Privacy Policy

I. Consent

By accessing our Service, you accept this Privacy Policy and our Terms of Use, and you consent to our collection, storage, use and disclosure of your personal information as described here. Each time you visit the website or use the Service, and any time you voluntarily provide us with information (for example, when you submit a celebration plan or request a tour), you agree that you are consenting to our collection, use and disclosure of that information, and to receive booking, payment, and event-related communications as described below.

II. Information we collect

We collect the following categories of information:

• Inquiry & planner details: name, email, phone, child's first name and age, preferred date, party size, and the selections you make in the birthday planner (theme, food, cake, décor, entertainment, add-ons, notes). The resulting total shown in the planner is an estimate, not an accepted booking.
• Payment information (only if you proceed to pay): date-save and balance payments are processed by Stripe. We never see or store your full card number.
• Account information: if you create an account we store your email and a secure session token (passwordless magic links).
• Usage & device data: pages viewed, referrers, device and browser type, and interaction events.
• Marketing attribution: UTM parameters (`utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term`, `utm_id`), Google Click ID (`gclid`), Meta Click ID (`fbclid`), and the referring URL, so we can understand how visitors reach the site.
• WhatsApp initiations: when you tap a WhatsApp button on our website, we record a short unique reference (for example `WA-AB12CD34`) together with the page, the prefilled message, any question you typed, and the marketing attribution above. The reference is appended to the WhatsApp message so we can match your conversation to your visit. The reference is not personal information on its own; the message content you send in WhatsApp is governed by WhatsApp's own privacy policy.

We also use cookies and browser localStorage to keep you signed in, remember your draft plan (including a stable inquiry `client_request_id` used to prevent duplicate submissions), store your privacy choices under the key `lh.consent.v1`, and support the analytics and advertising described below. You can remove or block cookies through your browser, but some areas of the Service may not work properly without them.

III. How we use and share information

Personal Information. We do not sell, trade, or rent your Personal Information. We use it to:

• Prepare, confirm, and run your event.
• Send booking confirmations, balance reminders, and event-day logistics.
• Respond to inquiries submitted through our contact form and provide customer support.
• Understand how the website is used and improve the planner and marketing.

We share only the minimum information needed with trusted service providers, who are permitted to use it solely to perform services for us:

• Stripe — payment processing for date-save and balance payments.
• Resend — transactional and confirmation email delivery.
• Lovable Cloud — secure backend hosting for bookings, accounts, and stored inquiries.
• Google Analytics 4 (via Google Tag Manager) — website measurement.
• Mixpanel — product analytics and, on the production website, session replay (recordings of on-page interactions used to debug the planner and improve the experience).
• PostHog — product analytics and, on the production website, session replay.
• Meta (Facebook/Instagram) — the Meta Pixel running in your browser and the Meta Conversions API running on our server both report advertising events (for example, page views and lead submissions) so we can measure and improve our Meta ads.

These providers have their own privacy policies governing the information we share with them; we encourage you to review them. We may also disclose Personal Information if required by law or if you violate our Terms of Use.

III-A. Your privacy choices

Analytics and advertising measurement are enabled by default for visitors in the United States who have not made a choice. You can change this at any time using the Manage Privacy Choices button on this page. Your choice is stored in your browser under the key `lh.consent.v1` and is applied on later visits before analytics and advertising tags load.

When you opt out of the advertising category, future Meta browser Pixel events and server-side Meta Conversions API events for your session are blocked. When you opt out of the analytics category, Google Analytics 4 receives a denied-consent signal, and our Mixpanel and PostHog clients call their built-in opt-out APIs, which stop analytics collection and session replay for future page views. We also make a reasonable, best-effort attempt to remove first-party analytics and advertising identifiers previously set in your browser (for example, cookies starting with `_ga`, `_fbp`, `_fbc`, `mp_`, and `ph_`).

Opting out prevents future collection but does not retract information that was already transmitted before your opt-out. Marketing emails have their own unsubscribe link, and Stripe payment records must be retained for legal, tax, and accounting purposes regardless of your analytics/advertising choice.

III-B. Meta Pixel & Conversions API — data handling

When advertising measurement is allowed, contact fields sent to Meta from our server (email and phone) are normalized and SHA-256 hashed on our server before transmission. Hashing reduces exposure but is not the same as anonymization: a party who already knows the underlying value could re-derive the hash. Browser Pixel events and server-side Conversions API events for the same action share a common `event_id` so that Meta can deduplicate them.

III-C. Cookies & local storage

We and our service providers set small files in your browser to run the Service and measure it. Common examples on our site include:

• Essential: authentication session, planner draft, and the `lh.consent.v1` privacy-choice record.
• Analytics: Google Analytics (`_ga`, `_ga_*`), Mixpanel (`mp_*`), and PostHog (`ph_*`, `posthog*`) identifiers and, on production, session replay data.
• Advertising measurement: Meta Pixel identifiers (`_fbp`, and `_fbc` when you arrive from a Meta ad).

IV. How we protect information

We use industry-standard safeguards — including TLS in transit, encrypted storage, row-level security in our database, and access controls — to protect your information. In the unlikely event of a data breach affecting your personal information, we will notify you promptly in accordance with the Florida Information Protection Act. No system is perfectly secure; please use a strong, unique sign-in email and keep access to your inbox secure, since we use passwordless magic links.

V. Your rights regarding your information

You may at any time ask us to access, correct, or delete your Personal Information, or withdraw consent for further use. You can also opt out of non-essential marketing communications. Note that we may still send you administrative messages (for example, booking confirmations or important updates to this Privacy Policy) that are necessary to deliver the Service.

VI. Hosting and infrastructure

Our Service is built and hosted on Lovable Cloud and its underlying infrastructure providers. Your information, including Personal Information, may be stored on their servers in accordance with their respective privacy and security practices.

VII. Links to other websites

We may link to third-party websites (for example, Stripe checkout or social media). We are not responsible for the privacy practices or content of those sites. This Privacy Policy applies solely to information collected through our Service.

VIII. Age of consent

Our planner is intended for adults planning an event on behalf of a child in their care. By using the Service, you represent that you are at least 18 years of age. Any child information we receive is submitted by the responsible adult, not by the child. We do not intentionally collect personal information directly from children.

VIII-A. Children's privacy (COPPA)

Consistent with the U.S. Children's Online Privacy Protection Act (COPPA), our Service is directed to adults, not to children under 13. We do not knowingly collect personal information directly from children. Booking-related details about a child (first name and age) are provided to us by a parent or guardian solely for the purpose of planning their event, are not used for advertising, and are not shared with third parties except service providers needed to deliver the party. A parent or guardian may review, correct, or request deletion of this information at any time through our contact form.

VIII-B. U.S. state privacy rights

Depending on where you live, U.S. state privacy laws — including the California Consumer Privacy Act as amended by the CPRA (California), the Virginia CDPA, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and similar laws in other states — may give you the right to:

• Know what personal information we collect about you and how we use it.
• Access a copy of your personal information in a portable format.
• Correct inaccurate personal information.
• Delete personal information we hold about you, subject to legal exceptions.
• Opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising, and of certain profiling.
• Be free from discrimination for exercising any of these rights.

We do not sell your personal information and we do not share it for cross-context behavioral advertising as those terms are defined under California law. We do not knowingly process the personal information of consumers under 16 for those purposes. To exercise any of the rights above — including a California “Shine the Light” request, a “Limit Use of My Sensitive Personal Information” request, or an authorized agent request — please contact us via our contact form. We will verify your request using the booking email on file and respond within the timeframe required by the applicable law (generally 45 days).

VIII-C. Email, SMS, and messaging consent (CAN-SPAM / TCPA)

By providing your email address, phone number, or messaging handle, you consent to receive transactional and event-related communications from LOULOU HOUSE by email, SMS, WhatsApp, or phone in connection with your booking. Message and data rates may apply. You may opt out of non-essential marketing messages at any time by replying STOP to a text, using the unsubscribe link in a marketing email, or contacting us; opting out does not stop transactional messages necessary to deliver your event. Consent to marketing messages is not a condition of any purchase.

VIII-D. “Do Not Track” signals

Some browsers transmit “Do Not Track” signals. Because there is no consistent industry or legal standard for how to respond to these signals, our Service does not currently change its behavior when it receives one. We do, however, honor verified opt-out requests as described above.

IX. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy at any time. Changes are posted on this page and become effective upon continued use of the Service. It is your responsibility to check this page periodically. If you have provided your email address, you give us permission to email you about material changes.

X. Merger or acquisition

If we undergo a business transaction such as a merger, acquisition, or sale of all or a portion of our assets, your Personal Information may be among the assets transferred. Any acquirer may continue to process your Personal Information as set forth in this Privacy Policy.

XI. Email communications & opting out

We will send you Service-related announcements when necessary (for example, booking confirmations, payment receipts, or material updates). You generally cannot opt out of these messages, which are not promotional. Any promotional communications include unsubscribe instructions.

XII. Contact us & withdrawing consent

If you have any questions about this Privacy Policy, or wish to withdraw consent for the continued collection, use, or disclosure of your Personal Information, please reach out via our contact form.

LOULOU HOUSE is based in Miami, Florida, United States. Our Service is operated from and intended for users in the United States.