers. Payment and financial transactions may be processed by Square, Stripe, Kajabi, HoneyBook, Venmo, Zelle, HighLevel-connected payment providers, or other processors selected for a particular transaction.

Third-party processors maintain their own privacy policies and security practices. We encourage you to review those policies before using their services.

We may disclose personal information:

• To vendors and service providers that perform services for us
• To payment, booking, CRM, website, hosting, analytics, advertising, communications, and automation providers
• To GoHighLevel/HighLevel and its relevant subprocessors
• To agency clients where we are processing information on their behalf
• To professional advisors, insurers, accountants, attorneys, and auditors where appropriate
• To government authorities, courts, regulators, or law enforcement when legally required
• In connection with a merger, financing, acquisition, sale, restructuring, or other business transfer
• With your direction or consent
• To protect rights, safety, security, or property

We require vendors that process personal information on our behalf to use it only for authorized purposes and to maintain appropriate protections where required by law.

AriCléa may use AI-assisted tools for website development, copywriting, marketing, strategy, transcription, summarization, business planning, workflow automation, research, design exploration, and other business functions.

We do not intentionally submit identifiable client health information or confidential agency-client information to public AI systems unless specifically authorized, contractually permitted, or otherwise lawful and appropriately safeguarded.

AI output may be reviewed by a human before publication or use. We do not rely solely on automated processing to make decisions about you that produce legal or similarly significant effects unless permitted by law and subject to applicable rights.

Agency clients are responsible for identifying any restricted data, regulated information, or contractual limitations that apply to their business. AriCléa may decline to process information through an AI-enabled feature where the risk or legal requirements make the use inappropriate.

If you submit content, your rights and our permitted uses are governed by the consent, release, agreement, or Terms and Conditions presented to you.

For client and student photographs, videos, testimonials, and likeness, we distinguish between service delivery, portfolio documentation, educational use, and promotional use. Where a separate release or consent is required, we will obtain it according to the applicable agreement.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including legal, tax, accounting, contractual, safety, dispute-resolution, and operational requirements.

Retention periods may vary by category:

• Client and service records: retained according to applicable professional, business, safety, tax, and legal requirements
• Transaction records: retained as required for tax, accounting, fraud-prevention, and legal purposes
• Agency client data: retained according to the agency agreement, client instructions, and applicable law
• Marketing suppression records: retained as needed to honor opt-out requests
• Application materials: generally retained only as long as reasonably necessary unless a longer period is required or authorized
• Analytics and advertising data: retained according to the applicable platform settings and our legitimate business needs, subject to applicable law

We may retain information that cannot lawfully be deleted because it is necessary to comply with law, establish or defend legal claims, prevent fraud, maintain suppression records, or complete an active transaction.

California privacy law, including the California Consumer Privacy Act as amended, applies to businesses that meet its statutory applicability requirements. If the law applies to AriCléa for a particular processing activity, California residents may have rights that include:

• Right to know/access
• Right to delete, subject to exceptions
• Right to correct
• Right to opt out of sale or sharing
• Right to limit certain uses and disclosures of sensitive personal information
• Right to non-discrimination
• Additional rights that become applicable under California law

AriCléa does not sell personal information for money. However, certain advertising or cross-context behavioral advertising activities may constitute “sharing” under California law. Where applicable, you may opt out through our designated privacy mechanism or by contacting us.

Requests may be submitted to info@almaarthouse.co with the subject line “California Privacy Request.” We may need to verify your identity before completing a request. Authorized agents may submit requests as permitted by law.

We will not discriminate against a consumer for exercising applicable privacy rights.

If you reside in another U.S. state with an applicable comprehensive consumer privacy law, we will handle rights requests according to the law applicable to the relevant processing activity. Depending on the state, rights may include access, correction, deletion, portability, opt-out of targeted advertising, opt-out of certain profiling, or appeal rights.

If you are located in the EEA, UK, Switzerland, or another jurisdiction with a comprehensive privacy law, additional rights and obligations may apply where AriCléa offers goods or services to you, monitors behavior, or otherwise falls within the jurisdiction of that law.

Where applicable, AriCléa will identify a lawful basis for processing, provide required notices, honor applicable access/correction/deletion/objection/portability rights, use appropriate safeguards for international transfers, and provide required mechanisms for withdrawing consent.

Where consent is the legal basis, you may withdraw it at any time. Withdrawal does not affect processing already performed lawfully before withdrawal.

International users should understand that information may be processed in the United States and other countries where our vendors operate. Where required, we use appropriate transfer mechanisms and contractual safeguards.

AriCléa may receive sensitive personal information in connection with restorative or paramedical services. We limit access to personnel and vendors who need the information to perform authorized services, protect safety, administer the business, or comply with law.

Do not submit more medical or sensitive information than requested. Where a third-party medical provider, surgeon, insurer, or other professional is involved, separate privacy rules may apply to that provider.

AriCléa is not a hospital, medical practice, or insurer merely because it provides paramedical tattoo services. We do not represent that all of our services are subject to HIPAA. If AriCléa enters into a written Business Associate Agreement for a specific engagement, that agreement controls the applicable HIPAA obligations for that engagement.

We use commercially reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information we process. These may include access controls, authentication, encryption in transit, secure vendor platforms, limited access, contractual controls, and security monitoring.

No system is completely secure. We cannot guarantee absolute security.

If a security incident occurs, we will provide notifications required by applicable federal, state, or international law.

California and other jurisdictions impose specific requirements concerning certain data breaches. If we determine that a legally reportable breach has occurred, we will provide notices within the time and in the manner required by applicable law. Nothing in this Policy promises a particular notice deadline where the law provides a different standard.

AriCléa is committed to digital accessibility and aims to make ariclea.co and our digital experiences substantially conform to WCAG 2.1 Level AA, using generally recognized accessibility practices.

Accessibility is an ongoing process. Some third-party content, embedded services, or platform interfaces may not be fully controlled by AriCléa.

If you encounter an accessibility barrier, contact info@almaarthouse.co with “Accessibility Request” in the subject line. We will make reasonable efforts to identify the barrier and provide the requested information or service through an accessible alternative where appropriate.

Our Website and services may link to or embed third-party services including GoHighLevel/HighLevel, Square, Stripe, Kajabi, HoneyBook, Google, Meta, YouTube, Instagram, TikTok, Pinterest, Zoom, payment providers, scheduling platforms, and advertising platforms. Those providers maintain their own terms and privacy policies. AriCléa does not control their independent processing practices.

Our services are intended for adults unless a specific service expressly states otherwise and applicable consent requirements are satisfied. We do not knowingly collect personal information from children in violation of applicable law.

Our Website may not respond to all browser Do Not Track signals. Where required by California law, we will treat a valid Global Privacy Control or comparable legally recognized opt-out signal as required by applicable law and our technical implementation.

We may update this Policy to reflect changes in law, technology, services, vendors, or business practices. The updated version will be posted with a revised Last Updated date. Where legally required, we will provide additional notice or obtain consent.

AriCléa, DBA Alma Art House LLC
940 W Chapman Ave, Suite 202
Orange, CA 92868
Website: ariclea.co and aricleaagency.co
Email: info@almaarthouse.co
Phone: (714) 497-0106

For privacy requests, accessibility requests, data-rights requests, or opt-outs, contact us using the information above.

By using a digital property on which this Policy is posted or linked, you acknowledge that you have reviewed this Policy. Where applicable law requires affirmative consent, we will obtain that consent through the relevant form, checkbox, cookie banner, SMS opt-in, contract, or other mechanism.