Privacy Policy

This Privacy Policy explains how LSR Studio (“LSR Studio,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit lsrstudiopro.com (the “Site”), use our client portal, or otherwise engage our digital services (together, the “Services”).

The business responsible for your personal information (the “business” or “controller”) is:

• Business: LSR Studio
• Location: San Francisco, California, United States
• Email: contact@lsrstudiopro.com
• Mailing address: full mailing address available on request by emailing contact@lsrstudiopro.com

1. Scope of this policy

This policy applies to personal information we process about visitors to the Site, prospective clients, and clients who use our portal. It does not apply to third-party websites, platforms, or services that we do not control, even where we link to them. LSR Studio is a digital growth studio providing website creation, Google Business Profile management, Instagram management, visual identity, social media content, and landing pages, primarily for aesthetic clinics, salons, and beauty professionals.

2. Information we collect

We collect the following categories of personal information, depending on how you interact with us:

We do not intentionally collect sensitive personal information (such as government IDs, precise geolocation, health data, or financial account login credentials). Please do not send us such information unless we specifically request it for a legitimate purpose.

3. How we use information

We use personal information to:

• Provide, operate, and maintain the Site and client portal;
• Create and manage your account and authenticate your access;
• Deliver the Services you engage us for and communicate with you about projects;
• Process invoices, payments, and subscriptions through our payment processor;
• Respond to your requests, questions, and support tickets;
• Manage and report on the marketing channels we run on your behalf;
• Improve, secure, and troubleshoot the Services and prevent fraud or abuse;
• Comply with legal, tax, and accounting obligations; and
• Send you service-related and, where permitted, marketing communications (you can opt out of marketing at any time).

4. Cookies & tracking technologies

The Site uses cookies and similar technologies that are strictly necessary for the client portal to work — for example, to keep you signed in and to protect your session. We may also use analytics or preference cookies to understand how the Site is used and to remember settings such as your chosen language.

You can control or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the client portal from functioning. Where required by law, we will request your consent before setting non-essential cookies.

5. How we share information

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under California law. We disclose personal information only in the following circumstances:

• Service providers (processors) who process data on our behalf under contract, including:
  • Vercel — website and application hosting;
  • Supabase — database, authentication, and file storage;
  • Stripe — payment processing;
  • Resend — transactional and account email delivery;
  • Google — analytics and the advertising/business platforms we manage on your behalf.
• Professional advisors such as accountants and lawyers, where reasonably necessary;
• Legal & safety — to comply with law, respond to lawful requests, enforce our agreements, or protect the rights, property, and safety of LSR Studio, our clients, or others;
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

These providers are located in the United States and other countries and are authorized to use your personal information only as necessary to provide services to us.

6. Google API Services & third-party platforms

Some of our Services connect to Google platforms (such as Google Ads, Google Analytics, Google Business Profile, and Google Search Console) so we can manage and report on marketing performance. Where our application requests access to Google account data through Google's authorization (OAuth) flow, our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Specifically, our “LSR Studio Ads Integration” application requests the Google Ads scope (.../auth/adwords) together with the read-only Google Analytics (analytics.readonly) and Google Search Console (webmasters.readonly) scopes, and uses all of them in read-only mode — only to read campaign and site performance metrics (such as impressions, clicks, cost, conversions, sessions, and search performance) to build the reports shown in your client portal. It never creates, edits, pauses, or deletes campaigns, ads, budgets, or account data.

Separately, our Google Business Profile integration requests the https://www.googleapis.com/auth/business.manage scope. Unlike the scopes above, this one is used to read and write — but only to the business profile of the client who authorized it, and only for the business information that client asked us to manage on their behalf: business name, category, description, phone, website, address or service areas, opening hours, services, and photos. We use it to create or update that profile and to read back its current state and verification status so the client portal can show whether the profile is live. We never use it to access, modify, or read any other business, and we never post reviews or reply as the business.

Photos submitted for a Google Business Profile are held on our servers only until Google confirms the upload, and the file is then deleted from our storage — we keep only a record that the upload happened (date, file name, and Google's media identifier). If an upload fails, the file is kept so it can be retried, and it is removed once the upload succeeds or the client discards it.

In practice, this means: we only request the access needed to provide the feature you asked for; we use Google user data solely to operate and report on those Services; we do not sell Google user data; we do not use it for advertising; and we do not transfer it to others except as needed to provide the Services, comply with law, or as part of a business transfer. You can revoke our access at any time through your Google Account's security settings.

Third-party platforms (Google, Stripe, Instagram/Meta, and others) process data under their own privacy policies, which we encourage you to review.

7. Data retention

We keep personal information only for as long as needed for the purposes described in this policy — for example, for the life of your account and our engagement, and afterward as required to meet legal, tax, accounting, or dispute-resolution obligations. When information is no longer needed, we delete or anonymize it.

8. Data security

We use technical and organizational measures designed to protect personal information, including encryption in transit (HTTPS), hashed password storage, access controls, and row-level security in our database. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at contact@lsrstudiopro.com.

9. Your California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to:

• Know / access the categories and specific pieces of personal information we have collected about you;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information — note: LSR Studio does not sell or share personal information;
• Limit the use of sensitive personal information — we do not use sensitive personal information for purposes that would trigger this right; and
• Non-discrimination — we will not discriminate against you for exercising any of these rights.

To exercise these rights, email us at contact@lsrstudiopro.com with the subject line “California Privacy Request.” We will verify your request by confirming information associated with your account. You may use an authorized agent, subject to verification. We will respond within the timeframes required by law.

10. Other U.S. state privacy rights

Residents of other U.S. states with comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a portable copy of their personal information, and to opt out of targeted advertising, sale, or certain profiling. Because we do not sell personal information or use it for targeted advertising, there is nothing to opt out of. To exercise any available right, contact us using the details in Section 14.

11. International visitors

The Services are operated from and hosted in the United States. If you access them from outside the United States, you understand that your personal information will be transferred to and processed in the United States and other countries, which may have data-protection rules different from those in your country. Where the EU/UK GDPR applies to a visitor, we process personal information on the lawful bases of contract performance, our legitimate interests in operating the Services, your consent (where applicable), and legal obligation, and such visitors may have additional rights of access, rectification, erasure, restriction, portability, and objection.

12. Children's privacy

The Services are intended for businesses and adults aged 18 and over. We do not knowingly collect personal information from children under 13 (or under 16 where applicable). If you believe a child has provided us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Your continued use of the Services after an update means you accept the revised policy.

14. Contact us

For any question or request about this Privacy Policy or your personal information:

• Email: contact@lsrstudiopro.com
• Location: San Francisco, California, United States
• Mailing address: full mailing address available on request by emailing contact@lsrstudiopro.com