Privacy Policy

1. Overview

Muse & Co ("we," "us," "our") operates a hybrid art studio and tea house located at 311 Hay Street, Fayetteville, NC 28310, as well as the website ncmuse.co and related digital services.

This Privacy Policy describes how we collect, use, store, and protect your personal information when you:

• Visit our website or mobile application
• Create an account or membership
• Place orders for food, beverages, or merchandise
• Book art classes, workshops, or private events
• Use our complimentary WiFi network
• Interact with our AI chatbot (BaristaBot)
• Subscribe to our newsletter or communications
• Visit our physical location

By using our services, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Analytics & Tracking

We use analytics tools (including custom analytics via Cloudflare Workers) to understand how users interact with our website. This helps us improve user experience, optimize content, and identify technical issues.

2.4 AI Chatbot Interactions (BaristaBot)

When you interact with BaristaBot, our AI-powered assistant:

• We log conversation messages to improve service quality
• Chat data may be analyzed to identify common questions and improve responses
• Conversations are stored temporarily and reviewed for quality assurance
• Important: Do not share sensitive personal information (credit card numbers, passwords, SSN) in chat conversations

2.5 WiFi Usage Data

When you connect to our complimentary WiFi network at our physical location:

• Device MAC address (anonymized)
• Connection duration and bandwidth usage
• General location within premises (for network optimization)
• No browsing history or website visits are tracked

3. How We Use Your Information

We use collected information for the following purposes:

3.1 Service Delivery & Operations

• Order Processing: Fulfill food, beverage, and merchandise orders
• Reservations: Manage art class registrations, workshop bookings, and private event scheduling
• Membership Management: Administer membership benefits, track drop-ins, process renewals
• Customer Support: Respond to inquiries, resolve issues, provide assistance
• Payment Processing: Complete transactions securely via Stripe

3.2 Communication

• Transactional Emails: Order confirmations, receipts, booking confirmations, class reminders
• Account Notifications: Password resets, account updates, payment failures
• Marketing (with consent): Newsletters, promotional offers, new menu items, event announcements
• Feedback Requests: Surveys to improve our services

You can opt out of marketing emails at any time using the unsubscribe link in emails or by contacting us.

3.3 Personalization & Improvement

• Menu Recommendations: Suggest items based on past orders and preferences
• User Experience: Remember preferences (language, ice level, sugar level)
• Analytics: Understand user behavior to improve website navigation, content, and features
• A/B Testing: Test different layouts, features, or promotions to optimize user experience

3.4 Security & Fraud Prevention

• Detect and prevent fraudulent transactions
• Protect against unauthorized account access
• Monitor for suspicious activity or security threats
• Enforce our Terms of Service

3.5 Legal Compliance

• Comply with legal obligations (tax reporting, health regulations)
• Respond to law enforcement requests or legal processes
• Protect our legal rights and interests

4. Cookies & Tracking Technologies

4.1 Types of Cookies We Use

4.2 How to Manage Cookies

You can control cookie preferences through your browser settings:

• Chrome: Settings → Privacy and security → Cookies
• Firefox: Options → Privacy & Security → Cookies
• Safari: Preferences → Privacy → Cookies
• Edge: Settings → Privacy → Cookies

Note: Blocking essential cookies may prevent certain features from working properly (login, checkout, cart).

4.3 Third-Party Tracking

We use third-party services that may set their own cookies:

• Stripe: Payment processing and fraud detection
• Cloudflare: Content delivery, security, and analytics
• Google Analytics: Website traffic analysis and user behavior insights
• Google Ads: Conversion tracking on order success pages to measure advertising effectiveness

4.4 Conversion Tracking on Success Pages

5. Third-Party Services & Data Sharing

We may share your information with trusted third-party service providers who help us operate our business. These providers are contractually obligated to protect your data and only use it for the purposes we specify.

5.1 Service Providers We Use

5.2 We Do NOT Sell Your Personal Information

5.3 Legal Disclosures

We may disclose your information if required to:

• Comply with legal obligations (court orders, subpoenas)
• Protect our rights, property, or safety
• Investigate fraud or security incidents
• Enforce our Terms of Service

6. Data Security

6.1 Security Measures

• Encryption: All data transmitted to our servers uses SSL/TLS encryption (HTTPS)
• Password Security: Passwords are hashed using bcrypt with salt
• Payment Security: Credit card data is tokenized and processed via PCI-compliant Stripe
• Access Controls: Employee access to customer data is restricted and logged
• Database Security: Cloudflare D1 database with encrypted storage and backup
• Regular Audits: Security reviews and vulnerability assessments

6.2 Your Responsibility

You can help protect your account by:

• Using a strong, unique password
• Not sharing your password with others
• Logging out after using shared devices
• Reporting suspicious activity immediately

7. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations.

7.1 Retention Periods

• Account Data: Retained while your account is active, plus 2 years after account closure (for legal/tax purposes)
• Order History: 7 years (tax and financial record-keeping requirements)
• Payment Information: Tokenized data retained by Stripe per their policy
• Chat Logs (BaristaBot): 90 days for quality assurance, then anonymized/deleted
• Analytics Data: Aggregated and anonymized data retained indefinitely for business insights
• Marketing Data: Until you opt out or request deletion

7.2 Data Deletion

You can request deletion of your personal data at any time (see Section 8: Your Privacy Rights). Some information may be retained as required by law or for legitimate business purposes (e.g., fraud prevention, dispute resolution).

8. Your Privacy Rights

8.1 How to Exercise Your Rights

To exercise any of these rights, contact us at:

8.2 Account Settings

You can also manage your data directly through your account:

• Profile Settings: Update name, email, phone, password
• Communication Preferences: Opt in/out of emails, notifications
• Order History: View past orders and transactions
• Delete Account: Permanently delete your account and data

9. Children's Privacy

If you are a parent or guardian and believe your child has provided us with personal information without consent, please contact us immediately at [email protected]. We will delete the information promptly.

9.1 Minors Ages 13-17

Users between 13-17 years old must have parental consent to use our services. By creating an account, minors represent that they have obtained permission from a parent or legal guardian.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

10.1 Your CCPA Rights

• Right to Know: Request details about personal information collected, used, disclosed, or sold
• Right to Delete: Request deletion of personal information (with exceptions)
• Right to Opt-Out: Opt out of the sale of personal information (we do NOT sell your data)
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

10.2 Information We Collect (CCPA Categories)

10.3 How to Submit a CCPA Request

California residents can submit requests by:

• Email: [email protected] (subject: "CCPA Request")
• Phone: Contact us at our physical location
• We will verify your identity before fulfilling the request

11. International Users & Data Transfers

Our services are operated in the United States, and our servers are located in the US (via Cloudflare's global network). If you access our services from outside the United States, your information may be transferred to, stored, and processed in the United States.

11.1 GDPR (European Users)

If you are located in the European Economic Area (EEA), UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis for Processing: We process your data based on contract performance, legal obligations, legitimate interests, or your consent
• Right to Object: Object to processing based on legitimate interests
• Right to Complain: Lodge a complaint with your local data protection authority
• Data Controller: Muse & Co is the data controller for your personal information

11.2 Data Transfer Safeguards

We rely on standard contractual clauses and appropriate safeguards to ensure your data is protected when transferred internationally.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

12.1 How We Notify You

• Website Notice: Updated "Last Updated" date at the top of this page
• Email Notification: For material changes, we will send an email to registered users
• In-App Banner: Prominent notification on our website/app

Your continued use of our services after changes take effect constitutes acceptance of the updated policy. If you do not agree to changes, please discontinue use of our services.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to your inquiry within 30 days. For urgent security concerns, please mark your message as "Urgent."