338 N Riverland Dr · Door B1 · Crested Butte, CO Get Directions Mon–Fri 10am–5pm Call us
Book
The Loft

Privacy Policy

Last updated September 15, 2026

We are The Loft — Hair & Skin Lab. This privacy policy outlines how we collect, use, and protect your personal information when you use our services.

Introduction

What is this policy about?

This document explains how this website collects, uses, and protects your personal data to achieve the purposes outlined in this document.

What is personal data?

Personal data refers to information that can be used to identify you directly or indirectly. This includes details such as first name, last name, email address, tracking technologies (like cookies or tracking pixels), user activity, and device information. You can find detailed information on each type of personal data collected in dedicated sections of this privacy policy or in text shown before data is collected.

Contact information

Please reach us through our contact page, where our current contact details are listed.

The Loft — Hair & Skin Lab
338 N Riverland Dr, Door B1
Crested Butte, Colorado 81224

Types of data collected

The types of personal data that this website collects, by itself or through third parties, may include:

  • first name;
  • last name;
  • email address;
  • phone number;
  • Trackers;
  • Usage data

Complete details on each type of personal data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the data collection. Personal data may be freely provided by you, or, in case of Usage data, collected automatically when using this website. Unless specified otherwise, all data requested by this website is mandatory and failure to provide this data may make it impossible for this website to provide its services. In cases where this website specifically states that some personal data is not mandatory, you are free not to communicate this data without consequences to the availability or the functioning of the service.

Any use of cookies – or of other tracking tools — by this website or by the owners of third-party services used by this website serves the purpose of providing the service required by you, in addition to any other purposes described in the present document. You are responsible for any third-party personal data obtained, published or shared through this website.

Mode and place of processing personal data

Methods of processing

We take appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the data. The data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to ourselves, in some cases, the data may be accessible to certain types of persons in charge, involved with the operation of this website, or to external parties appointed, if necessary, as data processors by us. The updated list of these parties may be requested from us at any time.

Place

The data is processed at our operating offices and in any other places where the parties involved in the processing are located. Depending on your location, data transfers may involve transferring your data to a country other than your own.

Retention time

Unless specified otherwise in this document, personal data shall be processed and stored for as long as required by the purpose they have been collected for and may be retained for longer due to applicable legal obligation or based on your consent.

Detailed information on the processing of personal data

Your personal data is collected to allow us to provide our service, comply with our legal obligations, respond to enforcement requests, protect our rights and interests (or yours or those of third parties), detect any malicious or fraudulent activity, as well as the purposes set out below.

Analytics — Umami

This website uses Umami, a privacy-friendly analytics service, to understand how the website is used. Umami does not use cookies and does not collect or store personal data that identifies you. It records aggregated usage data such as pages viewed, referring website, and general device or browser type.

Personal data processed: Usage data.

Displaying content from external platforms — Google Fonts (Google LLC)

Google Fonts is a typeface visualization service provided by Google LLC that allows this website to incorporate fonts on its pages. To understand Google's use of data, consult Google's privacy policy at https://business.safety.google/privacy/.

Personal data processed: Trackers; Usage data. Place of processing: United States.

Booking — Vagaro

Appointments are booked through Vagaro, a third-party booking service. When you choose to book, you are directed to Vagaro and any information you provide there is processed under Vagaro's own privacy policy.

Personal data processed: first name; last name; email address; phone number, as provided by you to Vagaro.

Contact — email and phone

By contacting us by email or phone, you authorize us to use these details to reply to your requests for information, quotes or any other kind of request. Personal data processed: email address; name; phone number.

Further information

Legal basis of processing

We may process personal data relating to you if you have given your consent or for one or more specific purposes: provision of data is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof; processing is necessary for compliance with a legal obligation to which we are subject; processing is related to a task carried out in the public interest; or processing is necessary for the purposes of the legitimate interests pursued by us or by a third party. We will gladly help to clarify the specific legal basis that applies.

Understanding how long we keep your information

When we collect your personal information, we keep it for as long as required for the purposes we collected it for. Sometimes, we might need to keep your personal information longer due to a legal obligation or based on your consent. Once the retention period expires, your personal data will be deleted.

Your rights based on the General Data Protection Regulation (GDPR)

You may exercise certain rights regarding your data processed by us. In particular, to the extent permitted by law, you have the right to:

  • Withdraw your consent at any time.
  • Object to processing of your data.
  • Access your data and obtain a copy of it.
  • Verify and seek rectification of inaccurate data.
  • Restrict the processing of your data.
  • Have your personal data deleted or otherwise removed.
  • Receive your data and have it transferred to another controller.
  • Lodge a complaint before your competent data protection authority.

Any requests to exercise your rights can be directed to us using the contact details at the start of this document. Such requests are free of charge and will be answered by us as early as possible.

Further information for California residents (CCPA/CPRA)

This section supplements the rest of the privacy policy and applies to users who are consumers residing in the state of California, under the California Consumer Privacy Act (CCPA), as updated by the California Privacy Rights Act (CPRA).

Categories of personal information we collect

We have collected the following categories of personal information: identifiers, and internet or other electronic network activity information. We do not collect sensitive personal information. We will not collect additional categories of personal information without notifying you.

Your California privacy rights

You have the right to request that we disclose the personal information we collect, use, and disclose; the right to request the deletion of your personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of your personal information; and the right of non-discrimination for exercising your rights. We do not sell your personal information for money.

How to exercise your rights

To exercise the rights described above, submit a verifiable request to us through our contact page. We will confirm receipt within 10 days and respond within 45 days of receipt; should we need more time, we will explain why and may take up to 90 days.

Additional information about data collection and processing

Legal action

Your personal data may be used for legal purposes by us in Court or in the stages leading to possible legal action arising from improper use of this website or the related services. You declare to be aware that we may be required to reveal personal data upon request of public authorities.

System logs and maintenance

For operation and maintenance purposes, this website and any third-party services may collect files that record interaction with this website (system logs) or use other personal data (such as the IP address) for this purpose.

Changes to this privacy policy

We reserve the right to make changes to this privacy policy at any time by notifying you on this page. It is strongly recommended to check this page often, referring to the date of the last modification listed at the top.

Definitions and legal references

Personal data (or data): Any information that directly, indirectly, or in connection with other information allows for the identification or identifiability of a natural person.

Usage data: Information automatically collected through this website or third-party services, including your IP address, browser type, operating system, time and method of requests, response status, visit duration, page sequence, and device-specific details.

Cookie: Cookies are trackers consisting of small sets of data stored in your browser.

Tracker: Any technology — e.g. cookies, unique identifiers, web beacons, embedded scripts and fingerprinting — that enables the tracking of you.

This privacy policy relates solely to this website, if not stated otherwise within this document.