NORMAN PRIVACY POLICY

Last Updated: October 3, 2026

Effective Date: October 3, 2026

Howe Holdings LLC dba Norman ("Norman," "we," "us," or "our") is committed to protecting the privacy of artists, studio operators, and studio clients. This Privacy Policy explains how personal information, Google user data, payment information, website analytics, and client intake records are collected, used, disclosed, and retained when using our website, mobile application, white-labeled client booking links, and administrative software (collectively, the "Services").

Business Contact & Data Protection Inquiries:

Howe Holdings LLC (dba Norman)

7960B Soquel Drive #135, Aptos, CA 95003

Email: hello@meetnorman.app

1. Dual Roles: Data Controller vs. Data Processor

Depending on how you interact with Norman, our legal role under applicable data privacy frameworks (such as the California Consumer Privacy Act / CPRA) differs:

  • When Norman is a Data Controller: We act as a Data Controller for personal data directly collected from Artists and Studio Operators to manage user accounts, process subscription payments, send platform notifications, run website analytics, and maintain customer support relationships.
  • When Norman is a Data Processor / Service Provider: We act as a Data Processor / Service Provider on behalf of the Studio or Artist (who acts as the Data Controller) for all Client Intake, Consent Form, and Appointment Booking Data. We process client intake data strictly to deliver services to the artist pursuant to our Terms of Service.

2. Information We Collect

A. Artist & Studio Account Data (Controller)

When an artist or studio creates an account or subscribes to Norman, we collect:

  • Account Credentials & Contact Info: Name, studio name, physical studio address, email address, phone number, and account credentials.
  • Licensing & Regulatory Details: Practitioner license numbers, studio permits, and issuing jurisdictions to support compliant form headers.
  • Billing Information: Credit card, debit card, or payment method details (processed securely via PCI-DSS compliant third-party payment gateways; Norman does not store raw credit card numbers).

B. Client Booking & Consent Form Data (Processor)

When clients use an artist's white-labeled link or in-studio application to book an appointment or complete a consent waiver:

  • Identity Data: Full legal name, date of birth, phone number.
  • Government ID Details: Government ID type, issuing jurisdiction, expiration date, and ID number. (Note: App interfaces display only masked numbers e.g., #••••3456; full ID numbers are restricted to encrypted audit PDFs).
  • Health & Safety Declarations: Responses to pre-procedure safety disclosures required under health codes (e.g., bleeding disorders, skin sensitivities, pregnancy, fainting history).
  • Electronic Signatures & Audit Logs: Typed client signatures, stored artist signature graphics, timestamps, IP addresses, device fingerprints, and form version metrics.

C. Website Analytics & Usage Data (Controller)

When visiting meetnorman.app or accessing our web application, we automatically collect basic technical and analytical data:

  • IP address, browser type, device information, operating system, referring URL, and interaction logs.
  • Cookies and local storage mechanisms necessary for application session security, authentication, and performance analytics.

3. Google Calendar Integration & Google API Limited Use Disclosure

Norman offers an optional integration allowing artists to sync studio appointments with their Google Calendar via Google OAuth.

A. Data Accessed via Google APIs

When an artist authorizes Google Calendar integration, Norman accesses:

  • Google Account Email Address: To verify identity and link the correct calendar.
  • Calendar Events & Availability: To view existing schedule events (preventing double-booking) and to create, update, or cancel studio appointment events on the artist's connected Google Calendar.

B. Google API Limited Use Compliance Statement

Norman's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

  • No Transfer for Advertising: We do NOT share, transfer, or sell Google user data to third parties for targeted advertising, retargeting, or data broker activity under any circumstances.
  • No AI/ML Training: We do NOT use Google user data to develop, train, or improve generalized or non-personalized artificial intelligence or machine learning models.
  • Human Access Restrictions: Humans do NOT read your Google Calendar data unless: (1) we have your explicit consent for troubleshooting specific account errors; (2) it is necessary for security purposes (such as investigating abuse); (3) it is required to comply with applicable law; or (4) the data is aggregated and anonymized for internal operation.
  • Data Minimization: We request access only to the minimal Google Calendar OAuth scopes required to perform two-way schedule synchronization.

4. How We Use Information

We process personal information strictly for legitimate operational and compliance purposes:

  • To Deliver Services: Creating accounts, managing bookings, displaying appointment schedules, and generating encrypted consent records.
  • To Maintain Public Health & Legal Compliance: Archiving completed consent forms in accordance with state-mandated body art retention schedules and civil statutes of limitations.
  • To Process Payments & Subscriptions: Managing billing cycles, subscription renewals, and administrative account notices.
  • To Improve Platform Security: Enforcing Multi-Factor Authentication (MFA), monitoring system health, preventing fraud, and ensuring audit trail integrity.

5. Third-Party Disclosures & Infrastructure Sub-Processors

Client intake and artist data are confidential. We never sell, rent, or lease personal information. Disclosures occur strictly with authorized sub-processors or under regulatory mandates:

  • Cloud Infrastructure & Storage: Encrypted database and application hosting providers (Vercel for application hosting and Neon for database hosting) bound by strict Data Processing Addenda (DPAs), using AES-256 encryption at rest and TLS 1.2 or higher in transit.
  • Payment Processors: Third-party payment gateways operating under PCI-DSS compliance standards.
  • Public Health Inspectors & Regulatory Audits: State, county, or municipal health department officials conducting official regulatory compliance or sanitary inspections as mandated by body art statutes.

6. Data Retention, Automated Purge & Data Export

A. State Health Retention Engine

Public health regulations require body art studios to retain signed consent forms for specified timeframes (ranging from 1 year to permanent archive depending on jurisdiction).

  • Baseline Schedule: Completed consent forms are retained for the longer of the local Department of Health statutory minimum OR the state personal injury statute of limitations, plus a standard system buffer.
  • Automated Purging: Once the statutory window expires, records are automatically and permanently deleted from active production databases and removed from rolling backup cycles (7 to 30 days).

B. Cancelled Bookings & No-Shows

Consent forms submitted for appointments where no procedure took place (cancellations or no-shows) are automatically purged after 30 calendar days, provided no legal hold is manually set by the artist.

C. Account Closure & Data Export

  • Export Right: Upon account closure or cancellation, artists are provided a 30-day window to download a complete, encrypted ZIP archive containing all historical client PDF records, intake forms, and audit logs.
  • Compliance Cold Archive: Following account closure, Norman moves historical health records into a passive, encrypted cold archive strictly until each record's statutory retention expiration date passes, protecting artists against evidence spoliation and regulatory non-compliance.

7. Children's Privacy & COPPA Statement

Norman's Services are designed exclusively for commercial studio use and adult clients.

  • Under-18 Absolute Prohibition: Norman strictly prohibits facilitating body art procedures or collecting consent forms for individuals under 18 years of age.
  • Automated Age-Gating: If a client enters a date of birth reflecting an age under 18 during advance intake, the platform immediately halts submission, cancels the booking attempt, and drops the entered date of birth. No profile or record is created or retained.
  • COPPA Compliance: We do not knowingly collect or solicit personal information from children under 13 years of age pursuant to the Children's Online Privacy Protection Act (COPPA). If we learn that a child under 13 has submitted personal information, we will purge that data immediately.

8. Your Privacy Rights (California CCPA/CPRA & State Frameworks)

Under the California Consumer Privacy Act (CCPA/CPRA) and state privacy laws, artists and clients have specific rights regarding personal data:

  • Right to Know & Access: You may request details about personal data collected, stored, or processed.
  • Right to Request Deletion: You may request deletion of non-essential personal information.
  • Statutory Record Exemption: Statutory health recordkeeping regulations override general consumer deletion requests. Active client consent forms required under state public health laws must be retained until the mandatory statutory health retention window expires.
  • Submitting Requests: Artists may exercise data rights by logging into account settings or emailing hello@meetnorman.app. Clients seeking access or deletion of intake records should direct requests to the studio/artist where their procedure took place, or contact hello@meetnorman.app.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect regulatory changes or platform updates. Material revisions will be communicated at least thirty (30) days prior to taking effect via email or platform notification.

Contact Us:

Howe Holdings LLC (dba Norman)

Attn: Privacy Officer

7960B Soquel Drive #135, Aptos, CA 95003

Email: hello@meetnorman.app

Terms of ServiceHome