Legal
Privacy Policy
This policy describes how Rest and Recovery Spa (“we,” “us,” or “the studio”) collects, uses, stores, and shares personal information when you visit our website, book services, join a membership, or shop with us.
1. Who we are
Rest and Recovery Spa operates the Kingwood, Texas studio formerly known as Planet Beach Kingwood, and the online experience at restandrecoveryspa.com (and related member and staff portals). Rest and Recovery Spa is a DBA of MCJC23 LLC. For privacy questions, contact us at (281) 312-1130, or write to 2665 Royal Forest Dr, Suite B100, Kingwood, TX 77339.
2. Information we collect
Depending on how you use our services, we may collect:
- Account and contact details — name, email address, phone number, and password (stored in hashed form by our authentication provider).
- Booking and membership data — service preferences, appointment history, membership tier, billing day, and related studio notes needed to deliver sessions.
- Payment information — card payments are processed by CyberSource (a Visa solution). We do not store full card numbers on our servers. We may store tokenized payment instrument identifiers, last-four digits, card brand, and billing address needed for recurring memberships or saved methods.
- Retail and loyalty data — orders, gift cards, points balances, and redemptions.
- Device and usage data — IP address, browser type, pages viewed, and similar diagnostics via cookies or analytics tools we enable.
3. How we use information
- To create and manage member accounts and staff access.
- To schedule, confirm, remind, and fulfill bookings and memberships.
- To process payments, refunds, and recurring billing through CyberSource.
- To operate loyalty, referrals, and promotional communications you opt into.
- To improve studio operations, security, and customer support.
- To comply with legal obligations and enforce our Terms of Service.
4. Payment processing
Card-not-present and card-present payments are handled by CyberSource and, where applicable, our in-studio terminal bridge. Payment processors receive the data needed to authorize and settle transactions under their own privacy practices. We retain transaction identifiers and amounts for accounting, refunds, and dispute resolution.
5. Cookies and similar technologies
We use cookies and local storage for authentication sessions, security, remembering preferences, and understanding site performance. You can control cookies through your browser settings; disabling some cookies may limit login or booking features.
6. How we share information
We do not sell your personal information. We may share data with:
- Service providers who host our app, database, email, or payment infrastructure.
- Professional advisors or authorities when required by law or to protect rights.
- Successors in the event of a business transfer, subject to appropriate safeguards.
SMS/Text Messaging
If you provide your mobile phone number and consent to receive text messages from us, your mobile number will not be shared or sold to third parties for marketing purposes. Message frequency varies based on your account activity and the type of messages you've opted into. Message and data rates may apply, depending on your mobile carrier plan.
7. Retention and security
We retain account, booking, and payment records for as long as needed to operate the studio, meet accounting and legal requirements, and resolve disputes. We use access controls, encrypted transport, and least-privilege staff roles to protect data. No method of transmission or storage is perfectly secure.
8. Your choices
You may update profile details in the member portal, request access or correction of personal data, or ask us to close an account (subject to legal retention needs). Marketing emails include unsubscribe options where required.
Cookie and analytics preferences. When you visit our marketing site, you can choose Essential only (required cookies for sign-in and booking) or Allow analytics (optional tools such as traffic measurement). We do not sell your personal information. Choosing analytics does not mean we sell or share your data for money—it only enables the optional measurement tools described in section 5.
California and other state residents may have additional rights under applicable privacy laws, including the right to opt out of certain sharing for cross-context behavioral advertising. To exercise those rights, contact us at the phone or address in section 1 or use Essential only on the site notice to disable optional analytics cookies.
9. Children
Our online services are not directed to children under 13. We do not knowingly collect personal information from children under 13 online.
10. Changes
We may update this policy from time to time. The “Last updated” date above will change when we do. Continued use of the site after an update constitutes acceptance of the revised policy where permitted by law.