Appointment Assistant Privacy Policy

1. Scope and contact details

This Privacy Policy applies exclusively to the Bridal Xoxo online appointment assistant and chatbot made available on the separate website where this Policy is displayed (the "Assistant"). It explains how Bridal Xoxo ("Bridal Xoxo," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you interact with the Assistant, request or manage an appointment, or make an appointment deposit through the Assistant's booking flow.

This Policy does not apply to Bridal Xoxo's main website, online store, social-media pages, or other services. Those services are governed by their own applicable privacy notices.

Bridal Xoxo is the operator responsible for the personal information described in this Policy. Questions and privacy requests may be directed to:

This Policy also does not govern a third-party website or service that has its own privacy policy, even when the Assistant links to that service.

2. How the Assistant works

The Assistant is an automated service built and operated using Bridal Xoxo's proprietary technology. Its conversation flow, questions, predefined responses, data validation, guest-profile creation, appointment logic, and integration with Bridal Xoxo's management systems are handled by that proprietary technology. The Assistant does not rely on a general-purpose AI model to conduct the entire conversation.

Only when a user asks one of the specific types of questions for which an automatically generated answer is appropriate may our proprietary system call OpenAI's API and use the GPT-4o mini model to prepare that particular answer. In those limited cases, the system sends OpenAI only the question and the minimum relevant conversational context needed to generate a useful response. The remaining conversation and appointment workflow continue to be managed by Bridal Xoxo's proprietary technology.

You are interacting with an automated system, not a human. An answer generated through the OpenAI API may be inaccurate, incomplete, or unexpected. The Assistant is intended only to collect appointment information, answer general questions, and help arrange a visit. It does not provide legal, medical, financial, or other professional advice.

We store the full conversation transcript together with the information supplied during the conversation in our own systems. Bridal Xoxo does not use conversations to train or fine-tune an AI model and has not opted in to share API data for OpenAI model training. OpenAI does not use API inputs or outputs to train its general-purpose models by default. OpenAI may securely retain the limited API inputs and outputs it receives for up to 30 days for service delivery and abuse monitoring, unless a different legally permitted retention setting applies.

The Assistant does not make decisions that produce legal or similarly significant effects. Appointment availability may be checked and the booking workflow may be handled automatically by our proprietary software, but an appointment is final only when it is confirmed. You may contact our staff using the details in Section 1 if you prefer human assistance.

The Assistant is not designed to request or accept medical information, pregnancy status, disability details, allergies, diagnoses, medication information, or other consumer health data. Please do not attempt to provide this information through the Assistant. If such information is received unintentionally, we will not use it for profiling or advertising and will delete it when identified unless retention is required by law or necessary to respond to an immediate request from you.

3. Information we collect

Information you provide

Depending on how you interact with us, we may collect:

• Identity and contact information, such as your name, telephone number, email address, and guest or customer identifier.
• Appointment and event information, including your wedding or event date, requested appointment type, preferred appointment date and time, booking status, confirmations, reminders, rescheduling or cancellation history, and information you choose to provide about your visit.
• Bridal preferences, such as preferred styles, designers, size or fit information, price range, shopping timeline, and other preferences you choose to discuss.
• Conversation and customer-service information, including the complete Assistant transcript, emails, form submissions, feedback, and notes associated with your guest profile.
• Transaction information, such as the amount, date, status, and reference number of an appointment deposit processed through Stripe. We do not receive or store your complete payment-card number or card security code.
• Information contained in privacy requests, including information reasonably necessary to authenticate and respond to a request.

Information collected automatically

Our servers and infrastructure providers may automatically process limited technical information needed to deliver and secure the Assistant, including IP address, browser and device type, operating system, timestamps, requested pages, referring page, and diagnostic or security logs. We do not use this information for cross-site advertising or behavioral profiling.

Sources

We collect information directly from you, automatically from your device when you use the Assistant, from a person acting at your direction, and from service providers that help us operate appointments, communications, payments, hosting, and security.

4. How we use personal information

We use personal information to:

• open, maintain, and update a guest profile;
• operate the proprietary conversation flow and answer questions;
• check availability and request, confirm, remind, reschedule, or cancel an appointment;
• insert and synchronize information in our proprietary appointment and customer-management system;
• prepare the boutique manager and authorized staff for your appointment;
• process and document an appointment deposit;
• provide customer service and respond to your communications;
• review service quality, analyze Assistant performance, correct errors, and improve the proprietary conversation and appointment workflows, without using conversations to train or fine-tune an AI model;
• permit authorized technical developers to investigate or resolve a specific issue when approved by the store manager;
• protect the Assistant, prevent fraud and misuse, maintain logs, and investigate security events;
• comply with law and establish, exercise, or defend legal claims; and
• carry out another purpose that we explain when collecting the information or that you request or authorize.

5. How we disclose personal information

We disclose only the information reasonably necessary for the recipient to perform the relevant service. Our principal recipients are:

The boutique manager may review conversations and guest records for appointment administration, customer service, training, quality review, and business operations. Technical developers may access a conversation only when authorized by the manager and reasonably necessary to investigate, support, secure, or repair the system.

We may also disclose information to professional advisers; to courts, regulators, law enforcement, or government authorities when required or permitted by law; to protect rights, safety, property, or the integrity of the Assistant; in connection with a proposed or completed merger, financing, acquisition, reorganization, bankruptcy, or sale of business assets; or to another recipient at your direction or with your consent.

6. No sale or targeted advertising

Bridal Xoxo does not sell personal information for money or other valuable consideration. We do not provide customer lists or mobile numbers to data brokers, and we do not share personal information with third parties for their own marketing. We do not use personal information for cross-context behavioral advertising or targeted advertising based on activity across nonaffiliated websites or services.

If these practices change, we will update this Policy and provide any notice, consent, or opt-out mechanism required by applicable law before the change applies.

7. Cookies and tracking

The separate Assistant website does not use advertising cookies, analytics cookies, pixels, session-replay tools, embedded Google Maps, or similar cross-site tracking technologies. It may use only strictly necessary technical storage or server-side identifiers required to maintain the conversation, protect security, prevent abuse, and provide requested functionality.

Because we do not sell or share personal information for targeted advertising, a browser-based opt-out signal such as Global Privacy Control does not change our current practices. We will recognize such signals if our practices change and applicable law requires us to do so.

8. Appointment communications

After you use the Assistant, we send only transactional appointment confirmations and reminders by email. These messages are necessary to administer the appointment you requested and are not promotional marketing emails.

If we use SMS functionality, texts will be limited to the operational purpose disclosed when you provide your number. Message and data rates may apply. You may reply STOP to stop optional texts or HELP for assistance, or contact us using Section 1. We do not transfer mobile numbers to third parties for marketing or promotional purposes.

If Bridal Xoxo later offers a newsletter or promotional email or SMS program, enrollment will be separate from appointment booking and will include the notices, consent, and opt-out mechanism required by applicable law.

9. Appointment deposits and Stripe

Appointment deposits are processed by Stripe. Bridal Xoxo receives transaction details such as the amount, date, status, and payment reference but does not receive or store your complete card number or card security code. Stripe processes payment information under Stripe's Privacy Policy.

10. Data retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy. Our standard retention periods are:

• Assistant transcripts, guest profiles, appointment records, customer-service notes, and appointment emails: three years after your most recent appointment or interaction with us.
• Deposit, transaction, accounting, and tax records: seven years after the transaction, or longer if required by law.
• Privacy requests and records showing how we responded: five years after the request is closed.
• Application, security, and diagnostic logs: up to 12 months, unless a longer period is needed to investigate an incident, prevent fraud, or establish or defend a legal claim.
• Limited OpenAI API inputs and outputs: for the specific questions routed to OpenAI, OpenAI may retain the question, minimum relevant context, and generated answer for up to 30 days for service delivery and abuse monitoring, unless a different legally permitted retention setting applies.
• Backups: deleted data may remain in protected backups for up to 90 additional days before being overwritten through the normal backup cycle.

We may retain specific information longer when required by law, necessary for a dispute or security investigation, or requested by you. When retention is no longer necessary, we delete, anonymize, or securely dispose of the information.

11. Security

We use reasonable administrative, technical, and physical safeguards appropriate to the nature of the information, including encrypted network communications, restricted administrative access, role-based permissions, logging, backups, vendor controls, and procedures for investigating security incidents. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a data incident affects personal information, we will investigate and provide notice to affected individuals, regulators, or others when required by applicable law.

12. Your choices and privacy rights

Depending on your place of residence and whether the relevant law applies to Bridal Xoxo, you may have the right to:

• confirm whether we process your personal information and access it;
• correct inaccurate personal information;
• request deletion of personal information;
• receive a portable copy of certain information;
• withdraw consent where processing is based on consent;
• opt out of sale, targeted advertising, or certain profiling, although we do not currently engage in those practices;
• appeal our refusal to act on a request where applicable; and
• receive nondiscriminatory treatment for exercising a privacy right.

Submit a request by emailing hello@bridalxoxo.com with the subject line “Privacy Request.” Explain the right you wish to exercise and provide enough information for us to locate the relevant records. We may request additional information reasonably necessary to verify your identity and protect your information from unauthorized disclosure. Do not send a government identification document unless we specifically request it through a secure method.

An authorized agent may submit a request where permitted by law. We may request proof of the agent's authority and may verify the request directly with you. If we deny a request that carries a right of appeal, email the same address with the subject line “Privacy Appeal.”

13. Nevada privacy notice

For Nevada consumers, the categories of covered information we collect are described in Section 3; the sources and purposes are described in Sections 3 and 4; the categories of recipients are described in Section 5; the process to review and request changes is described in Section 12; and our third-party tracking practices are described in Section 7.

Nevada law permits a covered consumer to submit a verified request directing an operator not to make a covered sale of covered information. Bridal Xoxo does not make covered sales as defined by Nevada law. You may nevertheless submit a Nevada opt-out request to hello@bridalxoxo.com with the subject line “Nevada Privacy Request.”

We do not intentionally collect consumer health data as defined by Nevada law through the Assistant, do not infer consumer health status, and do not sell consumer health data. The Assistant is configured not to request or accept the health-related information identified in Section 2.

14. International visitors

The Assistant is available in English and is intended to support Bridal Xoxo's Las Vegas appointment service, but its separate website may be accessed from other countries. Personal information is processed in the United States, where privacy laws may differ from those in your country.

If the European Economic Area, United Kingdom, or another applicable privacy law governs our processing, our legal bases may include taking steps at your request before providing a service, performing our agreement with you, complying with law, pursuing legitimate interests such as providing and securing the Assistant, and consent where required. Applicable rights may include access, correction, deletion, restriction, objection, portability, withdrawal of consent, and the right to complain to your local data-protection authority.

Where legally required for an international transfer, we will use an approved transfer mechanism or other safeguards permitted by applicable law. To exercise a right, contact hello@bridalxoxo.com.

15. Children's privacy

The Assistant is intended for adults and is not directed to children under 13. We do not knowingly collect personal information online from a child under 13. If you believe a child has provided personal information, contact us so we can investigate and delete it as appropriate. A person under 18 should use the Assistant only with the involvement of a parent or legal guardian.

16. Changes to this Policy

We may update this Policy to reflect changes in the Assistant, vendors, technology, practices, or legal obligations. We will post the revised version on this page and update the effective date. If a change is material, we will provide additional notice reasonably appropriate to the change and obtain consent before applying the change when required by law.