We document our data handling practices with complete transparency so visitors know exactly what our Charlotte studio records.

This privacy statement took effect on October 18, 2026, and governs all technical access, inquiry submissions, and consultation records gathered through the domain vellune.click. We update this text whenever studio data collection practices change or when relevant state and federal advertising requirements require procedural amendments.

All policies established herein apply to prospective clients inquiring about facial aesthetic appointments, skincare consultations, brow waxing sessions, and cosmetic masterclasses conducted at our Charlotte boutique.

The operational controller responsible for decisions concerning your personal data is Vellune, trading at the web address vellune.click. Our single physical studio premises are located at:

Product oversight, formulation vetting, and service compliance are managed by Irina Petrova, Product Manager, active with the business since 2021.

We do not operate an online shopping cart, client accounts, or credit card processing gateways. The scope of information collected through vellune.click is strictly confined to four discrete channels:

• Inquiry Form Data: When you complete an intake request via nesi220.php, we collect your full name, telephone number, email address, physical street address or postal code, the specific category of service requested (such as Full Face, Brow Wax, Feature Focus, or Beauty Lesson), written notes, requested product formulation specifications, and your affirmative consent confirmation.
• Automated Technical Headers: Our web server automatically writes your IP address, browser user-agent header string, referring URL, timestamp of initial page delivery, and timestamp of form transmission.
• Studio Live Chat Transcripts: When opening our interactive consultation widget via morib98.php, the system stores your typed conversational text along with a locally generated persistent session token in your browser so you may resume dialogue across visits.
• Advertising Identifiers & Consent Keys: We record the visitor choice parameter under the local browser key site_consent_v2. When landing through paid advertising campaigns, incoming URLs carry ad click identifiers including gclid for Google Ads, msclkid for Microsoft Advertising, and fbclid for Meta Ads.

Each item of recorded data serves an explicit operational purpose inside our Charlotte studio:

• Consultation Review & Scheduling: Your contact details and requested service categories allow Irina Petrova and our studio aestheticians to check appointment slots, review contraindications, and formulate pricing estimates.
• Customer Correspondence: We use your phone or email to respond to specific questions regarding skin barrier prep, botanical waxing ingredients, or masterclass curriculum details.
• Platform Security & Fraud Prevention: Automated network headers, submission timestamps, and hidden honeypot validation fields protect our inquiry infrastructure against spam, automated abuse, and distributed attacks.
• Advertising Performance Measurement: Click parameters and privacy-safe conversion pings allow us to verify campaign reach and return on ad spend without compiling longitudinal user dossiers.

Under international and domestic statutory standards, we rely on three lawful bases for data handling:

Vellune actively directs paid commercial web traffic to this domain. We do not claim that ad platforms have reviewed or endorsed our studio. The marketing services sending live traffic to vellune.click include google ads, microsoft advertising, and Meta Ads.

When an individual clicks a sponsored studio placement, the destination URL receives a specific click parameter:

• gclid (Google Click Identifier) supplied by google ads to monitor search and display campaign interactions.
• msclkid (Microsoft Click Identifier) supplied by microsoft advertising to track Bing network search queries.
• fbclid (Facebook Click Identifier) supplied by Meta Ads to measure sponsored Instagram and Facebook promotions.

These tags operate in strict alignment with our Consent Mode v2 implementation described below.

Our website operates Consent Mode v2 directly inside the front-end runtime. By default, before any visitor interaction with our consent dialog, four core storage parameters remain strictly held in a denied state:

If you press "Reject Optional", all four parameters remain denied. Only when you click "Accept All" are these four signals updated to granted. If you later reopen your preferences and withdraw consent, the engine immediately sets ad_storage, ad_user_data, ad_personalization, and analytics_storage back to denied.

Vellune never sells, trades, or rents customer inquiry data to marketing brokers. We share data only with designated technical processors necessary to deliver our website and fulfill booking inquiries:

• Google LLC / Google Ireland Ltd: Operates Google Ads measurement and infrastructure analytics under strictly governed standard contractual clauses.
• Microsoft Ireland Operations Ltd: Manages Microsoft Advertising conversion reporting; full details on their processing standards can be examined directly at privacy.microsoft.com.
• Meta Platforms Ireland Ltd: Processes Meta Ads campaign signals when prospective clients interact with social studio placements.
• Hosting & Server Infrastructure Provider: Houses our server infrastructure, processes nesi220.php scripts, and stores database entries inside hardened United States facilities with full encryption.
• Transactional Mail Routing Service: Delivers intake inquiry notifications directly to office@vellune.click with transport-layer encryption.

Our server facilities and primary business operations reside in Charlotte, North Carolina, United States. If you visit vellune.click from outside the United States, your transmission originates in your home jurisdiction and terminates on American servers.

For visitors accessing our domain from the European Economic Area, Switzerland, or the United Kingdom, cross-border data movements are protected through Standard Contractual Clauses (SCCs) executed with our enterprise service vendors, ensuring equivalent data privacy protection regardless of geographical destination.

We do not keep personal records indefinitely or under vague terms. We enforce exact calendar deletion limits across every category of studio data:

• Inquiries and Email Records: Kept for exactly 36 months following your initial appointment request to enable recurring consultation tracking, after which records are purged.
• Chat Transcripts: Stored on our application server for exactly 12 months to provide continuity during multi-stage beauty consultations.
• Server Access Logs: Web server access logs, diagnostic IP logs, and system error traces are purged after 30 days.
• Tracking Consent Selections: The browser storage record of your consent choice (site_consent_v2) expires after 12 months, prompting re-selection.
• Data Subject Access Inquiries: Any formal DSAR submission is reviewed and resolved with an answer within 5 days.

We employ multi-layered technical controls to prevent unauthorized access, alteration, or disclosure of submitted information. All network traffic between your device and vellune.click is encrypted using modern Transport Layer Security (TLS 1.3). Server endpoints enforce strict HTTP security headers including Content-Security-Policy and HSTS.

Internally, access to client inquiry forms and master consultation notes is restricted strictly to Irina Petrova and designated studio management. We maintain physical access controls at our Charlotte facility and enforce tokenized authentication across our administration backends.

For visitors reaching our studio website from the European Union, United Kingdom, or Switzerland, the provisions of the gdpr grant you explicit individual rights regarding your personal records:

• Right of Access: You may request a complete portable copy of every personal record we retain regarding your inquiries.
• Right to Rectification: You may correct inaccurate or out-of-date personal data, including telephone numbers and skincare notes.
• Right to Erasure (Right to Be Forgotten): You may demand the full deletion of your consultation history, subject to statutory tax and legal requirements.
• Right to Restriction of Processing: You may pause processing while accuracy claims are investigated.
• Right to Data Portability: You may receive your submitted data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to data processing carried out under our legitimate interest grounds.
• Right to Withdraw Consent: You may withdraw your tracking consent at any moment via our footer consent control without penalty.

Residents of California and other states with comprehensive privacy legislation are endowed with statutory rights under the ccpa (California Consumer Privacy Act as amended by the CPRA) and applicable state frameworks in Virginia, Colorado, Connecticut, Utah, and North Carolina:

• Right to Know & Access: You have the right to request disclosure of the specific pieces of personal information collected over the preceding 12 months.
• Right to Delete: You can instruct us to permanently purge your submitted personal information from our databases.
• Right to Correct: You may demand correction of inaccurate personal data maintained in our records.
• Right to Opt Out of Sale or Sharing: Vellune does not sell personal information for monetary payment. However, to the extent that third-party ad parameters are classified as "sharing" for cross-context behavioral advertising, you hold the absolute right to opt out.
• Right to Non-Discrimination: We never alter service pricing, treatment quality, or session availability if you choose to exercise your legal privacy entitlements.

Our web application actively recognizes the global privacy control (GPC) specification transmitted via the Sec-GPC request header. If your browser broadcasts this signal, our front-end runtime automatically interprets it as a valid, affirmative directive to opt out of marketing cookies and cross-context behavioral advertising sharing.

When global privacy control is detected, Consent Mode v2 signals are locked in the denied state without requiring you to open the cookie banner or submit a manual opt-out inquiry.

Vellune is an adult cosmetic and wellness destination. Our facial waxing treatments, beauty masterclasses, and topical cosmetic formulations are engineered strictly for adults aged 18 and older. In compliance with advertising policies and the Children's Online Privacy Protection Act (COPPA), this website is neither directed toward nor intended for minors under 18 years of age.

We do not knowingly collect, solicit, or maintain personal information from individuals under 18. If we discover that an inquiry form has been submitted by a minor, the information is immediately and permanently expunged from our storage systems.

If you believe our studio has failed to honor your statutory privacy entitlements, you have the right to lodge a formal complaint with relevant regulatory authorities:

• United States: You may lodge a complaint with your respective state Attorney General (such as the North Carolina Department of Justice in Raleigh, NC) or the California Privacy Protection Agency (CPPA) if residing in California.
• European Union / UK: You have the right to contact the Data Protection Authority in your member state of habitual residence, place of work, or where an alleged infringement occurred.

We encourage you to contact our management team directly at office@vellune.click beforehand so we may swiftly address and resolve any procedural concerns.

To exercise any of the statutory privacy rights enumerated above—including access, deletion, rectification, or opt-out of data sharing—please submit a formal request using either of the following contact routes:

To safeguard your personal information, we verify your identity by confirming that your incoming request originates from the email address or telephone number originally recorded on your consultation intake ticket. Every verified data request is answered within 5 days with an acknowledgment and resolution.

As studio cosmetic protocols evolve or when online platform terms are amended, we revise this privacy disclosure accordingly. Any modification will be posted directly to this page with an updated effective date stamped at the top of the document.

For material modifications affecting the processing bases or retention limits of active consultation records, we provide prominent advance notification across the studio website or by direct electronic message to active clients holding current appointment reservations.

If you have questions regarding this privacy statement, the technical functioning of Consent Mode v2, or how Irina Petrova handles studio records, you can reach a human representative directly: