P.Privacy, data requests, accessibility
We keep your inquiry for 24 months and your chat for 12, and we answer a data request within 5 days.
This is how our bridal boutique in Seattle handles what you send when you book a bridal appointment, write to us in the chat, or arrive here from an ad.
What an appointment inquiry actually hands us.
Who runs this site
The site at thedresstheory.us is operated by Thedresstheory, trading as The Dress Theory, an award-winning bridal boutique. The postal address is 1423 N 45th St, Seattle, Washington 98103, United States. That is the shop floor where fittings happen, and it is also the address that receives letters about your data. For the purposes of the GDPR, Thedresstheory is the controller of the personal data described here.
We are a small, owner-led shop. The people who read your inquiry are the same people who pull gowns for your appointment. There is no call center and no outsourced inbox.
Every category we take
The inquiry form. When you ask for a bridal appointment in Seattle, or ask about a specific gown, the form sends us your name, phone number, email, address (usually a city or ZIP, so we can plan around travel), the kind of inquiry, your message, the specification you asked about (a silhouette, a size range, a gown from the collection) and whether you ticked the consent box.
Recorded with it, automatically. Your IP address, your browser's user-agent string, the page that referred you, the moment the form was rendered and the moment it was sent. The two timestamps are there to catch bots, which fill a form in under a second. People do not.
The support chat. If you use the chat window, we keep the conversation and any name, phone or email you choose to give it. Your browser keeps a token so you can close the tab and come back to the same thread.
Technical and log data. Our host writes standard access logs: IP address, time, the page requested, the response code, the user-agent.
Cookie and storage identifiers. Your consent choice is stored in your browser under site_consent_v2. Nothing else on this site stores a preference. If you allow storage, advertising and measurement cookies from Google, Microsoft and Meta are set; the full list sits on the cookie page.
Advertising click identifiers. A visitor who arrives from a paid ad brings a click identifier in the link: gclid from Google Ads, msclkid from Microsoft Advertising, fbclid from Meta Ads. Part 02 explains what happens to it.
We take no account, no password, no payment and no card data. Nothing is sold on this site. Gowns are ordered in person, at the fitting, in writing.
What each category is for
- Form fields: to reply, to book the appointment, to pull the right gowns and sizes before you arrive, and to keep the thread if you order.
- Automatic form data and timestamps: to block spam and repeated abuse of the form.
- Chat content and token: to answer you and keep the conversation in one place.
- Access logs: to keep the site running, find faults and trace attacks.
- The consent record: to remember your answer so the banner does not ask again on every page.
- Advertising cookies and click identifiers: to learn which Google, Microsoft or Meta ad led to an appointment request, and to stop paying for ads that do not.
We do not sell your data. We do not build a profile of you for anyone else. We do not add you to a newsletter because you asked about a lace sheath.
The legal basis for each purpose
For visitors from Europe, the GDPR asks us to name the basis for each use. Here they are, said plainly.
| Purpose | Data used | Basis |
|---|---|---|
| Replying and booking | Form fields, chat | Consent; steps before a contract |
| Managing an order | Name, contact details, specification | Contract |
| Spam and abuse checks | IP, user-agent, timestamps | Legitimate interest |
| Running the site | Access logs | Legitimate interest |
| Remembering your choice | site_consent_v2 | Legal obligation; legitimate interest |
| Ad measurement | Cookies, gclid, msclkid, fbclid | Consent |
Where the basis is consent, you can withdraw it at any time and the withdrawal applies from then on.
Children
This site is for adults planning a wedding. It is not aimed at children and we do not knowingly take data from anyone under 16. If a parent tells us a child has written to us, we delete the message and anything attached to it.
We pay for ads, and we measure them only once you say yes.
The platforms that send people here
We buy search and social ads for phrases like wedding dresses in Seattle and bridal boutique Seattle. Three platforms send that paid traffic to this site today.
- Google Ads. A click on a Google ad adds a
gclidparameter to the link. - Microsoft Advertising. A click on a Bing or Microsoft ad adds
msclkid. - Meta Ads. Where a campaign runs on Facebook or Instagram, a click adds
fbclid.
The identifier is a random string. On its own it does not tell us your name. What it can do, once you allow storage, is let the platform connect "someone clicked this ad" with "someone then sent an appointment request", so we see which ads bring brides through the door and which ones only spend money. Without your consent the identifier sits in the address bar and is not written to a cookie by us.
Buying ad space from these platforms is a purchase and nothing more. Their privacy rules still apply to their own cookies, and the cookie page links to each one.
Consent Mode v2
We use Google's consent mode, version 2, and send the same choice to the Microsoft and Meta tags. Before you answer the cookie banner, four signals are held at denied:
- ad_storagedenied
- ad_user_datadenied
- ad_personalizationdenied
- analytics_storagedenied
While they are denied, no advertising or analytics cookie is written and no ad data about you is sent for personalization. Google may still receive a cookieless ping that a page loaded, with the consent state attached. When you press Allow, the four signals switch to granted. When you press Decline, or later withdraw through Cookie settings in the footer, they go straight back to denied and stay there.
Global Privacy Control
If your browser sends the Global Privacy Control signal (the Sec-GPC header), we treat it as a refusal. The four Consent Mode signals stay denied, the banner does not ask you again, and it counts as your opt-out of any sale or sharing of personal data under the CCPA and the other state laws that recognise it.
Five recipients, and every record has an end date.
Who receives data, one by one
- Google Ireland Ltd and Google LLC
- Run Google Ads. Attach gclid to a click and receive the Consent Mode signals. Advertising cookies only after you allow them.
- Microsoft Ireland Operations Ltd
- Runs Microsoft Advertising. Attaches msclkid. Its own handling is set out in the Microsoft privacy statement at privacy.microsoft.com/privacystatement.
- Meta Platforms Ireland Ltd
- Runs Meta Ads. Attaches fbclid where a campaign runs there. Cookies only after you allow them.
- Our hosting provider
- Serves the site, writes the access logs and stores the inquiry and chat database. It processes on our instructions and may not use the data for itself.
- Our mail provider
- Carries the notification of a new inquiry to our inbox, and carries our replies to you.
Gown designers do not receive your contact details. When you order, we pass the designer your measurements, size, colour and delivery date. Not your email, not your phone.
Data leaving the country
We collect data in the United States and store it with a US host. If you write from Europe, your data travels to the US to reach us. Google, Microsoft and Meta also move data between the US and Europe. Those transfers rely on the EU-U.S. Data Privacy Framework where the company is certified under it, and on the European Commission's Standard Contractual Clauses otherwise.
How long we keep each thing
| Record | Kept for | Then |
|---|---|---|
| Inquiries and their email copies | 24 months | Deleted |
| Chat transcripts | 12 months | Deleted |
| Server and access logs | 90 days | Overwritten |
| Record of a consent choice | 12 months | Banner asks again |
Twenty-four months is not arbitrary. Brides order eight to ten months ahead, fittings run to two or three weeks before the wedding, and questions about a hem or a bustle often come after. Two years covers that without holding on for the sake of it. Order paperwork is governed by the terms of service.
How it is protected
Every page and form is served over HTTPS. The inquiry database sits behind a login that only the owners hold, on a host that is patched and backed up. The form is protected by two hidden honeypot fields and the timing check, so bulk spam never reaches a human. We do not keep inquiries in spreadsheets on shared laptops, and we do not forward them to personal accounts. No system is perfect. If we learn of a breach that affects you, we tell you and the relevant authority as the law requires.
Ask for a copy, a correction or a deletion. We answer within 5 days.
Rights under the GDPR
If you reach this site from the European Union, the European Economic Area or the United Kingdom, the GDPR (or the UK version of it) gives you these rights over your data:
- Access: a copy of what we hold about you.
- Rectification: fixing anything wrong or out of date.
- Erasure: deletion, unless we must keep an order record.
- Restriction: we keep the data but stop using it while a dispute is settled.
- Portability: your form and chat data in a plain, machine-readable file.
- Objection: to any use based on our legitimate interest.
- Withdrawing consent: at any time, without affecting what was done before.
Rights under US state law
California residents have rights under the CCPA, as amended by the CPRA: to know what personal information we collect and why, to get a copy, to have it deleted, to correct it, to limit use of sensitive information, and to opt out of the sale or sharing of personal information. We do not sell personal information for money. Allowing advertising cookies can count as "sharing" for cross-context advertising under California law, so you can opt out by pressing Decline, by using Cookie settings in the footer, or by sending the Global Privacy Control signal. Residents of Washington, Colorado, Connecticut, Virginia, Oregon, Texas and the other states with privacy laws in force have matching rights, and we honour them the same way wherever you live. Using a right never changes how you are treated at an appointment.
If you want to complain
Tell us first, and we will try to put it right. You can also complain to your state Attorney General; in California, to the California Privacy Protection Agency as well. Visitors from Europe can complain to the data protection authority in the country where they live or work.
How to make a request
Email [email protected], write to The Dress Theory, 1423 N 45th St, Seattle, Washington 98103, United States, or use the form below. We answer within 5 days. If we need to confirm it is you, we ask for the email or phone you used with us, never for an ID document by email. An authorised agent can act for you with your signed permission.
Data request form
When this policy changes
We change the "last updated" date at the top of this page and describe the change in a short note here. If a change widens what we do with data you already gave us, we email the people it affects before it applies, and we ask the cookie question again.
Reaching a person
Email [email protected] or call +1 206-550-7948. Post goes to The Dress Theory, 1423 N 45th St, Seattle, Washington 98103, United States. One of the owners reads it.
The site, and the salon, should work for every bride.
We build this site to the Web Content Accessibility Guidelines 2.1 at level AA. That is the target, and we test against it at phone, tablet and desktop widths.
What is in place
- A skip link as the first thing on every page, and full keyboard use of the menu, the tabs on this page, the forms and the chat.
- Visible focus rings in garnet on every link, button and field.
- Text in near-black ink on warm white, with contrast above the 4.5 to 1 minimum for body copy.
- Every photograph of a gown carries a written description of fabric and silhouette.
- Parallax and reveal movement switch off when your device asks for reduced motion.
- Form errors are written in words next to the field, never shown by colour alone.
Where we fall short
Lace is hard to describe in an alt attribute. A photograph of Chantilly over silk crepe says more than a sentence can, and we know the description is a poor substitute. Ask, and we will describe any gown by phone in as much detail as you want.
At the boutique
Tell us when you book if you need anything at the appointment: a longer slot, a chair on the fitting platform, a quieter time of day, or a person who reads the tags aloud. We plan around it.
Found a barrier on this site? Email [email protected] or call +1 206-550-7948 with the page and what went wrong. We reply within 5 days.