PRIVACY POLICY

Last Updated: September 19, 2026

Shaped AF LLC (“Shaped,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information when you visit shapedaf.com (the “Site”), purchase products, book or receive services, communicate with us, sign up for marketing, participate in promotions or events, or otherwise interact with Shaped online or in person.

By using our Site or services, you acknowledge the practices described in this Privacy Policy.

1. CONTACT US

If you have questions about this Privacy Policy, our privacy practices, or would like to exercise a privacy right, you may contact us at:

Shaped AF LLC
956 Valencia Street
San Francisco, CA 94110
United States

Email: info@shapedaf.com

2. PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on how you interact with Shaped.

We may collect the following categories of information:

Contact and Identification Information

This may include your name, email address, phone number, billing address, shipping address, account information, and other information you provide to us.

Appointment and Service Information

When you book or receive a service, we may collect information such as your appointment date and time, services booked, service history, membership information, preferences, communications with our team, and information you choose to provide that is relevant to your treatment or experience.

Skin, Body, and Treatment Information

When appropriate for a service, you may choose to provide information about your skin, body, treatment goals, sensitivities, allergies, medications, prior cosmetic procedures, health considerations, or other information relevant to safely providing or customizing a treatment.

We use this information primarily to provide, personalize, and safely perform the services you request.

Transaction and Purchase Information

We may collect information about purchases, appointments, memberships, discounts, credits, refunds, transaction history, billing information, and payment status.

Payment card information is generally processed by our payment processors and commerce or booking providers. We do not necessarily receive or store complete payment card numbers ourselves.

Website and Device Information

When you use our Site, we and our service providers may automatically collect information such as:

• IP address
• Browser and device type
• Device identifiers
• Operating system
• Pages viewed
• Links clicked
• Referring pages or websites
• Date and time of visits
• Approximate location derived from an IP address
• Shopping and browsing activity
• Interactions with advertisements
• Cookie and pixel identifiers
• Website events and conversion activity

Communications

We may collect information you provide when you email, call, text, message, submit a form, communicate through social media, contact customer support, leave feedback, or otherwise communicate with Shaped.

Marketing Information

If you subscribe to our emails, text messages, promotions, or other marketing communications, we may collect your contact information, marketing preferences, interactions with communications, and information about how you engage with our marketing.

User-Submitted Content

If you submit a review, testimonial, photograph, video, model application, survey response, social media content, or other material to us, we may collect and process that information in accordance with the purpose for which it was submitted and any applicable authorization or agreement.

3. HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information:

• Directly from you
• When you visit our Site
• When you purchase a product
• When you book or receive a treatment
• When you create an account or membership
• When you communicate with our team
• Through cookies, pixels, tags, SDKs, and similar technologies
• From our booking, commerce, payment, analytics, advertising, and marketing providers
• From social media platforms when you interact with us
• From advertising partners
• From referrals, promotions, events, or partnerships
• From other sources where permitted by law

4. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

• Provide and personalize treatments and services
• Schedule, confirm, modify, and manage appointments
• Maintain customer and treatment records
• Process purchases, memberships, payments, credits, and refunds
• Fulfill and ship product orders
• Communicate with you about appointments, purchases, memberships, or customer service matters
• Respond to questions and requests
• Operate and improve our Site and services
• Understand how visitors use our Site
• Measure advertising and marketing performance
• Measure completed bookings and other website conversions
• Personalize advertising where permitted by law
• Send marketing communications where permitted by law
• Administer promotions, events, model calls, surveys, or loyalty programs
• Detect, investigate, and prevent fraud, misuse, security incidents, and other prohibited activity
• Protect Shaped, our customers, employees, and others
• Maintain records and conduct internal business operations
• Comply with legal, tax, accounting, regulatory, and contractual obligations
• Establish, exercise, or defend legal claims
• Carry out other purposes disclosed to you at the time information is collected

5. APPOINTMENT BOOKING

Shaped uses third-party technology to facilitate appointment scheduling and customer management.

When you book an appointment, information such as your name, contact information, appointment details, service selections, membership information, payment information, and other information you provide may be processed through our booking and customer management providers, including Mangomint.

We may also use website technology to determine when an online booking has been successfully completed. This information may be used for analytics, conversion measurement, advertising performance, and business reporting, subject to applicable privacy choices and law.

6. ONLINE STORE AND SHOPIFY

Our online store and portions of our Site are powered by Shopify.

Shopify may process information about your device, browsing activity, purchases, checkout activity, payment information, and interactions with our Site in order to provide commerce, security, analytics, personalization, and related services.

Shopify may process information in accordance with its own privacy terms and the services we have enabled.

7. EMAIL AND TEXT MARKETING

We may use providers such as Klaviyo and other communications platforms to send email or text communications, manage subscriber lists, personalize communications, and understand engagement.

Where required, we obtain consent before sending marketing communications.

You may unsubscribe from marketing emails at any time by using the unsubscribe link included in our marketing emails.

If we offer SMS marketing, you may opt out of marketing text messages by following the opt-out instructions provided in the message, such as replying STOP.

Opting out of marketing does not prevent us from sending transactional or service-related communications, such as appointment confirmations, purchase confirmations, security messages, or communications necessary to provide services you requested.

Message and data rates may apply to text communications.

8. COOKIES AND SIMILAR TECHNOLOGIES

We and our service providers use cookies, pixels, tags, local storage, and similar technologies to operate the Site, remember preferences, understand Site usage, measure performance, prevent fraud, analyze traffic, and support advertising.

These technologies may collect information about your browser, device, IP address, Site activity, advertising interactions, and other online activity.

We generally use these technologies for the following categories of purposes:

Necessary: Required for core Site functions, checkout, security, customer privacy preferences, and other essential functionality.

Analytics: Help us understand Site traffic, performance, and how visitors interact with the Site.

Functional or Preference: Remember choices and improve functionality.

Advertising and Marketing: Help measure advertising performance, understand conversions, create audiences, and deliver or measure advertising where permitted.

Where required by applicable law, non-essential technologies are used subject to your consent or privacy choices.

You may manage available cookie and privacy preferences through the privacy controls provided on our Site and through your browser settings.

Disabling certain technologies may affect Site functionality.

9. ANALYTICS AND ADVERTISING

We use analytics and advertising services to understand how our Site performs, measure marketing campaigns, understand conversions, and advertise Shaped.

Depending on our current marketing activities, these providers may include services offered by:

• Google, including Google Analytics and Google Ads
• Meta, including Facebook and Instagram
• Reddit
• TikTok
• Shopify
• Other advertising, analytics, or marketing providers we may use from time to time

These services may use cookies, pixels, tags, device identifiers, and similar technologies to collect information about your interactions with our Site and advertisements.

For example, we may measure whether a visitor who interacted with an advertisement later completed an appointment booking.

Some disclosures of online identifiers and activity to advertising partners may be considered a “sale,” “sharing,” or “targeted advertising” under certain U.S. state privacy laws even though Shaped does not sell customer information for money in the traditional sense.

You may exercise applicable opt-out rights as described below.

10. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information to service providers and other parties that help us operate Shaped, including:

• Website and e-commerce providers
• Appointment booking and customer management providers
• Payment processors
• Shipping and fulfillment providers
• Email and communications providers
• Cloud hosting and technology providers
• Analytics providers
• Advertising and marketing providers
• Professional advisers such as attorneys, accountants, insurers, and consultants
• Fraud prevention and security providers
• Government authorities or other parties when required by law

We may also disclose information:

• With your direction or consent
• To fulfill a service you requested
• To comply with applicable laws, regulations, subpoenas, court orders, or lawful government requests
• To investigate or prevent fraud, security incidents, or illegal activity
• To protect our rights, property, customers, employees, or others
• In connection with a merger, financing, acquisition, sale, restructuring, bankruptcy, or transfer of some or all of our business or assets

11. SALE, SHARING, AND TARGETED ADVERTISING

Shaped does not sell personal information to third parties for money in the traditional sense.

However, some privacy laws define “sale” or “sharing” broadly. Our use of advertising technologies may involve disclosure of identifiers, device information, internet or network activity, commercial information, and advertising interactions to advertising and analytics partners in ways that may constitute “sale,” “sharing,” or processing for targeted advertising under applicable law.

Where applicable, you may opt out through the Your Privacy Choices or Do Not Sell or Share My Personal Information control available on our Site.

We also honor legally recognized opt-out preference signals, such as Global Privacy Control, where required by applicable law and where technically detectable.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

12. SENSITIVE PERSONAL INFORMATION

Depending on your interactions with us, some information you voluntarily provide may qualify as sensitive personal information under applicable law, including certain financial, health, treatment, or account-related information.

We use sensitive personal information for purposes reasonably necessary to provide requested services, process transactions, maintain security, comply with law, and operate our business.

Where applicable law provides a right to limit certain uses or disclosures of sensitive personal information, we will honor that right when it applies to our processing activities.

13. CALIFORNIA PRIVACY RIGHTS

California residents may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), subject to applicability and legal exceptions.

These rights may include:

Right to Know

You may request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, our purposes for collecting or using it, and the categories of third parties to whom it has been disclosed.

Right to Delete

You may request deletion of personal information we collected from you, subject to legal exceptions.

Right to Correct

You may request correction of inaccurate personal information we maintain about you.

Right to Opt Out of Sale or Sharing

You may have the right to direct us not to sell or share your personal information for cross-context behavioral advertising.

You may exercise this right through the Your Privacy Choices or Do Not Sell or Share My Personal Information link available on our Site.

Where required, we also process recognized Global Privacy Control signals as requests to opt out for the browser or device sending the signal.

Right to Limit Certain Uses of Sensitive Personal Information

Where applicable, you may have the right to limit certain uses and disclosures of sensitive personal information.

Right to Non-Discrimination

We will not unlawfully discriminate against you because you exercise an applicable privacy right.

Authorized Agents

You may designate an authorized agent to submit certain privacy requests on your behalf. We may request information necessary to verify the agent's authority and, where permitted, verify your identity directly.

14. CALIFORNIA CATEGORIES OF PERSONAL INFORMATION

During the preceding 12 months, depending on how consumers interacted with Shaped, we may have collected the following categories of personal information:

Identifiers: such as name, email address, telephone number, postal address, IP address, account identifiers, and online identifiers.

Customer Records Information: such as contact information, payment-related information, and customer account information.

Commercial Information: such as products or services purchased or considered, appointment history, membership information, transaction history, and preferences.

Internet or Other Electronic Network Activity: such as browsing activity, Site interactions, advertisement interactions, device information, and cookie or pixel data.

Geolocation Information: such as approximate location derived from an IP address.

Audio, Electronic, Visual, or Similar Information: such as photographs, videos, testimonials, or other content submitted to us or created with appropriate authorization.

Professional or Employment-Related Information: where voluntarily provided in connection with employment, applications, vendor relationships, model applications, or other relevant interactions.

Sensitive Personal Information: where voluntarily provided and applicable, such as certain account credentials, payment information, or information relevant to safely providing requested treatments.

Inferences: such as preferences or interests derived from interactions with our Site, services, or marketing.

We collect and use these categories for the purposes described throughout this Privacy Policy.

For advertising and analytics, we may disclose categories such as identifiers, commercial information, internet or electronic network activity, and related inferences to advertising and analytics partners. Such disclosure may constitute “sharing” or “sale” under certain privacy laws.

15. OTHER U.S. STATE PRIVACY RIGHTS

Residents of certain U.S. states may have additional privacy rights depending on applicable state law.

These rights may include rights to:

• Access personal information
• Correct inaccurate information
• Delete personal information
• Obtain a portable copy of certain information
• Opt out of targeted advertising
• Opt out of certain sales of personal information
• Opt out of certain profiling activities
• Appeal certain decisions regarding privacy requests

Where applicable, we will process requests in accordance with the law governing your request.

16. EEA, UK, AND OTHER INTERNATIONAL VISITORS

If you are located in the European Economic Area, United Kingdom, or another jurisdiction that provides similar data protection rights, you may have rights regarding your personal data.

Depending on applicable law, these may include rights to access, correct, erase, restrict processing, object to processing, and receive certain personal data in a portable format.

Where required, we process personal data under an appropriate legal basis, which may include:

• Performance of a contract with you
• Your consent
• Compliance with a legal obligation
• Our legitimate interests, where those interests are not overridden by your rights

You may withdraw consent where processing is based on consent, subject to applicable law.

Because Shaped and many of our service providers are located in the United States, personal information may be transferred to and processed in countries other than the country in which you reside. Where required, appropriate safeguards may be used for international transfers.

You may also have the right to lodge a complaint with the data protection authority responsible for your jurisdiction.

17. DATA RETENTION

We retain personal information for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining customer and transaction records, fulfilling legal and accounting obligations, resolving disputes, preventing fraud, enforcing agreements, and protecting our legal rights.

Retention periods vary depending on the type of information, the nature of our relationship with you, legal requirements, and legitimate business needs.

When information is no longer reasonably necessary, we may delete, de-identify, or anonymize it, subject to applicable law.

18. DATA SECURITY

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information.

However, no website, electronic transmission, database, or storage system can be guaranteed to be completely secure. You should use appropriate precautions when providing information online and protect passwords and account credentials from unauthorized access.

19. CHILDREN'S PRIVACY

Our Site and services are not directed to children under 13, and we do not knowingly collect personal information online from children under 13 without appropriate authorization.

We do not knowingly sell or share personal information of individuals under 16 for targeted or cross-context behavioral advertising without legally required authorization.

If you believe a child has provided personal information to us inappropriately, please contact us so we can review the matter.

Individual Shaped services may have separate age requirements, parental consent requirements, or treatment restrictions.

20. THIRD-PARTY WEBSITES AND SERVICES

Our Site may contain links to websites, platforms, booking services, social media services, or other third-party services that we do not control.

Their privacy practices are governed by their own privacy notices. We encourage you to review those notices before providing personal information.

21. SOCIAL MEDIA

If you interact with Shaped through social media platforms, those platforms may collect and process information independently from Shaped.

Your interactions with those services are governed by the privacy terms and settings of the applicable platform.

Information you make publicly available through social media may also be visible to Shaped and other users.

22. EMAIL MARKETING CHOICES

You may unsubscribe from promotional emails at any time using the unsubscribe mechanism included in our emails.

We will process marketing opt-out requests in accordance with applicable law.

Even after opting out of promotional messages, you may continue to receive non-promotional communications relating to appointments, purchases, memberships, transactions, customer service, safety, or our ongoing business relationship with you.

23. GLOBAL PRIVACY CONTROL

Where required by applicable law, our Site recognizes supported browser-based opt-out preference signals such as Global Privacy Control (“GPC”).

A recognized signal may apply only to the browser or device from which it is sent unless applicable law requires otherwise or we are able to associate the signal with your account.

You may also use the privacy choices available directly on our Site.

24. EXERCISING YOUR PRIVACY RIGHTS

To exercise an applicable privacy right, you may:

• Use the Your Privacy Choices or Do Not Sell or Share My Personal Information link on our Site for applicable sale/sharing or targeted-advertising opt-outs; or

• Contact us at info@shapedaf.com for access, deletion, correction, or other privacy requests.

We may need to verify your identity before completing certain requests. We will only request information reasonably necessary for verification and processing of your request.

We will respond within the time required by applicable law.

Certain requests may be denied or limited where an exception applies. If we deny a request, we will provide information about the decision where required by law.

25. LEGAL REQUESTS

We may preserve, access, or disclose personal information when we reasonably believe doing so is necessary to:

• Comply with applicable law or legal process
• Respond to lawful subpoenas, court orders, warrants, or government requests
• Protect or enforce our rights
• Investigate fraud, security incidents, or illegal activity
• Protect the safety, rights, or property of Shaped, our customers, employees, or others

26. BUSINESS TRANSFERS

If Shaped is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to applicable law.

27. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect changes in our practices, technology, services, legal obligations, or other operational reasons.

When we make changes, we will update the “Last Updated” date at the top of this policy.

If required by law, we will provide additional notice of material changes.

28. QUESTIONS OR COMPLAINTS

If you have questions, concerns, or complaints regarding this Privacy Policy or our handling of personal information, please contact:

Shaped AF LLC
956 Valencia Street
San Francisco, CA 94110
United States

Email: info@shapedaf.com

We will review privacy inquiries and respond as required by applicable law.