247 Routine Legal

Privacy Policy

Effective date: October 6, 2026
Last updated: October 6, 2026

247 Routine is a skin care routine, rewards, and membership app that spas and wellness studios ("Spas") offer to their clients. 247 Routine is a product of TAO Digital Agency LLC, a Florida limited liability company ("247 Routine," "we," "us," or "our").

This policy explains how we collect, use, share, and protect personal information when you use the 247 Routine mobile app, web app, and website at lp.247routine.com (together, the "Services").

247 Routine is available only in the United States, and only to people 18 or older.

1. Who this policy covers

  • Members: clients of a Spa who use the 247 Routine app.
  • Spa users: owners and staff of Spas who use the Spa Manager dashboard.
  • Visitors to our website at lp.247routine.com.

How 247 Routine and your Spa work together. Your Spa invites you to the app and decides which features, rewards, memberships, and messages it offers. We run the app and handle your information to provide it. Your Spa can see the information described in Section 4 so it can serve you. Your Spa's own use of your information is also covered by your Spa's privacy policy.

2. Consumer health data

Some information you add to the app, such as your skin type, skin concerns, skin logs, skin photos, products you use, and notes about how your skin reacts, may be "consumer health data" under laws such as Washington's My Health My Data Act and similar laws in Nevada and Connecticut. We treat this information with extra care for all members, wherever they live in the US:

  • We collect it only with your consent, which you give in the app before you first add it.
  • We share it with your Spa only with your separate consent, which you also give in the app.
  • We never sell it.
  • We never use it for advertising.
  • You can withdraw your consent, and delete this information, at any time in the app.

Section 10 is our Consumer Health Data Privacy Policy, with more detail.

247 Routine is a wellness and routine app. It is not a medical service, and it does not diagnose or treat any condition. We are not a HIPAA covered entity, and the app is not designed to store protected health information from medical providers.

3. Information we collect

Information you give us

  • Account information: name, email address, phone number, birthday (if you choose to share it for birthday rewards), and password or login details.
  • Skin profile and routine information: skin type, skin concerns, goals, the products in your routine, your morning and evening routine check-ins, and notes.
  • Skin photos: photos you take inside the app to track your progress.
  • Rewards and membership information: points, levels, streaks, rewards you redeem, membership status, and referrals you make.
  • Requests and messages: restock requests, feedback, private testimonials, and messages you send through the app.
  • Conversations with Esti: questions you ask Esti, our AI skin care assistant, and the answers you receive.

Information from your Spa

When your Spa invites you, it may send us your name, email, phone number, appointment history, membership status, and similar client details from its booking or client management system, so we can set up your account and match your visits to your rewards.

Information collected automatically

  • Device and app information: device type, operating system, app version, time zone, language, and crash reports.
  • Usage information: features you use, check-ins, and notification interactions.
  • Approximate location: only if you allow it, used to confirm you have arrived at your Spa for check-in rewards. We do not track your location in the background.
  • Push notification tokens: if you allow notifications.
  • Advertising identifiers: your device's advertising ID and similar identifiers, only where your device settings allow it (see Section 11).

What we do not collect

  • We do not use facial recognition, and we do not create face scans, face geometry, or other biometric identifiers from your photos.
  • We do not collect payment card details. The app does not process payments. Purchases happen directly with your Spa.

4. How we use and share information

How we use it

  1. to create and run your account and the app's features, including routines, check-ins, skin logs, progress photos, points, levels, rewards, memberships, and restock requests;
  2. to send the notifications and messages you have agreed to receive (see Section 7);
  3. to power Esti, so it can answer your questions using your routine and skin profile;
  4. to provide support, keep the app secure, prevent fraud and points abuse, and fix problems;
  5. to improve the app, using information that is aggregated or de-identified wherever possible; and
  6. to comply with the law and enforce our terms.

What your Spa can see

With your consent, your Spa can see your profile, routine, check-ins, skin logs, progress photos, points, rewards, membership, and requests, so it can recommend treatments and products, honor rewards, and fulfill your requests. Your Spa cannot see your conversations with Esti.

Who else we share with

  • Service providers that help us run the app, under contracts that limit their use of your information to providing services to us. These include cloud hosting and databases, push notification and text messaging providers, AI model providers that power Esti, email, analytics and crash reporting, and customer support tools.
  • Legal and safety reasons, when required by law or to protect the rights, safety, and property of our users, Spas, or 247 Routine.
  • Business transfers, as part of a merger, acquisition, or sale of assets, subject to this policy.
  • With your consent or at your direction.

We do not sell personal information for money. We may share limited device, usage, and website information with advertising partners to show and measure 247 Routine ads, as described in Section 11. You can opt out at any time.

5. Esti, our AI assistant

Esti uses artificial intelligence to answer skin care routine questions. Esti's answers are general wellness information, not medical advice, and can be wrong. Do not rely on Esti for medical decisions. If you have a skin condition, a reaction, or a medical concern, talk to a licensed professional.

We send your questions, and the parts of your profile Esti needs, to our AI model providers to generate answers. We choose providers and settings that do not use your information to train their public models, where the provider offers that option.

6. Skin photos

  • Photos are taken inside the app and are not saved to your phone's camera roll by the app.
  • We remove location and device metadata from photos when they are uploaded.
  • Photos are stored in encrypted storage in the United States, and access is limited and logged.
  • We keep your photos while your account is active, so you can see your progress from day one.
  • You can delete any photo at any time in the app.
  • When you close your account, we delete your photos within 30 days.
  • If your account has no activity for 3 years, we delete your photos automatically.

7. Notifications and text messages

  • Push notifications: sent only if you allow them on your device. You can turn them off in your device settings or in the app.
  • Text messages: sent only if you agree in the app. Messages may include routine reminders, rewards updates, membership updates, and offers from your Spa. Message frequency varies. Message and data rates may apply. Reply STOP to stop, or HELP for help. Consent is not a condition of any purchase.
  • We send marketing messages only during reasonable daytime hours in your local time zone.
  • We do not sell, rent, or share mobile phone numbers or text messaging opt-in data and consent with third parties or affiliates for their marketing purposes.

8. How long we keep information

  • Account, profile, routine, and rewards information: while your account is active. When you close your account, we delete it within 30 days, except where we must keep limited records by law (for example to prove consent or resolve a dispute).
  • Skin photos: see Section 6.
  • Esti conversations: up to 12 months, then deleted.
  • Inactive accounts: deleted after 3 years with no activity.
  • Backups: deleted information is removed from backups on our normal backup cycle, usually within 30 days.

9. Your rights and choices

You can, at any time:

  • see and update your information in the app;
  • download a copy of your information and photos;
  • delete individual photos, logs, or your whole account in the app (Settings, then Delete Account);
  • withdraw consent for consumer health data, location, notifications, or text messages;
  • opt out of the sale or sharing of your personal information for targeted advertising (see Section 11); and
  • ask questions or make requests by emailing admin@taodigitalagency.com.

We will confirm your identity before acting on a request, and respond within 45 days. If we deny a request, we will tell you why, and how to appeal. To appeal, reply to our decision with "Appeal" in the subject line. If we deny your appeal, you can contact your state attorney general.

Depending on your state, you may have additional rights under state privacy laws. We honor these rights for all US members.

10. Consumer Health Data Privacy Policy

This section applies to consumer health data as defined by the Washington My Health My Data Act and similar state laws.

  • Categories we collect: skin type, skin concerns and goals, skin logs, skin photos, products in your routine, reactions and notes, routine check-ins, and Esti conversations about your skin.
  • Sources: you, and information your Spa sends us about your visits and treatments.
  • Purposes: to provide the app features you use, as described in Section 4.
  • Categories we share and with whom: the categories above, with your Spa (with your consent), and with our service providers acting on our behalf.
  • Your rights: to confirm whether we collect, share, or sell your consumer health data; to access it and get a list of the third parties and affiliates we shared it with; to withdraw consent; and to delete it. Use the in-app tools or email admin@taodigitalagency.com.
  • We do not sell consumer health data.
  • No geofencing for health data. We do not use geofencing to collect consumer health data or to send health-related messages near health care facilities. Check-in location confirms only that you arrived at your Spa.

11. Cookies, advertising, and your choices

This section explains the cookies, pixels, software development kits (SDKs), and similar technologies used on our website at lp.247routine.com and in the app.

  • Essential technologies keep the website and app working and secure, for example for hosting, caching, security, sign-in, and remembering your privacy choices.
  • Analytics. We use analytics tools, such as Google Analytics loaded through Google Tag Manager on the website, to understand how people use the website and app, such as pages and screens viewed, time spent, device and browser type, and approximate location based on IP address.
  • Advertising. We may work with advertising partners, such as Google and Meta, to promote 247 Routine, measure our ads, and show 247 Routine ads to people who visited our website or used the app. These partners may use cookies, pixels, SDKs, and advertising identifiers to collect your IP address, device and browser information, advertising ID, pages and screens you view, and actions you take, such as signing up. Under some state privacy laws, this may be considered a "sale" or "sharing" of personal information, or "targeted advertising."
  • Fonts. The website loads fonts from Google Fonts, which receives your IP address to deliver them.
  • Forms and links. Some buttons on the website, such as the waitlist and intro call forms, take you to taodigitalagency.com. Information you submit there is handled under TAO Digital Agency's privacy policy.

What we never use for advertising. We never use consumer health data, skin photos, skin logs, routine details, Esti conversations, or the information your Spa sends us about you for advertising, and we never share them with advertising partners.

Your choices.

  • Opt out of sale, sharing, and targeted advertising: use the "Do Not Sell or Share My Personal Information" or "Cookie Settings" link at the bottom of any page of our website, use the privacy settings in the app where available, or email admin@taodigitalagency.com.
  • Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as a request to opt out for that browser.
  • Device settings: on iPhone, apps must ask your permission before tracking you across other companies' apps and websites. On Android, you can delete or reset your advertising ID in your device settings. You can also turn off ad personalization in your Google and Meta account settings.
  • Browser settings: you can block or delete cookies in your browser, and opt out of Google Analytics with Google's browser add-on at https://tools.google.com/dlpage/gaoptout.

An opt-out made through a browser applies to that browser and device. If you clear your cookies or use another browser, you may need to opt out again.

12. Security and breaches

We use administrative, technical, and physical safeguards, including encryption in transit and at rest, access controls, and logging. No system is completely secure. If a breach affects your information, we will notify you, and regulators such as the Federal Trade Commission, as the law requires.

13. Children

The Services are only for people 18 and older. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it.

14. Changes

We will post changes here and update the date at the top. For material changes, we will notify you in the app before they take effect, and ask for your consent again where the law requires it.

15. Contact

247 Routine, a product of TAO Digital Agency LLC
Privacy questions and requests: admin@taodigitalagency.com