Privacy Policy, Marketing Identifier Disclosure, and Statutory Data Rights

This privacy policy took effect on October 19, 2026 (2026-10-19) and governs all personal information, diagnostic consultation notes, inquiry submissions, and telemetry data collected through the digital catalog operating at glowmuses.click as well as during in-person visits to our studio located at 224 Southwest 1st Avenue, Portland, Oregon 97204.

The controller responsible for your personal data under United States federal and state privacy statutes and European data protection law is Glowmuses, trading under the registered domain glowmuses.click. The controller maintains its physical office, consultation facility, and client records at 224 Southwest 1st Avenue, Portland, Oregon 97204, Portland, Oregon, United States. Telephone inquiries are received at +1 (594) 555-2913 and electronic inquiries at office@glowmuses.click.

We collect and record only specific, enumerated information required for diagnostic skincare advice and regulatory auditing. Through our inquiry form (fadud08.php), we receive full legal name, telephone number, email address, physical postal location, inquiry classification (consultation or product category), active ingredient specifications, and current regimen notes. Along with every submission, our server logs capture the network IP address, browser user-agent string, referring URL, time of page generation, and time of submission. Through the studio support chat (mawe02e.php), we collect direct dialogue transcripts and a persistent local browser token. Through our consent banner, we record your selection under the local storage key site_consent_v2. We do not operate customer accounts, do not accept passwords, and do not process, collect, or store payment cards or financial transactions on this website.

Data collected is processed exclusively for discrete operational tasks: evaluating skin barrier compatibility before dispensing active topical formulations; scheduling sixty-minute diagnostic consultations or routine audits with Irina Petrova; routing email confirmations and answering client inquiries; defending website infrastructure against automated spam and denial-of-service abuse via honeypot tokens; and measuring paid advertisement conversion efficacy when visitors arrive from designated marketing platforms.

Processing of personal data is founded upon defined statutory legal bases: (a) Consent under GDPR Article 6(1)(a) and relevant state statutes for marketing cookie storage, advertising measurement signals, and optional email follow-up; (b) Performance of a Contract or Pre-Contractual Measures under GDPR Article 6(1)(b) for processing consultation reservations, custom formulation pricing, and catalog inquiries; and (c) Legitimate Interests under GDPR Article 6(1)(f) for maintaining system security, server log retention, fraud detection, and preventing cross-reaction of dispensing incompatible active acids.

This website actively receives paid advertising traffic from Google Ads, Microsoft Advertising, and Meta Ads. When an advertising campaign directs traffic to glowmuses.click, specific click identifier parameters are attached to the destination URL. Specifically, Google Ads attaches the gclid parameter; Microsoft Advertising attaches the msclkid parameter; and Meta Ads attaches the fbclid parameter. These parameters are parsed to measure ad delivery performance and ensure promotional attribution, operating strictly subject to the visitor's affirmative storage consent.

We deploy Google Consent Mode v2 across this domain. Prior to the visitor providing explicit consent through our banner interface, all four designated marketing and analytics signals—specifically ad_storage, ad_user_data, ad_personalization, and analytics_storage—remain in a strictly denied state. No tracking cookies or advertising identifiers are written while in this state. If the visitor grants affirmative consent, these signals are updated to granted. If the visitor selects decline, or subsequently revokes consent via the footer settings control, all four parameters are immediately reset to denied.

Data collected through glowmuses.click is shared exclusively with named service providers performing contracted technical functions: (1) Google LLC / Google Ireland Ltd for search and shopping ad measurement; (2) Microsoft Ireland Operations Ltd / Microsoft Corporation for Microsoft Advertising campaigns, subject to the official Microsoft Privacy Statement available at privacy.microsoft.com; (3) Meta Platforms Ireland Ltd / Meta Platforms Inc for social campaign measurement; (4) our contracted web hosting infrastructure provider hosting our inquiry database and Apache/PHP runtime in secure United States data centers; and (5) our authenticated transactional mail gateway delivering incoming inquiries to office@glowmuses.click.

All primary databases, consultation logs, and mail servers are hosted within the United States. For visitors accessing this site from the European Economic Area or the United Kingdom, your data is transferred to the United States. Lawful cross-border transfer mechanisms are satisfied through Standard Contractual Clauses (SCCs) approved by the European Commission, as well as operational alignment with the EU-U.S. Data Privacy Framework commitments maintained by our platform partners.

We do not store information indefinitely. We observe strict, quantified retention clocks: (a) Inquiry form submissions and their mirrored administrative email copies are retained for exactly thirty-six (36) months to maintain client consultation continuity and ingredient tolerance history; (b) Studio chat conversation transcripts are retained for twelve (12) months; (c) Web server access, security, and error logs are deleted after ninety (90) days; (d) The local browser record of your consent choice (site_consent_v2) persists for twelve (12) months unless cleared manually; and (e) Statutory data rights requests (DSAR) are acknowledged immediately and answered definitively within seven (7) business days.

We maintain strict administrative, technical, and physical safeguards at 224 Southwest 1st Avenue and within our digital hosting infrastructure. Digital communications are encrypted in transit via Transport Layer Security (TLS 1.3). Server endpoints enforce least-privilege administrative access, automated rate-limiting, hardened Linux permissions, and continuous intrusion monitoring. Client consultation ledgers and patch test notes stored on site are kept in locked apothecary filing storage accessible solely by licensed staff.

Visitors residing in the European Economic Area or United Kingdom hold comprehensive statutory rights under the General Data Protection Regulation (gdpr): (a) Right of Access to confirm processing and obtain copies of stored records; (b) Right to Rectification of inaccurate skin profile or contact details; (c) Right to Erasure ('right to be forgotten'); (d) Right to Restriction of ongoing processing; (e) Right to Data Portability in a structured, machine-readable format; (f) Right to Object to processing based on legitimate interest; and (g) Right to Withdraw Consent at any moment without affecting prior lawful processing.

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa) and comparable state legislation in Oregon, Washington, Colorado, Virginia, Connecticut, and Utah, residents possess specific entitlements: the right to know what personal data categories are collected; the right to request deletion of personal information; the right to correct inaccurate personal data; the right to equal service and non-discrimination for exercising privacy privileges; and the absolute right to opt out of the sale or sharing of personal data. Glowmuses does not sell personal information for monetary consideration. Any sharing of pseudonymous marketing identifiers with ad networks is governed strictly by the visitor's consent options.

Our website programmatically detects and honors the Global Privacy Control (global privacy control or Sec-GPC) signal transmitted by compatible web browsers. When an incoming browser request contains an active GPC header, our system automatically treats the directive as a verified instruction to deny all advertising and marketing storage, setting ad_storage, ad_user_data, and ad_personalization to denied without requiring secondary manual interaction.

The catalogue, consultations, and professional facial skincare formulations offered by Glowmuses are directed exclusively to adults aged eighteen (18) years and older. We do not knowingly solicit, collect, or store personal information from individuals under the age of sixteen (16). In the event that we discover personal information belonging to a minor has been transmitted through our inquiry forms, that data will be purged immediately from active ledgers and server databases.

If you believe our processing of your personal information infringes statutory privacy standards, you maintain the legal right to lodge a formal complaint with a competent supervisory authority. In the United States, you may petition your state Attorney General (including the Oregon Department of Justice, Financial Fraud and Consumer Protection Section) or the California Privacy Protection Agency (CPPA). In the European Union, complaints may be submitted to your national Data Protection Authority.

To exercise your statutory rights of access, correction, deletion, or portability, you may submit a formal request using the intake form below or send written notice directly to our designated compliance officer at office@glowmuses.click or via certified mail to Glowmuses, Attn: Data Privacy Officer, 224 Southwest 1st Avenue, Portland, Oregon 97204. We verify the identity of the requester to safeguard client records and provide a substantive statutory response within seven (7) business days.

We periodically review this policy to reflect modifications in apothecary studio procedures, regulatory developments, or advertising network requirements. Any revisions will be published directly to this page with an updated effective date stamped at the top of this statute record. Continued interaction with glowmuses.click following notice constitutes acknowledgment of updated terms.

For inquiries regarding this privacy statute or our clinical handling of skincare consultation records, please contact our human compliance team directly: Telephone: +1 (594) 555-2913; Email: office@glowmuses.click; Postal: Glowmuses Studio, 224 Southwest 1st Avenue, Portland, Oregon 97204, Portland, Oregon, United States.