Extend USA Hair Extensions® Privacy Policy

Last updated: August 29, 2026

This privacy notice for Cris Richards Inc., doing business as Extend USA Hair Extensions® (“Extend USA Hair Extensions,” “we,” “us,” or “our”), explains how and why we may collect, store, use, and/or share (“process”) your information when you use our services (“Services”), such as when you:

visit our website at https://www.extendusa.com, or any other website of ours that links to this privacy notice; or
engage with us in other related ways, including any sales, marketing, or events.

If you have questions or concerns after reading this privacy notice, please contact us at support@extendusa.com.

If you do not agree with our policies and practices, please do not use our Services.

Summary of Key Points

This summary highlights key points from our privacy notice. For more detail on any topic, read the full section referenced below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information? We may process certain sensitive personal information only when necessary, and either with your consent or as otherwise permitted by applicable law.

Do we collect any information from third parties? We may collect information about you from public databases, marketing partners, social media platforms, and other external sources.

How do we process your information? We process your information to provide, operate, and improve our Services, communicate with you, protect against fraud and enhance security, and comply with legal obligations. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal basis to do so.

In what situations and with which types of parties do we share personal information? We may share information in specific situations (for example, with your consent, to comply with the law, to protect rights, or in connection with a business transfer), and with specific categories of third parties (such as service providers and professional advisors).

How do we keep your information safe? We use a combination of organizational and technical safeguards designed to protect your personal information. However, no system or electronic transmission over the Internet is 100% secure, and we cannot guarantee that hackers, cybercriminals, or other unauthorized third parties will never be able to defeat our security and access, steal, or alter your information.

What are your rights? Depending on where you live, you may have certain rights under applicable privacy laws, such as rights to access, correct, delete, restrict, or object to the processing of your personal information, as well as other rights.

How do you exercise your rights? The easiest way to exercise your privacy rights is to submit a data subject access request (if provided in our tools) or contact us at support@extendusa.com. We will review and respond to your request in accordance with applicable data protection laws.

1. What Information Do We Collect?

Personal information you disclose to us

In short: We collect personal information that you choose to provide to us.

We collect personal information that you voluntarily give us when you:

register for or use the Services;
request information about us or our products and Services;
take part in activities on the Services (for example, creating an account, filling out forms, or participating in promotions); or
contact us for any other reason.

Personal information you provide. The personal information we collect depends on how you interact with us and the Services, the choices you make, and the products and features you use. This information may include:

names
phone numbers
email addresses
mailing addresses
job titles
usernames
contact preferences
contact or authentication data
billing addresses
passwords
debit/credit card numbers

Sensitive information. When necessary, and only with your consent or as allowed by applicable law, we may process certain categories of sensitive information, such as student data.

Payment data. If you make a purchase, we may collect the data needed to process your payment, such as your payment card or other payment instrument number and the security code associated with that payment instrument. We do not store full payment card details ourselves. All payment data is stored by our payment processors:

Google Pay – https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=privacynotice&ldl=en-US
Apple Pay – https://www.apple.com/legal/privacy/data/en/apple-pay/
PayPal – https://www.paypal.com/us/legalhub/privacy-full#personalData

Please review their privacy notices for more information about how they handle your data.

Social media login data. We may allow you to register or log in using your existing social media accounts (for example, Facebook, X, or other platforms). If you choose this option, we receive certain profile information from your social media provider. The information we receive varies by provider and your settings but may include your name, email address, friends or contacts list, profile picture, and other information you choose to make public on that platform.

All personal information you provide must be true, complete, and accurate, and you must tell us if your information changes.

Information automatically collected

In short: Some information is collected automatically when you use the Services (for example, device and usage data).

When you visit, use, or navigate the Services, we automatically collect certain technical and usage information. This information generally does not directly identify you but may include IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country and approximate location, information about how and when you use the Services, and other technical data.

We use this data mainly to maintain the security and normal operation of the Services and to perform internal analytics and reporting. Like many businesses, we also collect information using cookies and similar technologies.

Log and usage data. Service-related, diagnostic, usage, and performance information that our servers automatically log when you access or use the Services. This may include IP address, device information, browser type and settings, date and time stamps of your use, pages and files viewed, searches you perform, features you use and actions you take, and device event information (such as system activity, error reports or “crash dumps,” and hardware settings).

Device data. Information about the computer, phone, tablet, or other device you use to access the Services. Depending on the device, this may include IP address (or proxy server), device and application identification numbers, general location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration data.

Location data. We may collect information about your device’s location, either precise (for example, using your browser’s geolocation feature) or imprecise (for example, based on your IP address or network). You can block location data collection by refusing access when prompted or turning off location services in your device or browser settings. However, if you disable location features, some parts of the Services may not work properly.

Information collected from other sources

In short: We may receive limited information about you from other sources (such as public databases and marketing partners).

To improve our Services and keep our records up to date, we may receive information about you from public databases, joint marketing partners and affiliate programs, data providers, social media platforms, and other third parties. This information may include mailing addresses, job titles, email addresses, phone numbers, intent or user behavior data, IP addresses, social media profiles and URLs, and custom profiles.

We may use this information for purposes such as targeted advertising and event or promotion marketing. If you interact with us through a social media platform using your social media account, we may receive personal information about you from that platform, such as your name, email address, and gender; the exact information we receive depends on your social media privacy settings. How those platforms use your information is governed by their own privacy policies, not by this privacy notice.

2. How Do We Process Your Information?

In short: We process your information to run and improve our Services, communicate with you, prevent fraud and security issues, and comply with the law. We may also process your information for other purposes with your consent.

We process your personal information for different reasons depending on how you interact with the Services, including:

To create and manage your account, so you can register, log in, and keep your account working properly.
To deliver our Services and provide the products, features, and services you request.
To respond to inquiries and support requests.
To send administrative information, such as details about our products and services, updates to our terms and policies, and other similar administrative messages.
To fulfill and manage orders, including processing orders and payments, managing shipping and delivery, and handling returns and exchanges.
To enable user-to-user communications, if you use features that allow you to communicate with other users.
To request feedback and contact you about your experience with the Services.
To send marketing and promotional communications, where allowed by your marketing preferences and applicable law. You can opt out at any time.
To deliver targeted advertising that is more relevant to your interests and location.
To protect our Services, including maintaining safety and security and monitoring for and preventing fraud.
To identify usage trends and improve functionality.
To measure marketing performance so we can make our campaigns more relevant to you.
To protect vital interests, for example to help prevent serious harm.

3. What Legal Bases Do We Rely On to Process Your Information?

In short: We process your personal information only when we believe we have a valid legal reason to do so, such as your consent, a contract with you, our legitimate business interests, legal obligations, or the protection of vital interests.

If you are in the EU or UK. The GDPR and UK GDPR require us to explain the legal bases we rely on to process your personal information. We may rely on:

Consent — we may process your information if you have given us consent for a specific purpose. You can withdraw your consent at any time.
Performance of a contract — we may process your information when it is necessary to fulfill a contract with you or to take steps at your request before entering into a contract, including providing the Services you have requested.
Legitimate interests — we may process your information when we believe it is reasonably necessary for our legitimate business interests and those interests do not override your rights and freedoms. For example, to send information about special offers and discounts; develop and show you personalized content or advertising; analyze how the Services are used; support our marketing activities; diagnose problems and prevent fraud or misuse; and understand how users interact with our products and services.
Legal obligations — we may process your information when necessary to comply with the law, such as to cooperate with law enforcement or regulatory authorities, exercise or defend our legal rights, or provide information as evidence in legal proceedings.
Vital interests — we may process your information when necessary to protect your vital interests or those of another person.

If you are in Canada. We may process your information with your express consent for a specific purpose, or in some cases based on implied consent where your permission can reasonably be inferred from your actions or the context. You may withdraw your consent at any time. In some limited situations, Canadian law may allow us to process your information without your consent, including for example: when collection is clearly in an individual’s interests and consent cannot be obtained in time; for investigations and fraud detection or prevention; in the context of certain business transactions; when contained in a witness statement needed to assess an insurance claim; for identifying injured, ill, or deceased individuals and contacting next of kin; if we reasonably believe someone has been a victim of financial abuse; when obtaining consent could compromise the availability or accuracy of the information in an investigation; when disclosure is required to comply with a subpoena, warrant, or court order; when information is produced by an individual in the course of their employment, business, or profession; when collection is solely for journalistic, artistic, or literary purposes; or when the information is publicly available and specified by regulation.

4. When and With Whom Do We Share Your Personal Information?

In short: We share your information in specific situations and with specific categories of third parties who help us run our business.

Vendors, consultants, and other third-party service providers. We may share your information with third parties who perform services for us or on our behalf and who need access to your information to carry out that work. These may include cloud computing services, data analytics services, data storage providers, communication and collaboration tools, order fulfillment providers, payment processors, sales and marketing tools, performance monitoring tools, product engineering and design tools, testing tools, user account registration and authentication services, and affiliate marketing programs.

We have contracts in place with these third parties designed to protect your personal information. These third parties may only use your personal information as instructed by us, may not use it for their own purposes, may not share it with any other organization except as authorized by us, and must protect your data and keep it only for the time period we specify.

Other situations where we may share information:

Business transfers. We may share or transfer your information in connection with, or during negotiations for, any merger, sale of company assets, financing, or acquisition of all or part of our business by another company.
Use of Google Maps Platform APIs. When we use Google Maps Platform APIs, we may share certain information with Google as needed for those features to work.

5. Do We Use Cookies and Other Tracking Technologies?

In short: We may use cookies and other tracking technologies to collect and store your information.

Tracking technologies. We use cookies and similar technologies (like web beacons and pixels) to collect information when you interact with our Services. These help us keep systems secure, fix issues, save your preferences, and support how the site works.
Third-party tracking. We allow third parties to use tracking technologies on our Services for analytics and advertising. This includes managing and displaying ads, tailoring ads to your interests, and sending reminders for abandoned shopping carts.
Opting out. If online tracking technologies are considered a “sale” or “sharing” under US state laws, you can opt out by following the instructions in the section “Do United States Residents Have Specific Privacy Rights?”

Google Analytics. We use Google Analytics to track and analyze how people use our Services. Features we may use include Demographics and Interests Reporting, Remarketing, and Display Network Impressions Reporting. To opt out of being tracked by Google Analytics, visit Google Analytics Opt-out. To opt out of Google Analytics Advertising Features, visit Ads Settings and other opt-out means such as Network Advertising and Mobile Choice. For more information on Google’s privacy practices, visit Google Privacy & Terms.

6. How Do We Handle Your Social Logins?

In short: If you use a social media account to register or log in to our Services, we may access certain information about you.

Our Services allow you to register and log in using social media accounts (like Facebook or X). We may receive profile information such as your name, email address, friends list, and profile picture, depending on the provider and your privacy settings. We use the information received only as described in this privacy notice or as made clear on the relevant Services. We are not responsible for other uses of your personal information by the social media provider. We recommend reviewing their privacy notice for details on their data practices.

7. Is Your Information Transferred Internationally?

In short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed by us and by those third parties with whom we may share your personal information, in the United States and other countries.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, these countries may not necessarily have data protection laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this privacy notice and applicable law. We have implemented measures to protect your personal information, including using the European Commission’s Standard Contractual Clauses for transfers of personal information between our group companies and between us and our third-party providers. Our Standard Contractual Clauses can be provided upon request.

8. How Long Do We Keep Your Information?

In short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law.

We will only keep your personal information for as long as necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than sixty (60) months past the termination of the user’s account. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible, securely store it and isolate it from any further processing until deletion is possible.

9. How Do We Keep Your Information Safe?

In short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not