Privacy Policy

1. Who We Are

This Privacy Policy describes the practices of Backvrbeaut.ddd ("we," "us," or "our"), a business operating in the United States. We are responsible for the personal information collected through backvrbeaut.world (the "Website").

Business Contact Information:
Backvrbeaut.ddd
605 37th Street S
Birmingham, AL 35222
United States
Email: reach@backvrbeaut.world
Phone: +1 (205) 547-0722

2. Scope and Applicable Law

This Policy applies to personal information we collect when you visit the Website, submit our contact form, communicate with us by email or phone, or interact with cookies and similar technologies. Our primary audience is located in the United States.

We comply with applicable U.S. federal privacy requirements, including the Children's Online Privacy Protection Act (COPPA), the CAN-SPAM Act (for commercial email), Section 5 of the Federal Trade Commission (FTC) Act (prohibiting unfair or deceptive practices), and the California Online Privacy Protection Act (CalOPPA). Where state comprehensive privacy laws apply to our processing — including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), and similar state statutes — we honor the rights described in Section 9 of this Policy.

3. Categories of Personal Information We Collect

In the preceding 12 months, we may collect the following categories of personal information as defined under U.S. state privacy laws:

• Identifiers: name, email address, IP address, and online identifiers stored in cookies or local storage.
• Internet or other electronic network activity information: browsing history on our Website, pages viewed, referring URLs, session duration, browser type, device type, and operating system.
• Customer records information: information you provide in contact form messages or email correspondence.
• Inferences: general preferences derived from your cookie consent choices and Website interaction patterns, where analytics cookies are enabled with your consent.

3.1 Information You Provide Directly

• Contact form: name, email address, message content, and confirmation that you agree to our privacy practices.
• Email and phone: any personal information you choose to include when contacting us.

3.2 Information Collected Automatically

• Technical and usage data: IP address, browser type and version, operating system, device type, referring URL, pages visited, timestamps, and cookie identifiers.
• Cookie and tracking data: as described in our Cookie Policy.

3.3 Sensitive Personal Information

We do not intentionally collect sensitive personal information as defined under the CPRA (such as precise geolocation, racial or ethnic origin, health data, biometric data, or government ID numbers) through the Website. Please do not submit sensitive information through our contact form.

3.4 Sources of Personal Information

We collect personal information directly from you, automatically from your device when you use the Website, and from third-party service providers (such as hosting and analytics providers) that assist in operating the Website.

4. How We Use Personal Information

We use personal information for the following business and commercial purposes:

• Responding to inquiries submitted through the contact form, email, or phone.
• Operating, maintaining, and securing the Website.
• Detecting, preventing, and addressing fraud, abuse, or technical issues.
• Understanding how visitors use the Website to improve content and usability, where you have consented to analytics cookies.
• Measuring marketing effectiveness, where you have consented to marketing cookies.
• Complying with applicable legal obligations, court orders, and lawful government requests.
• Enforcing our Terms of Use and protecting our legal rights.

We do not use personal information for automated decision-making that produces legal or similarly significant effects. We do not offer financial incentives in exchange for the collection or retention of personal information.

5. How We Disclose Personal Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising (often referred to as "sharing" under the CPRA).

We may disclose personal information to the following categories of recipients for business purposes only:

• Service providers: hosting companies, email delivery services, and IT security vendors that process data on our behalf under written contracts requiring confidentiality and limited use.
• Analytics providers: only when you have opted in to analytics cookies through our cookie banner.
• Legal and safety recipients: law enforcement, regulators, or other parties when required by law or to protect rights, safety, and security.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to continued protection of your information.

We do not disclose personal information to third parties for their own direct marketing purposes.

6. Cookies and Tracking Technologies

We use cookies, local storage, and similar technologies as described in our Cookie Policy. Non-essential cookies are placed only after you provide consent through our cookie banner. You may withdraw consent at any time by adjusting Cookie Settings on the Website or clearing your browser storage.

Do Not Track: Some browsers transmit "Do Not Track" (DNT) signals. Because there is no uniform industry standard for responding to DNT signals, we do not currently alter our practices when we receive such a signal. California residents may use the Global Privacy Control (GPC) signal as described in Section 9.

7. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law. Retention periods are determined based on the nature of the data, the purpose of processing, and applicable legal requirements:

• Contact form submissions and email inquiries: up to 24 months from the date of last communication, unless needed longer for legal or dispute resolution purposes.
• Server and security logs: up to 90 days.
• Cookie consent records: up to 12 months.
• Analytics data: according to the analytics provider's settings, typically up to 26 months, only where you have consented to analytics cookies.

When retention periods expire, we delete or de-identify personal information using commercially reasonable methods.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including HTTPS encryption in transit, access controls limiting employee and contractor access, and secure hosting environments. No method of transmission or storage is 100% secure. You are responsible for maintaining the security of devices and accounts you use to access the Website.

In the event of a data breach affecting personal information that triggers notification obligations under applicable U.S. state law, we will notify affected individuals and regulators as required by law.

9. Your Privacy Rights (United States)

Depending on your state of residence, you may have some or all of the following rights regarding your personal information. We will not discriminate against you for exercising these rights.

• Right to know / access: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, purposes, and categories of third parties to whom we disclose it.
• Right to delete: request deletion of personal information we collected from you, subject to exceptions under applicable law (such as legal compliance or security needs).
• Right to correct: request correction of inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing: we do not sell or share personal information for cross-context behavioral advertising. No opt-out request is necessary for those activities because we do not engage in them.
• Right to limit use of sensitive personal information: not applicable, as we do not collect sensitive personal information as defined under the CPRA.
• Right to portability: request a copy of certain personal information in a portable, readily usable format where technically feasible (available in California and certain other states).
• Right to appeal: residents of Virginia, Colorado, Connecticut, and certain other states may appeal our response to a privacy request if denied. Instructions for appeals are provided in our response to your initial request.

9.1 How to Submit a Request

To exercise your rights, contact us at:

• Email: reach@backvrbeaut.world
• Phone: +1 (205) 547-0722
• Mail: 605 37th Street S, Birmingham, AL 35222, United States

We will verify your identity before fulfilling a request. Verification may require you to respond from the email address associated with your inquiry or provide additional information reasonably necessary to confirm your identity. Authorized agents may submit requests on your behalf where permitted by law, provided they submit proof of authorization as required by applicable state statute.

We will respond within 45 days of receiving a verifiable request, as required by the CCPA/CPRA and comparable state laws. If additional time is needed, we will notify you and may extend the response period by up to 45 additional days where permitted by law.

Your Privacy Choices — Do Not Sell or Share My Personal Information

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to opt out of the sale or sharing of personal information. We do not sell or share your personal information for cross-context behavioral advertising or monetary consideration. No action is required to opt out of activities we do not perform.

If our practices change in the future, we will update this Policy and provide a clear opt-out mechanism before any sale or sharing begins. You may also submit a request at any time using the contact methods in Section 9.1. We honor Global Privacy Control (GPC) signals as an opt-out of sale/sharing where applicable.

9.2 California Residents — Additional Disclosures

Under California Civil Code Section 1798.100 et seq. (CCPA/CPRA):

• We have not sold or shared personal information in the preceding 12 months.
• We do not use or disclose sensitive personal information for purposes other than those permitted by the CPRA.
• California residents may request information about disclosures for direct marketing under California's "Shine the Light" law (Civil Code Section 1798.83). Because we do not disclose personal information to third parties for their direct marketing, no such disclosures have been made in the prior calendar year.
• If you use the Global Privacy Control (GPC) browser signal, we treat it as a valid opt-out of sale/sharing. Because we do not sell or share personal information, the signal is honored by default.

9.3 Other State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may exercise rights similar to those listed above. Contact us using the methods in Section 9.1. If you are unsatisfied with our response, you may contact your state attorney general's office.

10. Children's Privacy (COPPA)

The Website is intended for a general audience and is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided personal information to us, contact us immediately at reach@backvrbeaut.world. We will promptly delete such information upon verification.

11. Communications and Marketing

If we send commercial email to you, we comply with the CAN-SPAM Act. You may opt out of marketing emails at any time by following the unsubscribe instructions in the email or contacting us directly. We do not send unsolicited text messages through the Website contact form process.

12. Third-Party Links and Services

The Website may contain links to third-party websites or embedded content (such as Google Maps on our contact page). We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you access.

13. International Visitors

If you access the Website from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where the General Data Protection Regulation (GDPR) or UK GDPR applies, our legal bases include consent, legitimate interests, contract performance, and legal obligation. EEA and UK residents may contact us to exercise GDPR rights and may lodge a complaint with their local supervisory authority.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. Where required by applicable law, we will provide additional notice (such as a banner on the Website) before material changes take effect. Your continued use of the Website after the effective date constitutes acceptance of the revised Policy.

15. Contact Us

For privacy questions, requests to exercise your rights, or concerns about our privacy practices:

Email: reach@backvrbeaut.world
Phone: +1 (205) 547-0722
Mail: 605 37th Street S, Birmingham, AL 35222, United States