Privacy policy and explicit advertising tracking disclosures.

Effective Date & Document History

This privacy policy took effect on October 17, 2026. It applies to all electronic inquiries, appointment requests, consultation conversations, and automated network traffic received through elvora.click and in-person intake records at our Charlotte studio.

Identity of the Data Controller

The data controller responsible for personal information gathered through this website is Elvora, trading at elvora.click.

Operator Legal Identity: Elvora Beauty Studio & Cosmetic Bar
Physical & Postal Address: 130 North Tryon Street, Charlotte, North Carolina 28202, Charlotte, North Carolina, United States
Telephone Desk: +1 (464) 555-7461
Direct Administrative Email: office@elvora.click
Supervising Product Specialist: Irina Petrova, Product Manager, active since 2021.

Categories of Data Collected

We collect personal information directly when you initiate contact, and technical log information automatically when your web browser queries our server. Specifically:

• Inquiry Form Submissions (via pefo218.php): We record your full name, telephone number, email address, physical mailing or street address, the category of inquiry, requested service specification, freeform consultation notes regarding topical sensitivities, and your affirmative consent confirmation.
• Server Log Information: With every HTTP/HTTPS request, our web infrastructure logs the visitor's Internet Protocol (IP) address, browser user-agent string, operating system profile, timestamp of submission, referring web address, and unix rendering time.
• Studio Support Chat (via keli639.php): Messages exchanged with our desk widget are stored along with a random session authentication token persisted in your browser's localStorage.
• Consent Selection: Your cookie preference is persisted in browser storage under the key site_consent_v2.
• Advertising Identifiers: When you arrive via paid marketing campaigns, URLs carry parameter click identifiers including Google Ads click ID (gclid), Microsoft Advertising click ID (msclkid), and Meta Ads click ID (fbclid).

We do not maintain user accounts, require passwords, or process credit card numbers on this website. Our online service is inquiry-only; all quotes and payment arrangements are handled directly in person or via verified invoice rather than automated web channels.

Purposes of Personal Data Processing

We process your information for explicit operational purposes:

• Evaluating prospective appointments for in-studio services (Full Face $60, Brow Wax $22, Feature Focus $30, Mini Makeover $15, Duo Wax $30, Beauty Lesson $75, Special Occasion $90, Trio Wax $40).
• Verifying skin contraindications such as recent retinoid or AHA usage to prevent barrier lifting during facial wax treatments.
• Supplying formulation quotations for barrier creams, mineral powders, topical cosmetic capsules, and softgel supplements based on packaging unit quantities and ingredient concentrations.
• Maintaining digital audit trails for appointment reminders, customer service inquiries, and product quality remedy evaluations.
• Measuring advertising efficiency and attributing paid marketing traffic to legitimate business inquiries across authorized campaign networks.

Legal Bases for Processing

Under applicable US and European data protection standards, Elvora relies on the following lawful bases:

Paid Advertising Platforms & Click Identifiers

This website is a direct landing destination for paid digital marketing campaigns. Google Ads, Microsoft Advertising, and Meta Ads actively send paid commercial traffic to elvora.click today.

To evaluate audience acquisition and campaign performance, inbound landing links may append platform-specific click identifiers to destination URLs:

• google ads: Appends the gclid (Google Click Identifier) parameter to inbound landing pages to measure campaign interactions, search term relevance, and appointment inquiry conversion rates.
• microsoft advertising: Appends the msclkid (Microsoft Click Identifier) parameter to inbound traffic from Bing search and audience networks. Microsoft Advertising handles query telemetry under its dedicated privacy infrastructure.
• meta ads: Appends the fbclid parameter to links clicked within Meta platforms (Facebook, Instagram) to trace ad delivery and lead attribution.

Consent Mode v2 Technical Implementation

Our web properties strictly comply with Google Consent Mode v2. When a visitor lands on elvora.click, tracking tags and storage scripts are held in a restricted state until affirmative consent is recorded through our consent banner.

Through Google consent mode v2, the following four consent signals are initialized with status denied:

Only after the visitor selects "Allow" are these signals updated to granted. If the visitor selects "Decline" or updates preferences through our footer Cookie Settings toggle, all four signals are immediately set back to denied, terminating non-essential tag storage.

Processors & Third-Party Recipients

Elvora works with selected third-party service providers who assist in operating our website, serving digital campaigns, and routing communications:

• Google LLC / Google Ireland Limited: Provides search advertising delivery and conversion measurement infrastructure via Google Ads.
• Microsoft Ireland Operations Limited: Operates search and native marketing networks through Microsoft Advertising. Data processing is governed by the privacy.microsoft.com privacy statement.
• Meta Platforms Ireland Limited / Meta Platforms, Inc.: Facilitates social advertising delivery and campaign analytics via Meta Ads.
• Hosting Infrastructure Provider: Delivers protected Apache/PHP web runtime, SSL termination, and encrypted SQL storage in US-based data centers.
• Transactional Mail Routing Service: Transmits encrypted copies of inquiry submissions from pefo218.php directly to office@elvora.click.

Cross-Border Data Transfers

Elvora operates in Charlotte, North Carolina, United States. When visitors access our website from the European Economic Area (EEA), United Kingdom, or other international regions, their personal data is transferred directly to United States servers.

Cross-border transfers to third-party processors are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission, and where applicable, certification under the EU-U.S. Data Privacy Framework.

Data Retention Periods

We retain personal records only for the defined periods necessary to provide studio services, resolve disputes, and maintain regulatory compliance:

• Enquiries and Email Notification Records: Retained for exactly 24 months from submission before systematic purge.
• Support Chat Transcripts: Retained for exactly 12 months from the date of the last exchange.
• Server Access and Security Logs: Retained for exactly 90 days before automatic rotation and overwriting.
• Consent Choices (site_consent_v2): Stored locally in the user's browser for 12 months unless cleared manually.
• Data Subject Access Requests (DSAR): Fulfilled and confirmed in writing within 14 days of receipt.

Technical and Organizational Security

We implement rigorous technical safeguards to defend stored personal information against unauthorized access, loss, or manipulation:

• Mandatory TLS 1.3 cryptographic transport across all web pages and form submission endpoints.
• Server-side input sanitization, honeypot spam traps (firm, domain verification), and time-stamped inquiry validation.
• Strict file permissions restricting direct public web execution of administrative directories or backend database records.
• Encrypted storage volumes and firewalled network perimeters protecting client intake tables.

Rights of European Visitors Under GDPR

Visitors accessing our site from the European Union, European Economic Area, or United Kingdom hold specific statutory rights under the General Data Protection Regulation (gdpr):

• Right of Access: You may request a verified copy of all personal records we hold regarding your inquiries.
• Right to Rectification: You may correct inaccurate or incomplete contact records or service notes.
• Right to Erasure ("Right to be Forgotten"): You may instruct us to permanently purge your inquiry logs and chat history.
• Right to Restriction of Processing: You may request that we suspend active processing of your contact data while verifying accuracy.
• Right to Data Portability: You may receive your provided personal data in a structured, machine-readable format.
• Right to Object: You may object at any time to data processing carried out under our legitimate interests.
• Right to Withdraw Consent: You may withdraw consent for marketing cookies or intake communications without retroactive penalty.

US State Privacy Rights & CCPA Disclosures

Residents of California, North Carolina, and other states with comprehensive privacy legislation hold distinct protections under the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa):

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information collected, the sources of collection, and the commercial business purpose.
• Right to Delete: You have the right to request deletion of personal information collected directly from you.
• Right to Correct: You have the right to demand correction of inaccurate personal information.
• Non-Discrimination: Elvora will never deny services, charge differing prices, or alter treatment durations (e.g. Full Face $60 / 60 min) because you exercised statutory privacy rights.
• No Sale of Personal Information: Elvora does not sell personal information or share personal data with third parties for cross-context behavioral advertising outside our direct campaign attribution models.

Global Privacy Control (GPC) Compliance

Our website recognizes and honors the global privacy control (GPC) browser signal. When your browser transmits the Sec-GPC: 1 HTTP header, our consent framework automatically sets advertising and tracking cookies to denied without displaying repeated consent popups.

Children's Privacy Protection (18+ Policy)

Elvora's cosmetic styling services, facial waxing treatments, and nutritional skincare supplements are designed exclusively for individuals aged 18 and older. We do not knowingly solicit, record, or retain personal information from minors under 18 years of age.

If we discover that an inquiry or consultation request has been submitted by an individual under the age of 18 without verifiable parental consent, the entry is deleted from our database immediately.

Filing Regulatory Complaints

If you believe our data processing practices violate applicable privacy statutes, you hold the right to lodge a formal complaint with relevant regulatory bodies:

• In North Carolina: The Consumer Protection Division of the North Carolina Attorney General's Office.
• In California: The California Privacy Protection Agency (CPPA) or the California Attorney General.
• In Europe: The supervisory authority of the EU Member State in which you reside or work.

Submitting a Data Subject Access Request

Website Accessibility Standards

Updates to This Policy

We may revise this privacy notice periodically to reflect operational changes in our Charlotte studio, updates to advertising platform requirements, or statutory revisions to state and federal consumer data laws.

Material amendments will be published directly on this page with an updated effective date line. Continued use of our consultation services or web forms after published updates constitutes acknowledgement of the amended terms.

Contacting Our Data Management Team

For questions regarding this privacy policy, tracking disclosures, or our data handling practices, reach out to our primary business office:

Trading Name: Elvora
Address: 130 North Tryon Street, Charlotte, North Carolina 28202, United States
Telephone Desk: +1 (464) 555-7461
Email: office@elvora.click