Privacy Policy

Heather's Boutique is a family-owned formalwear boutique headquartered in Oconomowoc, Wisconsin. We operate this website (heathersboutique.com) and are the "data controller" for the information you provide to us here.

This policy explains what personal information we collect, how we use it, who we share it with, and the rights you have to control it. If anything on this page isn't clear, call the store — we'll answer.

You give us: name, email, phone, mailing address, ZIP, school affiliation, dress size, body measurements when submitted, photos you upload for AI try-on, order history, and payment details (payment details are handled by Stripe — we never see your card number).

Automatically collected: IP address, browser type, pages visited, referring URL, and anonymized usage events (via PostHog analytics) so we can improve the site.

Cookies: we use a small number of first-party cookies to keep you logged in and remember your bag. We do not sell third-party advertising cookies.

We use your information to (1) run your orders and deliver your dresses, (2) send order status updates and one-off SMS reminders about your locked look, (3) power your AI Try-On, (4) prevent fraud and secure your account, (5) improve our fit recommendations, and (6) with your explicit opt-in, send occasional marketing about new arrivals and promotions.

We never use your information to train third-party AI models or sell your data to anyone. Ever.

We share only what's necessary with a short list of trusted service providers so we can operate:

• Stripe — processes your payments (they never share your card details with us).
• Google Gemini — generates your AI Try-On images. Photos you upload are sent to Google for the purpose of generating your result and are governed by Google's Gemini terms.
• Postmark / your SMTP provider — delivers your order confirmation emails.
• GoHighLevel (GHL) — sends transactional SMS messages you've explicitly opted into.
• PostHog — records anonymized product analytics.

We do not sell your personal information. We share information with law enforcement only when required by valid legal process.

You can, at any time:

• Request a copy of all personal data we hold about you
• Ask us to correct or delete your account and all associated data
• Opt out of marketing emails (link in every marketing email footer) or SMS (reply STOP)
• Withdraw consent to AI Try-On uploads and have your uploaded photos deleted

Email support@heathersboutique.com or call the store and we'll process your request within 30 days.

Many of our customers are high-school students under 18. We collect only the minimum data needed to serve them (name, email, size, school). If a customer is under 13 we require a parent to place the order and hold the account. Parents can request removal of any data about a minor by contacting the store directly.

Order records are retained for 7 years (required for tax + warranty purposes). AI Try-On result images are retained for 90 days from generation, unless you've shared them to the community lookbook (then they persist until you delete them). You can delete your account anytime, which removes your profile, sizes, and non-tax data.

All traffic is served over HTTPS (TLS 1.2+). Passwords are hashed with bcrypt. Card numbers never touch our servers. Access to customer data is limited to Heather and a small operations team, and all administrative access is logged.

If we ever suffer a data breach affecting your personal information, we will notify you within 72 hours of discovery, as required by Wisconsin law.

We may update this policy from time to time. The "Last Updated" date at the top always reflects the current version. Material changes will be announced via email to registered users at least 14 days before taking effect.