We keep your inquiry for 24 months and sell none of it.

Effective date

This policy takes effect on September 30, 2026 and replaces every earlier version. It was last updated on the same day. If a clause is changed, the date at the top of this card changes with it.

Who runs this site

The site is operated by Romasposa, trading at romasposa.us as Roma Sposa. Romasposa decides what is collected here and why, which makes it the controller of your data.

Postal address: 722 N Old Woodward Ave, Birmingham, Michigan 48009, United States. Phone +1 248-723-4300. Email [email protected].

That is the salon itself. Letters addressed there reach the same people who book fittings.

What we collect

Less than most shops. No account, no password, no payment and no card data. Nothing is sold through this site and no payment is taken on it.

1. The inquiry form. When you send the form on the appointment page or the home page, rigaf6c.php stores your name, phone, email, the address or city you give, the kind of inquiry, your message, the specification you ask about and your consent tick.
2. Recorded with the form, automatically. Your IP address, your browser's user-agent string, the referring URL, the moment the form was rendered and the moment it was sent. The two timestamps exist to catch automated spam, which fills a form in under a second.
3. The support chat. jinof88.php keeps the conversation: what you write, what we answer, and the name, phone or email you choose to add. A token is kept in your browser so you can come back to the same thread.
4. Your cookie choice. Stored in your browser under site_consent_v2. Nothing else on this site persists a choice.
5. Advertising click identifiers. When you arrive from a paid ad, the link carries gclid, msclkid or fbclid. With your permission the matching platform tag reads it and sets its own cookies. The cookie statement lists each one.
6. Server logs. The host records requests to the server: IP address, time, page requested, user-agent and response code.

Measurements taken in the salon during a fitting are written on paper at the bench. They are not collected through this site and this policy does not cover them.

What it is used for

Inquiry details are used to reply to you, offer appointment times and prepare the salon for your visit, for example by pulling the Structured Ball Gown or a cathedral veil before you arrive. The automatic form data is used to filter spam and to trace abuse.

Chat messages are used to answer the question you asked. Server logs keep the site running and show us attacks.

Click identifiers and ad cookies, once you allow them, tell Google Ads, Microsoft Advertising and Meta Ads that a paid click led to an inquiry. That is how we see which ads bring brides to the atelier and which waste money. We do not build profiles of you ourselves and we do not sell or rent any list.

Legal bases

For visitors covered by the GDPR, each use rests on one of the bases below. Under US state law the same table tells you why we hold the data.

Where the basis is consent, you can withdraw it at any time. Withdrawal does not undo processing that happened before it.

Advertising platforms

This site receives paid traffic today. Google Ads and Microsoft Advertising run campaigns that send people here, and Meta Ads does when a campaign is live there. Each platform adds its own identifier to the link you click:

1. Google Ads attaches gclid.
2. Microsoft Advertising attaches msclkid.
3. Meta Ads attaches fbclid.

The identifier sits in the address bar whether or not you consent, because the platform put it there. What changes with your choice is whether our tags read it and store a cookie. Without consent they do not.

We do not claim any platform has reviewed or endorsed this site. They sell us ad space. That is the relationship.

Consent Mode v2

The site runs Google Consent Mode v2. Before the page does anything else it sets four signals to denied: ad_storage, ad_user_data, ad_personalization and analytics_storage. They stay denied until you press Allow in the cookie bar.

Press Allow and all four switch to granted. Press Decline, or withdraw later through the Cookie choices button in the footer, and all four go back to denied at once. While they are denied, tags send only cookieless pings with no identifier, and no advertising cookie is written.

The same choice governs the Microsoft and Meta tags. One answer, applied to all of them.

Who receives data

Named one by one. Nobody else gets it.

1. Google Ireland Ltd and Google LLC, for Google Ads. Receives the gclid and the consent signals. policies.google.com/privacy.
2. Microsoft Ireland Operations Ltd, for Microsoft Advertising. Receives the msclkid. Its handling is covered by the Microsoft privacy statement at privacy.microsoft.com/privacystatement.
3. Meta Platforms Ireland Ltd, for Meta Ads, where a campaign runs there. Receives the fbclid. facebook.com/privacy/policy.
4. The hosting provider that serves this site and stores the inquiry database and chat transcripts on its servers, under a processing agreement.
5. The mail provider that carries the notification of each inquiry to the atelier's inbox at [email protected].

We would also disclose data if a court or a lawful authority ordered it. That has to be a real order, not a request by phone.

Transfers abroad

The atelier is in the United States and your data is handled here. If you write from Europe, your data leaves the European Economic Area when you send it. Google, Microsoft and Meta move data between their Irish entities and the United States.

Those transfers rely on the EU-US Data Privacy Framework where the recipient is certified under it, and on the European Commission's Standard Contractual Clauses otherwise. You can ask us which mechanism covers a given recipient.

Retention periods

Twenty-four months is long on purpose. Brides often write a year or more before the wedding, and a gown ordered after measurement can take months to arrive and be fitted. Ad platforms keep their own data on their own schedules, set out in the documents linked in clause 08.

Security

Every page is served over HTTPS, so the form travels encrypted. The inquiry database sits outside the public web folder and is reachable only through a password-protected operator panel. Access is limited to the people who answer inquiries.

The form carries hidden spam traps and a render timestamp, which keeps bulk submissions out of the database. No system is immune. If a breach affects your data, we tell you and the relevant authority within the time the law requires.

Rights under the GDPR

If you reach the site from the European Economic Area, the United Kingdom or Switzerland, the GDPR gives you these rights over your data:

1. Access: a copy of what we hold.
2. Rectification: correcting it when it is wrong.
3. Erasure: deletion, unless we must keep a record by law.
4. Restriction: we keep it but stop using it while a dispute is settled.
5. Portability: your form and chat data in a machine-readable file.
6. Objection: to any use based on legitimate interest, and to advertising measurement outright.
7. Withdrawing consent: at any time, as easily as you gave it.

You also have the right not to be subject to a decision made purely by automated means. We make none.

US state rights

US state privacy law applies to this site. In California, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to delete it, to correct it, and to opt out of its sale or its sharing for cross-context behavioral advertising. Colorado, Connecticut, Virginia, Utah, Texas, Oregon and the other states with laws in force give similar rights to their residents.

We do not sell personal information for money. Letting an ad tag read a click identifier can count as sharing under California law, so declining in the cookie bar is your opt-out of sharing. You can also write to us and ask. We will not treat you differently for using any of these rights: the same appointment and the same written quote.

Global Privacy Control

We honor Global Privacy Control. If your browser sends the Sec-GPC header, the site treats it as an opt-out of sale and sharing without asking again. The four Consent Mode signals stay denied and no advertising cookie is set, even if the banner is never touched.

Children

This site is for adults planning a wedding. It is not directed at children under 16 and we do not knowingly take data from them. If a child has sent us an inquiry, write to us and we delete it.

Complaints

Write to us first if you can, because a person here reads it and can usually put it right directly. You also have the right to complain to a regulator. In the United States that is your state Attorney General, and in California also the California Privacy Protection Agency. In Europe it is the data protection authority of the country where you live or work.

How to make a data request

Email [email protected] with the subject line "Data request", or write to Romasposa, 722 N Old Woodward Ave, Birmingham, Michigan 48009, United States. You can also call +1 248-723-4300 and we will log the request for you.

Tell us which right you want to use and the email or phone number you used on the form or in chat. That is how we find your records. We may ask one question to confirm the request comes from you, never for a copy of an ID document unless there is no other way.

We answer within 7 days. An authorized agent may make a request on your behalf with your signed permission.

Accessibility

We build this site to WCAG 2.2 level AA. Text on the pale grounds meets a contrast ratio of at least 4.5:1, every control can be reached and used with a keyboard, focus is marked with a visible ring, buttons and links are at least 44 pixels tall, and motion stops when your system asks for reduced motion.

Some parts fall short. The collection photographs carry short descriptions rather than full fabric notes, and the notes themselves are in the text beside them. If something on the site does not work with your screen reader or your setup, call +1 248-723-4300 or email [email protected]. We will give you the information another way and fix the page.

If you need anything arranged for the appointment itself, tell us when you book and we will plan the visit around it.

Changes to this policy

When the policy changes, the new version is published on this page with a new version number and a new date in the masthead. If a change widens what we collect or who receives it, the cookie bar asks for your choice again on your next visit. If you have an open inquiry with us, we email you about any material change.

Contact

A person reads every message. Email [email protected], call +1 248-723-4300, or write to Romasposa, 722 N Old Woodward Ave, Birmingham, Michigan 48009, United States.

For cookie questions, the cookie statement has the full list. For appointment and order rules, see the terms.