Privacy Policy

CM Hair + Replacement Co.

Version 1.0 — Effective Date: August 13, 2026 — Last Updated: August 13, 2026

CM Hair + Replacement Co. (“CM,” “we,” “us,” or “our”) provides professional Mesh Integration and Meshless Integration education for licensed hairstylists and extension professionals through our website at cmhairreplacementco.com (the “Site”) and our course platform hosted on Kajabi. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices available to you.

This policy applies to visitors of the Site and to students who purchase or access our courses. It does not apply to third-party websites or services we link to or use, which have their own privacy practices.

Section 1: Information We Collect

Information you provide to us directly, such as: your name, email address, and phone number (if you provide it); information you submit through website contact or interest forms, including our pricing/profitability calculator; account and login information when you enroll in a course; payment and billing information you enter at checkout (see Section 5 — CM does not directly store your full card number); coursework you submit for feedback (for example, mannequin or model case-study photos or descriptions); and any messages you send us directly, including support requests.

Information collected automatically, such as general usage data about how you interact with the Site (pages viewed, links clicked, general navigation and session behavior), device and browser information, and approximate location derived from your IP address. This information is collected primarily through the analytics tools described in Section 3.

We do not knowingly collect government ID numbers, health/medical records, or other sensitive categories of information through the Site or checkout, beyond what a client-case description you voluntarily submit as part of coursework might incidentally include.

Section 2: How We Use Information

We use the information above to: provide, operate, and maintain the Site and our courses; process enrollment and payments and communicate with you about your purchase; deliver course access, provide feedback on submitted coursework, and support your progress through the program; respond to questions and support requests; send you transactional and account-related communications (for example, purchase receipts, access instructions, and payment reminders); send you marketing communications where you have opted in, and let you unsubscribe at any time (see Section 8); understand how visitors use the Site so we can improve it; and detect, prevent, and address technical issues, fraud, or misuse.

We do not use your information to make decisions about you using automated profiling with legal or similarly significant effects.

Section 3: Analytics, Cookies & Tracking Technologies

The Site currently uses the following third-party analytics and tracking technologies, which may place cookies or similar technologies on your device and collect information about your visit:

Google Analytics (GA4) — collects information about how visitors use the Site (pages viewed, general navigation, approximate location, device/browser type) so we can understand and improve Site performance. Learn more and opt out at Google’s Privacy Policy (policies.google.com/privacy) and Google Analytics opt-out (tools.google.com/dlpage/gaoptout).

Google Tag Manager (GTM) — a tag-management tool we use to deploy the analytics and tracking technologies described in this section. GTM itself does not collect personal information beyond what the tools it deploys (like GA4) collect.

Microsoft Clarity — a session-analytics tool that may capture how visitors interact with the Site, including mouse movement, clicks, scrolling, and general on-page behavior (sometimes called “session replay” and “heatmap” functionality), so we can understand and improve the Site’s usability. Microsoft states that input-box content (such as text typed into form fields) is masked by default in Clarity. Learn more at Microsoft’s Clarity documentation (clarity.microsoft.com) and Microsoft’s Privacy Statement (privacy.microsoft.com/privacystatement).

Google Search Console — used internally to monitor the Site’s presence in Google Search results; it does not collect information about individual visitors beyond aggregate search-performance data.

Kajabi — our course-hosting and checkout platform, described further in Section 4, sets its own cookies necessary to operate account login, checkout, and course delivery.

As of the effective date above, these tools generally load automatically when you visit pages on the Site, and our checkout pages (hosted on Kajabi) currently do not run any of the marketing-site analytics tools described above — Kajabi’s own platform documentation states that page-level tracking scripts added to the marketing site do not carry over to checkout pages, and we have not separately added tracking code to checkout. We are evaluating cookie-consent controls for the marketing site (see below) and will update this section if and when that changes.

Your choices. Most browsers let you block or delete cookies through your browser settings, though doing so may affect how some parts of the Site function. We honor opt-out requests submitted under Section 9 below. If we enable a cookie-preferences tool on the Site, a “Cookie Preferences” link will appear in the footer and this section will be updated to reflect exactly what that tool does and does not control.

Do Not Track & Global Privacy Control. Some browsers offer a “Do Not Track” signal or support the Global Privacy Control (GPC). We do not currently have a fully automated technical response to these signals across every tool listed above, but we honor verifiable opt-out and deletion requests submitted directly to us under Section 9, and we will update this Policy as our technical capabilities evolve.

Section 4: Third-Party Service Providers

We share information with the following categories of service providers, each of which processes information on our behalf to help us run CM’s business:

Squarespace — hosts the Site.

Kajabi — hosts our course platform, checkout, student accounts, and related communications.

Payment processor(s) — process payment at checkout (currently Kajabi Payments, which supports major credit/debit cards, Apple Pay, Google Pay, and the third-party buy-now-pay-later services Afterpay and Klarna where a customer chooses to use them). We do not directly receive or store your full card number; it is handled by the payment processor and, where applicable, the BNPL provider you select.

Email/communication providers we use to send transactional and, where you’ve opted in, marketing email.

Analytics providers described in Section 3.

These providers only receive the information reasonably necessary to perform their function for us, and we do not sell your personal information to any of them or to anyone else, and we do not share your personal information with third parties for their own independent marketing purposes.

We may also disclose information where required by law, to protect CM’s rights or the safety of others, or in connection with a business transaction such as a merger or sale of assets (in which case this Policy would continue to apply to your information under the new ownership).

Section 5: Payment Information

When you enroll in a course, your payment card information is entered directly into fields provided by our payment processor and is not stored on CM’s own systems. CM receives confirmation of your purchase, transaction records, and billing contact details (such as your name, email, and billing address) needed to fulfill your order, provide receipts, and manage your account.

Section 6: Data Retention

We retain personal information for as long as reasonably necessary to provide our services, maintain business and tax records, resolve disputes, and comply with our legal obligations. Course-account and transaction information is generally retained for the duration of your access to the course plus a reasonable period afterward for recordkeeping purposes. You may request deletion of your information as described in Section 9, subject to our legitimate need to retain certain records (for example, transaction and tax records).

Section 7: Data Security

We use reasonable administrative and technical safeguards designed to protect the information we hold, including relying on established, reputable platforms (Squarespace, Kajabi, and our payment processor) for the systems that handle the most sensitive parts of your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we experience a security incident affecting your personal information, we will provide notice as required by applicable law, including the Oklahoma Security Breach Notification Act.

Section 8: Email Communications

If you provide your email address, you may receive transactional emails related to your account, purchase, or course access, which are not promotional and cannot be opted out of while you have an active account. If you opt in to marketing emails (for example, through a checkout opt-in checkbox or a newsletter signup), you may unsubscribe at any time using the link included in those emails, or by contacting us directly. We do not currently use SMS/text messaging for marketing.

Section 9: Your Privacy Choices & Rights

You may contact us at any time to ask what personal information we hold about you, request a correction, request deletion (subject to Section 6), or ask us to stop using your information for marketing. We will respond to verifiable requests within a reasonable time.

California residents. Under the California Online Privacy Protection Act (CalOPPA), which applies broadly regardless of business size, we disclose the categories of information collected and shared as described throughout this Policy, and we do not sell your personal information. Separately, California’s CCPA/CPRA grants additional statutory rights (such as the right to know, delete, and opt out of “sale” or “sharing” of personal information) to consumers of businesses that meet specific statutory thresholds — currently, annual gross revenue over approximately $26,625,000, or handling personal information of 100,000 or more California consumers/households annually, or deriving 50% or more of annual revenue from selling/sharing personal information. Based on CM’s current size, CM does not believe it currently meets these CCPA/CPRA thresholds; we will comply with the CCPA/CPRA if and when we do. Regardless of threshold, if you are a California resident you may still contact us with a privacy request as described above and we will respond in good faith.

Other state privacy laws. A number of other states have enacted comprehensive consumer privacy laws, most of which apply only once a business meets certain size thresholds (commonly 25,000–100,000+ residents’ data processed annually). Based on CM’s current size, we do not believe these thresholds are currently met, but we will comply with applicable requirements as our business grows. This includes Oklahoma’s own comprehensive privacy law (SB 546), which was enacted in 2026 and becomes effective January 1, 2027, and which we are tracking for future applicability.

Section 10: Children’s Privacy

CM’s Site and courses are intended for professional adult hairstylists and extension professionals, not children. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected such information, we will delete it.

Section 11: Changes to This Policy

We may update this Privacy Policy from time to time. When we make a material change, we will update the “Last Updated” date above and, where appropriate, provide additional notice. We retain prior versions of this Policy internally as described in our policy-version register.

Section 12: Contact Us

Questions about this Privacy Policy or your information can be sent to:

CM Hair + Replacement Co.

7503 N May Ave, Oklahoma City, OK 73116

contact@cmhairreplacementco.com