Privacy Policy

1. Introduction and who we are

Susan Scaramucci Lifestyle LLC (“Susan Scaramucci Lifestyle,” “we,” “us” or “our”) is a personal styling, gifting and events concierge based in New York City.

This Privacy Policy explains what personal information we collect through our website at susanscaramucci.com (the “Site”), how we use and share it, how long we keep it, and the choices and rights you have. It applies to the Site and to inquiries, bookings and private offers made through it. It does not apply to websites or services run by others, even when we link to them.

If you have any questions, contact us at hello@susanscaramucci.com.

2. Information we collect

2.1 Information you provide

Contact form. When you send us a note through the contact form, we collect:

• your name, email address and message;
• the services you are interested in and a budget range, which you select on the form;
• your phone number, if you choose to give it; and
• the gift or occasion you selected on the Site, if any.

We store each note in our private storage and usually receive a copy by email (see Section 5). Please do not put sensitive information in your message, such as health information or financial account numbers.

If the form cannot send your note, it may offer to open your own email application with your details already filled in. A message sent that way goes from your email provider straight to our inbox. It does not pass through the Site.

Booking a call. Where online booking is available, you may book a call within 24 hours of sending a note, using the same email address. To make the booking, the Site uses:

• the time and length of the call you choose;
• the name, email address, phone number (if given), message and services from your note; and
• the time zone your browser reports.

We add the booking details to your note in our private storage. Looking up available times sends no personal information to Cal.com.

Whether you book through the Site or directly on our Cal.com booking page, Cal.com sends us the details of the booking, and of any later reschedule or cancellation, and we store them in our private storage. These details include your name, email address, phone number (if given), time zone, notes, the services you are interested in, the time and length of the call, the meeting link and any reason given for a cancellation.

Private offers and payments. If we prepare a private offer for you, we record:

• your name;
• the offer’s title, description and what is included;
• the amount; and
• the offer’s status and the dates it was created and changed.

Each offer has its own unlisted page that search engines are asked not to index. Anyone who has the link can view that page, including your name.

If you pay online, you enter your card details and email address on a checkout page hosted by Stripe, not on the Site. Stripe tells us whether the payment went through and gives us the email address you entered. We store that email address with the time of payment and Stripe’s reference number for the checkout session. We never receive or store your card details.

2.2 Information collected automatically

Visit statistics. The Site measures its own traffic. It uses no cookies and no third-party analytics tools to do this.

When you view a public page, your browser sends our server a short notice, at most once every 30 minutes for the same page. The notice contains the page address and whether the view starts a new visit. At the start of a visit, it also contains the address of the page that referred you and any campaign tag in the link, such as “ref” or “utm_source”.

From this notice, and from the standard information sent with every web request, our server adds to daily totals of:

• the page viewed (private offer pages are counted only as “offer”, without the offer’s code);
• the source of the visit, which is only the name of the referring website, the campaign tag, or “direct” (the rest of the referring address is discarded);
• your country, as a two-letter code that our hosting provider works out from your IP address; and
• your device type (phone, tablet or desktop), read from your browser’s user agent.

To estimate how many different people visited each day without storing who they are, our server combines the date, your IP address and your browser’s user agent with a secret key. This produces a short code that changes every day. The code is added to a counting structure that estimates the number of different visitors. The structure does not keep the codes themselves, and they cannot be read back out of it.

To stop the same visitor being counted too many times, a separate coded value made from your IP address and a secret key is kept for up to one hour.

The visit statistics do not include your IP address. We cannot use them to identify you or to follow you from one day to the next. Visits from known automated tools are filtered out, and our own visits while signed in to the Site’s management area are not counted.

Server logs. Our hosting provider, Vercel, automatically records technical information about requests to the Site. This may include:

• IP address and browser type;
• the page requested, including any query string;
• the referring page;
• approximate location; and
• the time of the request.

Our own application logs record technical errors, such as status codes and error messages, and are not designed to record what you type into forms. Rarely, an error message returned by a service provider may repeat a value that was sent to it, such as an email address.

Abuse protection. To protect the Site and its forms from spam and misuse, we count requests against limits. For limits that last beyond a single request, your IP address (for IPv6 addresses, only the first part, which identifies your network) and, when you send a note or book a call, your email address are turned into coded values with a secret key. These coded values expire automatically (see Section 7). Our application also holds raw IP addresses briefly in the temporary memory of the server handling the request, for short-term limits, and never writes them to storage. This is separate from our hosting provider’s logs described above.

The contact form and the booking step also include a hidden field that people cannot see. It catches automated submissions.

After you send a note, your browser receives a signed token that lets you book a call with the same email address within 24 hours. The token is not stored on our servers.

3. How we use information

We use personal information to:

• answer your inquiries and communicate with you;
• schedule, confirm and hold calls, including video calls;
• plan and provide the styling, gifting and event services you ask for;
• prepare private offers, process payments and confirm that a payment was made;
• keep business and payment records;
• understand, in aggregate, how the Site is used and where visitors come from;
• keep the Site and its forms secure and protect them from spam, fraud and abuse; and
• comply with legal obligations and establish, exercise or defend legal claims.

We do not use personal information for advertising, and we do not build profiles of visitors. We do not make decisions based only on automated processing that have legal or similarly significant effects. The only automated checks on the Site are the spam and abuse protections described above.

4. Legal bases for visitors in the EEA, the UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Contract: to take steps at your request before entering into a contract, to schedule calls, to provide the services you request and to process your payments.
• Legitimate interests: to answer general inquiries, measure use of the Site in aggregate, keep the Site secure, prevent spam and abuse, and keep business records. We rely on these interests only where your rights do not override them.
• Legal obligation: to keep payment and business records as the law requires, and to respond to lawful requests.

We do not currently rely on your consent for the processing described in this Policy.

5. How we share information

We do not sell personal information. We do not share it for cross-context behavioral advertising. We share it only as described below.

Service providers. We use the providers below to run the Site and our services. Each receives personal information only as needed to do its work for us. Each provider’s own terms and privacy policy also govern how it handles information.

• Vercel (hosting, content delivery, server functions, image delivery, server logs and private file storage). Vercel hosts the Site. It also stores contact notes, booking records and private offers in private storage that is not publicly accessible.
• Resend (email delivery). Resend delivers contact notes to our inbox, with every field you filled in, and sets your email address as the reply address. On unusually busy days, some notes are kept only in our private storage and are not emailed. The Site itself does not send email to visitors.
• Our email provider. It holds the notes we receive and our correspondence with you.
• Cal.com (scheduling). When you book a call through the Site, our server sends Cal.com your name, email address, time zone, language (English), message, the services you are interested in and your phone number (if given). Your budget range and gift selection are not sent to Cal.com. Cal.com sends booking confirmations and calendar invitations to you and to us, and sends us the booking details described in Section 2.1.
• Google (calendar and video calls, through Cal.com). Cal.com adds booked calls to our Google Calendar and sets up the call on Google Meet. Google therefore receives the booking details through that integration. Google’s terms apply when you join a call.
• Stripe (payments, for private offers paid online). Stripe receives the offer amount and title, your name as the person the offer was prepared for, and the offer’s reference. Stripe collects your payment details directly.
• Our database provider (visit statistics and abuse protection). It stores the daily visit totals, the coded visitor count and the short-lived coded limit values described in Section 2.2. It does not receive names, readable email addresses or raw IP addresses.

At your direction. We may share information with others when you ask us to.

Legal requirements. We may disclose information if we believe in good faith that it is required by law, regulation, legal process or a government request. We may also disclose it where needed to protect the rights, property or safety of Susan Scaramucci Lifestyle, our clients or others.

Business transfers. Personal information may be transferred as part of a merger, acquisition, financing, reorganization or sale of assets. If that happens, we will take reasonable steps to have it handled in line with this Policy.

6. International transfers

We are based in the United States. Our service providers store and process information in the United States and may also do so in other countries.

If you use the Site from outside the United States, your information will be transferred to, stored in and processed in the United States. Data protection laws there may differ from those in your country.

Where required, transfers from the EEA, the UK or Switzerland rely on appropriate safeguards. These include the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum or Swiss adaptations where relevant, or a provider’s certification under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework.

7. Retention

We keep personal information only as long as needed for the purposes in this Policy, unless the law requires or permits a longer period.

• Contact notes and booking records: kept until we delete them, once they are no longer needed to respond to you, provide our services or keep business records. They are not deleted automatically. Deleting a note also deletes the booking records linked to it. When we delete a booking record, we keep only the booking’s Cal.com reference number and the time it was deleted, so that later updates about that booking are not stored again.
• Copies held elsewhere: deleting a record from our storage does not remove the copies in our inbox or those held by Resend, Cal.com, Google Calendar or Stripe. Those copies are kept under each service’s own settings and policies. On request, we will delete the copies we control where we can.
• Private offers: kept until we delete them. Paid offers are kept as records of the payment.
• Visit statistics: each day’s totals and coded visitor count are deleted automatically about 400 days (about 13 months) after that day. The coded value used to limit counting is deleted within one hour.
• Abuse-protection values: coded limit values made from IP addresses and email addresses expire automatically between 10 minutes and 24 hours after they are first counted. IP addresses held in server memory are never written to storage and are discarded when our hosting provider shuts down the server instance that holds them.
• Server logs: kept by Vercel for the period set by our hosting plan.
• Information stored on your device: see Section 10.

8. Security

We use reasonable technical and organizational measures designed to protect personal information. These include:

• encrypted connections (HTTPS);
• private storage that is not publicly accessible;
• signed tokens;
• a password-protected management area that only Susan Scaramucci Lifestyle can use; and
• rate limits on forms and on sign-in.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your information has been compromised, please contact us.

9. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• object to some processing, or ask us to restrict it;
• receive your information in a portable format; and
• withdraw consent, where we rely on consent.

To use any of these rights, email hello@susanscaramucci.com. We may need to verify your identity first, usually by confirming that you control the email address you gave us. We will respond within the time the law requires. We will not discriminate against you for using your rights.

Some information cannot be linked to you, such as the daily visit statistics. We therefore cannot find or delete it for an individual request.

You can choose not to give your phone number or to add a gift to your note.

California residents. If you live in California, and to the extent the California Consumer Privacy Act applies to us, you have the right to know what personal information we collect, use and disclose, and to ask us to give you access to it, correct it or delete it. We collect:

• identifiers, such as name, email address, phone number and IP address;
• commercial information, such as the services you request, your budget range, offers and payment status;
• internet or other electronic network activity information, such as pages viewed, the referring website, and technical request data in server logs; and
• approximate location (country).

We collect these from the sources and for the purposes described above. We disclose them for business purposes only to the service providers in Section 5, and as described there for legal requirements. We do not sell or share personal information, as California law defines those terms. We do not use or disclose sensitive personal information for any purpose that would give you a right to limit it. You may use an authorized agent to make a request for you.

EEA, UK and Switzerland. You also have the right to complain to the data protection supervisory authority where you live or work, or where you believe an infringement took place. We would welcome the chance to address your concern first.

10. Cookies and similar technologies

The Site’s public pages set no cookies. We do not use advertising cookies, tracking pixels, third-party analytics or social media plug-ins. The Site’s public pages do not load fonts or scripts from other companies.

The Site keeps a few small settings in your browser’s storage. The stored values stay on your device, are not sent to our server and contain no identifier:

• ss-visit (session storage, cleared when you close the tab): records when you last viewed each page. This lets a page view be counted only once every 30 minutes and lets the start of a visit be recognized.
• ss-lite (session storage, cleared when you close the tab): remembers whether to show lighter animations, based on your device’s data-saver or low-power setting or on how smoothly it displays the page.
• ss-hero-order and ss-ig-order (local storage, kept until you clear your browser data): remember the last order in which photos were shown, so your next visit shows a different arrangement.

You can clear or block browser storage in your browser settings. The Site will keep working.

Our password-protected management area is used only by Susan Scaramucci Lifestyle. It sets one strictly necessary cookie, ss_studio, when the owner signs in. The cookie keeps that session signed in for up to 30 days and holds no personal information. Visitors to the Site never receive it.

The Site does not respond differently to Do Not Track signals. We do not track visitors across websites, and we do not sell or share personal information, so there is nothing for a Global Privacy Control signal to opt you out of.

11. Children’s privacy

The Site and our services are meant for adults and are not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

12. Third-party links

The Site links to websites run by others, including Instagram and PhotoCircle. If you pay for a private offer online, the Site sends you to Stripe’s checkout page. Emails from Cal.com about a booking contain links to Cal.com pages, such as reschedule and cancellation pages, and to Google Meet.

These are ordinary links. The Site’s public pages do not embed content from these services or load their scripts. When you visit them, their own terms and privacy policies apply, and we are not responsible for how they handle information.

13. Changes to this policy

We may update this Policy from time to time. When we do, we will post the new version on this page and change the “Last updated” date. If we make material changes, we will give additional notice where the law requires it.

14. Contact us