The short version
This site sets no cookies of its own, shows no advertising, and loads nothing from third parties other than Cloudflare, our host, while you look around: fonts, images and the film come from our own domain. It counts visits without cookies and without storing your IP address (section 2). We only process personal data when you do something that needs it: join a waitlist, buy or pre-order, review what you bought, withdraw from a purchase, ask about working with us as a salon, or write to us, here, by email or on Instagram and TikTok. We do not sell data and we do not build profiles for advertising. To learn how people talk about their hair, we also read public web pages (section 11).
1. Who is responsible
capXholding AG, Oberallmendstrasse 18, 6300 Zug, Switzerland (company number CHE-493.168.511) runs this site and our own back-office system, AIing (section 12), and decides how personal data is handled in both. For anything about your data, write to hello@bighairaffair.com.
Our representative in the European Union (Art. 27 GDPR) is Maximilian Carl Friede, Germany.
We apply the Swiss Federal Act on Data Protection and, for people in the European Union, the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR) and its UK counterpart. Where this notice names a legal basis, it refers to Art. 6 GDPR.
2. When you visit the site
The site is hosted on the network of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), which answers every request from a data center near you. To deliver a page, and to protect the site against attacks, Cloudflare processes on our behalf what every web server sees: your IP address, the page or file requested, date and time, the browser and operating system your browser reports, and the page you came from. We do not combine this with anything else we know, and we do not try to identify visitors. Legal basis: our legitimate interest in running a secure, working site (Art. 6(1)(f)).
From your IP address Cloudflare derives the country you are probably in. We use it to preselect the "ship to" country in the cart and, without anything else about you, in the visit counts below. Technical logs of the parts of the site that run as a program (cart, forms, payment hand-over) are kept for a few days, 7 at most, and then deleted automatically. They can contain the technical details above, but no names, email or postal addresses.
We count visits to learn which pages are read, in two ways that set no cookies and use no local storage: Counterscale, an open-source counter we run on Cloudflare (stats.capxholding.com), and Cloudflare Web Analytics. For each page view they record the page, the page you came from, browser and device type, and country. When you join or confirm the waitlist, the site adds one such count for that step, without your email address. Neither stores your IP address or builds a profile of you. To tell a first visit of the day from a repeat one, Counterscale relies on your browser's ordinary cache of one small response, which holds a time and no identifier. Counterscale's data is deleted after 90 days. Legal basis: our legitimate interest in understanding how the site is used (Art. 6(1)(f)).
3. What is stored on your device
The site itself sets no cookies. It uses your browser's local storage for three things, none of which leaves your device except as described: the contents of your cart, the reference of a payment page you have opened (so that the units reserved for you are recognized as yours, and released when you come back without paying), and the reference of your last completed order (so that the confirmation page does not empty a newer cart). This is strictly necessary for a shop you asked to use; you can clear it in your browser at any time. Cloudflare's protection systems may set a short-lived, technically necessary security cookie when they check whether a request comes from a person.
4. Protection against automated abuse
The forms and the checkout are protected by Cloudflare Turnstile. It is loaded only at the moment you go for a form or open a filled cart, not before. Turnstile examines technical signals from your browser (such as IP address, browser characteristics and how the page was loaded) to tell people from programs, and gives us a yes or a no. It is not used for advertising. Legal basis: our legitimate interest in keeping bots from reserving stock and from sending email through our forms (Art. 6(1)(f)).
5. The waitlist
If you join a waitlist we store your email address, the product you are waiting for, the page you signed up on and its language (so that our emails are in it), the country derived from your IP address (two letters, not the address itself) and the time. We use it to send you one email when that product is available, and for nothing else. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time with the link in our emails or by writing to hello@bighairaffair.com; we then delete the entry. Otherwise we keep it until that email has been sent, and delete it 30 days after.
Your address only counts once you have confirmed it. We send it one email with a link, so that you can confirm that the address is yours and that you want that email; only confirmed addresses ever get it. We store when the confirmation email went out and when you confirmed. If you do not confirm within 30 days, we delete the entry. The same email has a link to remove the address at once.
The waitlist form also asks where you heard about us. Answering is optional. If you pick an answer, we store it with your entry, and our back office counts the answers, without your address, to learn which channels bring people to us; it is not used to follow you anywhere. Legal basis: our legitimate interest in knowing how people find us (Art. 6(1)(f)). It is deleted with the entry.
You can also join the waitlist in a direct message on Instagram, by answering our reply with your email address. Our back office passes that address on to the waitlist once, then removes it from its copy of the conversation. From there everything above applies: the confirmation email, then one email when our products are available, and nothing else. The message itself is processed by Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland), which runs Instagram, under its own privacy policy: privacycenter.instagram.com/policy. Legal basis: your consent (Art. 6(1)(a)).
6. Orders, pre-orders and payment
Payment takes place on a page hosted by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). There you enter your name, email address, phone number, delivery and billing address and your payment details. Your card or account details go to Stripe only; we never see or store them. Stripe also uses data about the payment to prevent fraud and to meet its own legal duties, for which it is responsible itself: stripe.com/privacy. Stripe's page uses Stripe's own cookies.
From Stripe we receive, and store in our order database in Western Europe: your name, email address, phone number, delivery address, what you bought, the amounts, any promotion code, the payment status and Stripe's reference numbers, whether you asked for news and offers in the cart, which version of our notice about emails you were shown, and the language you ordered in (English or German), in which we then write to you. We use this to deliver your order, to send you the emails that belong to it, to handle withdrawals, returns and complaints, and to keep our books. Legal basis: performance of the contract with you (Art. 6(1)(b)) and our legal obligations under commercial and tax law (Art. 6(1)(c)). Without this data we cannot sell to you. We keep order records for as long as commercial and tax law requires, which is up to 10 years.
To get the parcel to you, our warehouse in Germany and the carrier receive your name, delivery address and, for delivery notices, your email address or phone number. For destinations outside the European Union the customs authorities receive what a customs declaration requires.
After an order we may send you a link to review what you bought. If you use it, we keep your rating, your text, the product and the order it belongs to, and the details about your hair you choose to give (its texture, whether it is coloured or bleached, how often you wash it). A review cannot contain web addresses, and email addresses, phone numbers and social media handles are taken out of its text. We use reviews to learn what customers think of our products and to look after complaints: a low rating, or a review that may describe a reaction to a product, goes to a person in our team, and a reaction is recorded as the law on cosmetics requires. We quote a review elsewhere (on this site, in emails, posts or ads, never with your name) only if you ticked the separate box for that. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time by writing to hello@bighairaffair.com; we then delete the review, except a report of a reaction, which we must keep (Art. 6(1)(c)).
7. Emails we send you
We send the emails a purchase requires: the order confirmation (with the pre-order date, if any, and your withdrawal rights), the notice that your parcel is on its way, and the acknowledgment of a withdrawal. Legal basis: the contract and our legal obligations (Art. 6(1)(b) and (c)). Any other email from us is one you asked for or may refuse: the email that asks you to confirm a waitlist signup and, once you have confirmed, the one email you asked for; news and offers, only if you ticked the box for them in the cart; and, if you have bought from us, the emails described next.
If you buy from us, we may use your email address to tell you about products of ours that are similar to the ones you bought, and to ask you to review what you bought. We say so in the cart and on the payment page, before you enter your address, and in every such email. You can object to this at any time, at no cost other than the transmission costs at basic rates, by using the unsubscribe link in any of these emails, replying to one, or writing to hello@bighairaffair.com; we then stop. Which of these emails you get, and when, depends on what you bought and when (for example, a reminder around the time a bottle is likely to be empty). Legal basis: our legitimate interest in telling customers about our products (Art. 6(1)(f)); in Germany § 7(3) of the Act against Unfair Competition. If you also tick the box for news and offers in the cart, we may write to you about our other products too, on the basis of your consent (Art. 6(1)(a)), which you can withdraw at any time in the same way.
The email to the waitlist when a product is available, and the emails after a purchase described above, are sent by our own back-office system, AIing (section 12). It keeps no email addresses: for each sending it asks our shop for the addresses of one batch of people who may get that email (confirmed waitlist signups, or the buyers of particular orders), sends at once, and keeps only a record of which signup or order an email went to and whether its recipient unsubscribed. Every one of these emails has a link to unsubscribe.
To deliver our emails, the shop’s and AIing’s, we use Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, United States, which processes your email address, the content of the message and the technical delivery data on our behalf and stores it in the United States, for thirty days: resend.com/legal/privacy-policy. The transfer to the United States takes place under the European Commission’s standard contractual clauses, which form part of our data processing agreement with them. Alerts to ourselves about new orders may instead go through Cloudflare's email service.
8. The withdrawal form
If you declare a withdrawal online, we store what you enter (name, order number, email address, your note if any), the language of the form and the date and time we received it, send you the acknowledgment the law requires, and keep the declaration with the records of the order. Legal basis: the contract and our legal obligations (Art. 6(1)(b) and (c)).
9. When you write to us
If you send us an email we use what you tell us to answer you and to deal with your request. Legal basis: steps toward or performance of a contract, or our legitimate interest in answering inquiries (Art. 6(1)(b) or (f)). We keep such correspondence as long as the matter requires, and business correspondence for as long as the law requires.
If you write to us through the form for salons and stylists, we store the name of the business, your name, your email address, the country, what kind of business it is, your note if any, and when it arrived, and send it to our own mailbox. We use it to answer you and, if we work together, for that, never for advertising. Our back office records the enquiry as a lead with the country and a one-way hash of your email address, never the address itself. We delete the enquiry twelve months after it arrived. Legal basis: steps you asked for before a contract (Art. 6(1)(b)) and our legitimate interest in answering business enquiries (Art. 6(1)(f)).
10. Instagram and TikTok
The Instagram symbol on this site is an ordinary link: nothing is loaded from Instagram, and Instagram learns nothing about you, unless you click it. Where we show posts from our Instagram account on this site, our server fetches them and the images come from our own domain, so your browser still does not contact Instagram.
When you send us a message, or comment on one of our posts, on Instagram or TikTok, our back office receives it from the platform with the name of your account. It sorts the message and drafts an answer with the help of an AI model from a provider in the United States, whom we name on request, which processes on our behalf only the text of the message, with account names, email addresses, phone numbers and links taken out. A person in our team checks every drafted answer before it is sent. Only for a few simple questions (what a product costs, where we ship, how to use it, how to join the waitlist) can a fixed answer that we wrote and approved beforehand go out by itself; complaints, questions about health and anything about a reaction to a product are always answered by a person. We keep a conversation for twelve months after its last message, and longer only where it reports a reaction to a product, which we must keep on record. Instagram is run by Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland) and TikTok by TikTok Technology Limited (10 Earlsfort Terrace, Dublin 2, Ireland), each under its own privacy policy. Legal basis: our legitimate interest in answering what people ask us (Art. 6(1)(f)); for a reaction to a product, our legal obligations (Art. 6(1)(c)).
To learn which answers help, our back office also keeps a copy of each message without the name of your account, with email addresses, phone numbers, links and order numbers taken out, together with how it was sorted; our team labels some of these copies by hand. Messages about health or about a reaction to a product are never kept this way. Each copy is deleted after twelve months. Legal basis: our legitimate interest in answering well (Art. 6(1)(f)).
11. What we read on public web pages
To learn how people describe their hair and what bothers them about it, our back office reads public web pages, such as forums, blogs and review pages, and keeps short phrases about hair care from them, without user names, handles or links, together with the address of the page, for 90 days. It never reads social media platforms and never logs in anywhere, and sentences about illness, medicines or pregnancy are left out. We do not contact anyone through these pages, and we never publish these phrases as testimonials. Legal basis: our legitimate interest in understanding how our customers speak (Art. 6(1)(f)). You may object at any time: write to hello@bighairaffair.com, with the page if you know it, and we delete what we kept from it and leave it out from then on.
12. Who receives data, and where
Our back office, AIing, is our own system, not an outside company: capXholding AG runs it, and its data is stored by Cloudflare in the European Union. It is told of every waitlist signup and every order, without names or addresses: a signup's number, the product and the page, the version of the wording you agreed to and, if you gave one, where you heard about us; an order's number, what was bought, the amounts, the destination country, any promotion code, whether you were shown our notice about emails, and when the order was shipped or withdrawn from. Once you have confirmed a signup, and with every order, it also gets a one-way hash of your email address, never the address itself, so that it can recognise you again: to tell a repeat customer from a new one, and to keep to an unsubscribe or a deletion. If you leave the waitlist, or ask us to delete you from it, it is told so and keeps only that hash, so that you are not written to again (unless you sign up again). With all this it counts how many people sign up and buy, and decides who may get which of the emails in section 7.
Apart from the recipients named above (Cloudflare for hosting and security; Resend for sending our emails; Stripe for payment; our warehouse and the carrier for delivery; our AI provider for sorting messages, drafting answers and working through the phrases from web pages; Meta and TikTok, on whose platforms you write to us; the provider of our own mailbox; our accountants and, where the law requires it, authorities), nobody receives your data. Service providers that work for us are bound by data processing agreements.
Our company is in Switzerland, for which the European Commission has recognized an adequate level of data protection. Cloudflare and Stripe are groups with parent companies in the United States; where personal data reaches the United States, this happens under the EU-US and Swiss-US Data Privacy Frameworks, under which both are certified, and under the standard contractual clauses in our agreements with them. Our AI provider and Resend process data in the United States under the European Commission's standard contractual clauses in our data processing agreements with them.
13. Your rights
You can ask us at any time what we store about you and get a copy, have wrong data corrected, have data deleted or its use restricted, receive the data you gave us in a common format, and object to processing that we base on our legitimate interests (Art. 21 GDPR), and to its use for advertising at any time and without giving reasons. Where processing is based on your consent you can withdraw it at any time, with effect for the future. No decision with legal or similarly significant effects on you is made automatically, and we build no profiles for advertising. Write to hello@bighairaffair.com; we answer within one month and may ask you to show that you are the person the data is about. Data we must keep by law is blocked from other use instead of deleted.
You also have the right to complain to a data protection authority: in the European Union the authority of the country where you live or work, in the United Kingdom the Information Commissioner's Office, in Switzerland the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
14. Security
All traffic to and from this site is encrypted. Order data is stored in a database that only the shop's own program and we can reach; the shop's back office is protected by a password and refuses requests from other sites, and AIing is open to our team only. Payment details never touch our systems.
15. Changes
When the site changes, this notice changes with it; the version date at the top tells you when. The version published here at the time of your visit applies.