Privacy Policy

Heather's Boutique, operated by Heather's Boutique LLC, operates heathersboutique.com and its subdomains, including wi.heathersboutique.com. We are a family-owned formalwear boutique headquartered in Oconomowoc, Wisconsin, and we are the "data controller" for information you provide to us through these online services.

This policy explains what personal information we collect, how we use it, who we share it with, and the rights you have to control it. If anything on this page isn't clear, call the store — we'll answer.

You give us: name, email, phone, mailing address, ZIP, school affiliation, dress size, body measurements when submitted, photos you upload for AI try-on, order history, and payment details (payment details are handled by Stripe — we never see your card number).

Automatically collected: IP address, browser type, pages visited, referring URL, and anonymized usage events (via PostHog analytics) so we can improve the site.

Cookies: we use a small number of first-party cookies to keep you logged in and remember your bag. We do not sell third-party advertising cookies.

We use your information to (1) run your orders and deliver your dresses, (2) send order status updates and one-off SMS reminders about your locked look, (3) power your AI Try-On, (4) prevent fraud and secure your account, (5) improve our fit recommendations, and (6) with your explicit opt-in, send occasional marketing about new arrivals and promotions.

We never use your information to train third-party AI models or sell your data to anyone. Ever.

We share only what's necessary with a short list of trusted service providers so we can operate:

• Stripe — processes your payments (they never share your card details with us).
• Google Gemini — generates your AI Try-On images. Photos you upload are sent to Google for the purpose of generating your result and are governed by Google's Gemini terms.
• Postmark / your SMTP provider — delivers your order confirmation emails.
• GoHighLevel (GHL) — sends transactional SMS messages you've explicitly opted into.
• PostHog — records anonymized product analytics.

We do not sell your personal information. We share information with law enforcement only when required by valid legal process.

You can, at any time:

• Request a copy of all personal data we hold about you
• Ask us to correct or delete your account and all associated data
• Opt out of marketing emails (link in every marketing email footer) or SMS (reply STOP)
• Withdraw consent to AI Try-On uploads and have your uploaded photos deleted

Email support@heathersboutique.com or call the store and we'll process your request within 30 days.

Heather's Boutique is a general-audience retail service and is not directed to children under 13. Customers who have not reached the age of majority where they live should use the service and complete purchases with the involvement and permission of a parent or legal guardian. Parents or guardians may contact the store to request removal of information about a minor.

Order records are retained for 7 years (required for tax + warranty purposes). AI Try-On result images are retained for 90 days from generation, unless you've shared them to the community lookbook (then they persist until you delete them). You can delete your account anytime, which removes your profile, sizes, and non-tax data.

All traffic is served over HTTPS (TLS 1.2+). Passwords are hashed with bcrypt. Card numbers never touch our servers. Access to customer data is limited to Heather and a small operations team, and all administrative access is logged.

If a security incident requires notification under applicable law, Heather's Boutique will provide notice within the timeframe required by applicable law.

We may update this policy from time to time. The "Last Updated" date at the top always reflects the current version. Material changes will be announced via email to registered users at least 14 days before taking effect.