What Palace Nails & Spa collects, why we have it, who else sees it, how long we keep it, and how to make us delete it.
Last updated 20 October 2026
The short version. We are a nail salon. To book you an appointment we need your name, a phone number and usually an email address, and we ask you to tick a box saying we may use them to confirm the appointment. We keep a record of your visits so we know what you had last time. We record which pages are looked at on this website, including the address your device connects from, so we can see what is working and spot abuse. We do not sell any of it, and we do not share it for advertising. You can ask us for a copy, ask us to correct it, or ask us to delete it — email info@palacenailsspa.com or call +1 (916) 745-4815, and we will answer within 45 days.
This website is run by Palace Nails & Spa. We decide what information is collected here and what happens to it — in the language of the privacy laws, we are the controller.
This notice covers this website and the appointment and customer records kept behind it. It does not cover anything you do on Google, Yelp, Facebook or Instagram, which have their own policies — see “Other websites” below.
Nothing here is collected because it might be useful one day. Each item below exists because something we do stops working without it.
| What | Why we need it |
|---|---|
| Your name | To know whose appointment it is and to greet you at the door. |
| Your phone number | To confirm the appointment and to reach you if something changes — a technician off sick, a power cut. It is the only way we can tell you before you have driven here. |
| Your email address | The booking confirmation, and the link that lets you cancel without ringing. Optional on the form if you would rather we only had the phone number. |
| The services, the date and time, and who you asked for | It is the appointment. |
| Anything you type in the note box | Because you wanted us to know it. Please do not put health details, card numbers or anything else sensitive in there — see “What we ask you not to send us”. |
| The number of people in your party, and their services | Three people need three technicians free at the same moment, which is a different question from one appointment three times as long. |
| The internet address your device connected from, and which browser it is | Recorded with the booking as proof of where it came from. It is how we spot one person booking the whole of Saturday under six different names, which is a real thing that happens to salons. |
| The consent tick, and the moment you ticked it | So that if you ever ask whether you agreed to be contacted, we can answer with a date rather than an opinion. |
We keep a customer record so the second visit is better than the first. It holds:
The contact form asks for your name, email address, phone number and your message. We keep the exchange so the next person who picks it up knows what has already been said.
Your name, contact details, licence number if you give one, anything you write, and the file you upload. Kept while we consider the application and for a reasonable period after, in case something else comes up. Ask us and we will delete it sooner.
The name you sign it with, the rating and what you wrote. A review is published to be read, so assume the name and the text are public. If you give an email address with it, that stays private and is only used if we need to ask you about the review.
Every page view on this website records:
utm_ parameters that tell us a visit came from a
particular post or printed card).This is counted on our own server. It is not sent to an advertising network, and there is no cross-site tracking pixel on this website.
We also count scans of our printed QR codes — which code, and when — so we know whether the card in the window is doing anything. That record holds no name.
Please do not type card numbers, social security numbers, immigration details or medical records into the booking note, the contact form or a review. If you need to tell us about a medical condition, an allergy or a pregnancy so that we can treat you safely, tell a member of staff in person or on the phone. We will write down only what we need in order to look after you, and that note lives in your customer record with everything else.
The tick box on the booking form says that we may contact you about that appointment — to confirm it, to remind you, or to tell you something has changed. That is the only thing it covers. It is required, because an appointment we cannot confirm is not an appointment.
Joining the customer list for offers is a separate, optional tick, and leaving it unticked costs you nothing. We do not add you to it because you booked, because you came in, or because you once sent us a message.
We do not take card payments on this website. You pay at the counter, on a terminal supplied by our card processor. No card number ever reaches this website or its database.
What we do keep is the amount of each visit, the method (cash, card, or a scan-to-pay account), and the tip — because that is how the business is run and how technicians are paid.
We do not use advertising cookies and there is no cookie banner on this site, because there is nothing on it worth asking about. In full, this is what is stored on your device:
| What | What it does | How long |
|---|---|---|
| A session cookie | Keeps one visit together — it is what lets the booking form remember what you chose on the previous step. It holds a random identifier and nothing else. | Until you close the browser |
| A dismissed-offer note | If you close an offer banner, your browser remembers which one so it does not reappear on every page. Stored in the browser itself and never sent to us. | Until you clear your browser data |
This site also loads fonts and a small number of code libraries from public content networks (Google Fonts, jsDelivr and Cloudflare). Loading a file from them tells them your IP address, the same as visiting any website does. They are not given anything about you by us, and they do not set tracking cookies for this purpose.
Pages with a map on them load it from Google Maps, which is a third party in the same way. Where we embed a video, we use YouTube's privacy-enhanced player, which does not record your viewing on your Google account unless you press play.
| Record | Kept for |
|---|---|
| Appointments and your customer record | While you are a customer, and for a reasonable period after your last visit so that we can recognise you if you come back and so the year's figures stay correct. Delete it sooner by asking. |
| Payment and takings records | As long as tax and accounting rules require — in practice several years. These we cannot delete on request, because we are required to keep them; see “Your rights”. |
| Website visit records | 365 days, then deleted automatically. |
| Messages sent through the contact form | Until the matter is dealt with and a reasonable period after. |
| Job applications | While the position is open and a reasonable period after. |
| Failed sign-in attempts to the staff dashboard | A short rolling window, purely to lock out password guessing. |
We do not sell your information, and we have never sold it. We do not share it for anyone else's advertising, and we do not use it for profiling or any automated decision that has a legal or similarly significant effect on you.
It is handled by these people, and only so that the shop can function:
Each of them acts on our instructions and is not allowed to use your information for anything of their own.
We will also hand information over if the law requires it — a court order, a lawful request from a government agency — or if it is needed to establish or defend a legal claim, or to protect somebody from harm. If the business is ever sold, customer records would pass to the buyer, who would be bound by this notice until they told you otherwise.
Passwords for staff accounts are stored as one-way hashes and cannot be read back, by us or by anyone who steals the database. Staff sign in over an encrypted connection, can turn on two-factor authentication, and are locked out after repeated wrong passwords. The screens at the counter can be restricted to the shop's own network, so a stolen link is of no use from outside the building. Every change made in the dashboard is logged with who made it and when.
We use internet addresses to detect abuse. That means spotting bulk fake bookings, somebody holding Saturday open under six names, repeated password guessing, and automated scraping. It is a narrow and specific use, and it is the reason the address is recorded alongside a booking at all. We do not use it to build a profile of you, and we do not share it with anyone for their own purposes.
No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach ever affects your information we will tell you, and the authorities, as quickly as the law requires and as plainly as we can.
Whatever state or country you are in, we will honour the following. You do not have to be a Texas resident to ask.
If you are in the European Union or the United Kingdom, the General Data Protection Regulation also gives you the right to object to processing we carry out on the basis of our legitimate interests, the right to restrict processing while a dispute is resolved, and the right to complain to your national supervisory authority. Our lawful bases are: contract for everything needed to give you the appointment you asked for; consent for marketing; legitimate interests for keeping the site working, measuring it and preventing fraud; and legal obligation for the tax record.
Email info@palacenailsspa.com or call +1 (916) 745-4815. Say what you want — a copy, a correction, deletion — and give us enough to find you: the name and phone number the appointment was under is usually plenty.
We will answer within 45 days. If the request is complicated we may take another 45, and we will tell you before the first 45 are up rather than after. There is no charge, unless somebody makes the same request over and over, in which case we will say so before doing anything.
We have to be reasonably sure it is you before we hand over a copy of somebody's records, so we may ask you to confirm something only the account holder would know. We will not ask you to create an account in order to make a request.
You can appeal, free, by replying and saying so. We will reconsider and give you a written answer within 60 days. If we still refuse, you may complain to the Texas Attorney General at texasattorneygeneral.gov, or to your own state's or country's authority.
This website is not aimed at children and we do not knowingly collect information from anybody under 13. We do treat children in the shop, and when we do, the booking is made by a parent or guardian using their own details. If you believe a child has given us information through this site, tell us and we will delete it.
We will not sell or share the personal data of anyone we know to be under 16 for targeted advertising, and since we do not do that for anybody, that holds for everybody.
We photograph work we are proud of and put it on this site and on social media. These are normally close-ups of hands, feet or hair with nobody identifiable in them. If a photograph would show your face, or anything that identifies you, we will ask you first and we will take no for an answer. If a picture of your work is already up and you want it taken down, tell us and we will remove it — no reason needed.
Our Google Business Profile, Yelp page, Facebook page and Instagram account are run by those companies on their own terms. What you do there — leaving a review, sending a message, following us — is governed by their privacy policies, not this one. We can see what any member of the public can see, and we can reply.
Links from this site to anywhere else are provided because they are useful. We are not responsible for what those sites do.
When we change it we will change the date at the top. If we ever make a change that materially affects what we do with information we already hold — a new purpose, a new recipient — we will say so plainly rather than quietly reissuing the page, and where the law requires consent for the change we will ask for it.
Any question about this notice, or about anything we hold: info@palacenailsspa.com, +1 (916) 745-4815, or 4400 Elverta Rd Ste 160, Antelope, CA 95843. You can also use the contact form, though please do not put anything sensitive in it.
This notice is published in English only. A translation of a legal document can change what it promises, so we would rather you read the one that binds us. If you would like it explained in Vietnamese, Spanish, Korean, Chinese or Arabic, ask at the desk and somebody will go through it with you.
See also our Terms of Service.