Privacy Policy

1. Introduction

Knotty Paw Spa ("we," "us," or "our") is committed to protecting the privacy of our customers. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, create an account, or use our grooming services.

By using our website or services, you consent to the practices described in this policy.

2. Information We Collect

We collect the following types of information:

Personal Information You Provide

• Account information: name, email address, phone number, and password when you register
• Pet information: pet name, breed, weight, age, vaccination records, coat type, health conditions, and grooming notes
• Payment information: credit/debit card details processed securely through Stripe (we do not store full card numbers on our servers)
• Appointment details: booking dates, service selections, groomer preferences, and special requests
• Communications: messages, feedback, or inquiries you send us

Information Collected Automatically

• Device information: browser type, operating system, and screen resolution
• Usage data: pages visited, features used, and interaction patterns
• Cookies: authentication tokens stored as secure, HTTP-only cookies to keep you signed in

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Schedule and manage grooming appointments
• Process payments and issue refunds
• Send appointment confirmations, reminders, and status updates via email or SMS
• Maintain grooming records and notes for consistent care across visits
• Communicate with you about your account or respond to inquiries
• Improve our website, services, and customer experience
• Comply with legal obligations

4. Payment Processing

All payment transactions are processed through Stripe, a PCI-DSS compliant payment processor. When you provide payment information, it is transmitted directly to Stripe using industry-standard encryption. We do not store your full credit card number, expiration date, or CVV on our servers.

We may store a Stripe customer identifier on your account to facilitate future payments, such as charging the remaining balance after your appointment is completed. For more information, see Stripe's Privacy Policy.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

• Service providers: with third-party services that help us operate our business (Stripe for payments, SendGrid for email, Twilio for SMS notifications). These providers are contractually obligated to protect your information.
• Our staff: groomers and administrators access pet and appointment information as needed to perform their duties.
• Legal requirements: when required by law, court order, or governmental authority, or to protect our rights, safety, or property.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

6. Cookies & Authentication

We use essential cookies to keep you securely signed in to your account. These are HTTP-only cookies that cannot be accessed by client-side scripts. We do not use third-party advertising or tracking cookies.

• access_token: a short-lived authentication token that verifies your identity
• refresh_token: used to securely renew your session without requiring you to sign in again

These cookies are essential for the website to function and cannot be disabled while using the service.

7. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encrypted data transmission (HTTPS/TLS)
• Passwords hashed with bcrypt (cost factor 12)
• HTTP-only, secure authentication cookies
• Rate limiting on authentication endpoints
• Security headers via Helmet

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. Appointment records and grooming notes are retained to ensure continuity of care for your pet. If you request account deletion, we will delete your personal information within 30 days, except where retention is required by law or for legitimate business purposes (e.g., payment records for tax compliance).

9. Your Rights

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information via your account profile
• Delete your account and associated personal data by contacting us
• Opt out of non-essential communications (promotional emails)
• Request a copy of your data in a portable format

To exercise any of these rights, please contact us at woof@knottypawspa.com.

10. Photos & Media

We may photograph or video record your pet during their visit for our records, social media, and marketing purposes. During booking, you will be asked to review and optionally consent to our Media Release & Photo Authorization. If you do not consent, your photos will not be shared publicly. You may change your preference at any time by notifying us.

11. Children's Privacy

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or how we handle your data, please contact us:

Knotty Paw Spa
6033 W Bell Rd, Suite J
Glendale, AZ 85308
woof@knottypawspa.com
(623) 800-6929