Privacy Policy & Consent Governance
This policy details operational data retention, Consent Mode v2 implementation, advertising platform click identifiers, and legal rights for visitors contacting Dermai from the United States, Europe, and international jurisdictions.
Effective Date
This privacy framework took effect on October 18, 2026 and governs all active traffic, commercial communications, and digital session persistence.
Implementation Date
October 18, 2026. Prior revisions are archived and accessible via written request.
Scope of Application
Applies to all inbound visitors to dermai.click, formulation inquiry submissions, and chat interactions.
Controller
The data controller responsible for the collection, retention, and routing of personal records is identified below.
Legal Entity
Dermai, trading commercially at dermai.click.
Postal Address
224 Southwest 1st Avenue, Portland, Oregon 97204, Portland, Oregon, United States.
Designated Contact
Email: office@dermai.click | Telephone: +1 (464) 575-5061.
Data Collected
Dermai collects only specified fields submitted through interactive forms, live chat, and automated web server protocols.
| Data Stream | Technical Substance | Collection Channel |
|---|---|---|
| Inquiry Records | Name, business email address, direct telephone number, postal delivery address, inquiry kind classification, technical formulation specifications, and operational notes. | Transmitted directly by visitor via inquiry forms to jazie7b.php endpoint. |
| Server Connection Meta | Internet Protocol (IP) address, browser user-agent header, referring URL, HTTP method, page render timestamp, and form transmission timestamp. | Generated automatically by web server access logs upon request execution. |
| Live Support Transcripts | Inquiry body text, visitor self-identified contact information, session token stored in browser localStorage, and communication timestamps. | Interactively exchanged through batch dispatch support chat communicating with vuza192.php. |
| Advertising Click Identifiers | Google Ads gclid parameter, Microsoft Advertising msclkid parameter, and Meta Ads fbclid parameter appended to inbound landing page URLs. | Captured from URL query parameters to measure campaign routing and conversion integrity. |
| Consent Preference Token | Explicit record of visitor selection ('granted' or 'denied') stored strictly in browser localStorage under key site_consent_v2. | Persisted locally on visitor client device; no account credentials or financial data taken. |
Purposes
Every item of collected data is tied to a concrete operational function within our formulation facility.
Quotation & Sample Dispatch
Evaluating clinical requirements, calculating single pack unit prices ($33–$125 for serums/creams, $28–$150 for cleansers and body lines), verifying trade status, and routing physical sample parcels.
Direct Commercial Communication
Replying to batch availability inquiries, clarifying formulation run lengths, and transmitting certificates of analysis via email or phone.
Network Security & Abuse Prevention
Monitoring server logs to detect automated scrapers, malicious form submissions, and brute-force intrusion attempts against our infrastructure.
Paid Advertising Attribution
Verifying inbound campaign effectiveness from Google Ads, Microsoft Advertising, and Meta Ads without profiling individual consumer identities.
Legal Bases
Processing activities are justified under explicit lawful bases pursuant to article 6 of the General Data Protection Regulation and US statutory provisions.
| Operational Purpose | Legal Basis Applied | Statutory Rationalization |
|---|---|---|
| Sample & Batch Quotes | Contractual Necessity (Pre-contractual Steps) | Processing is required to prepare commercial quotations and execute sample dispatches requested by the visitor. |
| Advertising Signals & Cookies | Affirmative Consent | Non-essential tags and advertising signals execute only when granted explicitly via the consent banner. |
| Infrastructure Security Logs | Legitimate Interests | Protecting catalog availability, preventing fraudulent inquiries, and ensuring web application stability. |
| Statutory Records | Legal Obligation | Compliance with commercial accounting mandates, corporate records, and regulatory inquiry disclosures. |
Advertising Platforms
Dermai currently runs active commercial campaigns across major digital advertising networks. This site receives paid traffic today.
Google Ads
Operated by Google LLC / Google Ireland Ltd. Traffic directed to this site carries the gclid (Google Click Identifier) URL query parameter, used to verify keyword relevance and conversion actions.
Microsoft Advertising
Operated by Microsoft Ireland Operations Ltd. Paid search clicks append the msclkid parameter to destination URLs to confirm search engine attribution.
Meta Ads
Operated by Meta Platforms Ireland Ltd / Meta Platforms Inc. Campaigns direct traffic with the fbclid parameter for domain-verified web events.
Consent Mode
We enforce Google Consent Mode v2 directly within client scripts. Tracking signals remain strictly blocked prior to visitor interaction.
| Signal Parameter | Default Initial State | Behavior Upon Consent Event |
|---|---|---|
| ad_storage | denied | Switches to granted only if visitor selects 'Allow Storage'. Resets to denied upon decline or revocation. |
| ad_user_data | denied | Prevents transmission of user-specific identifiers to Google advertising endpoints until explicit opt-in. |
| ad_personalization | denied | Disables remarketing list population and personalized profiling unless affirmative approval is recorded. |
| analytics_storage | denied | Blocks measurement cookies and diagnostic telemetry until consent is explicitly acknowledged. |
Processors
Personal data is handled by verified third-party infrastructure entities bound by data processing agreements.
Google LLC / Google Ireland
Provides campaign analytics and conversion measurement for Google Ads. Privacy practices detailed at policies.google.com/privacy.
Microsoft Corporation
Provides search ad attribution via Microsoft Advertising. Handling practices are governed by the Microsoft Privacy Statement at privacy.microsoft.com/privacystatement.
Meta Platforms Ireland Ltd
Facilitates campaign measurement and audience matching for Meta Ads under strict business data terms.
Web Hosting Provider
Maintains managed web server hosting, encrypted file storage, and secure SQL databases holding inquiry form payloads.
SMTP Mail Relay
Routes transactional submission alerts from jazie7b.php directly to our operator inbox at office@dermai.click.
Transfers
Data originating outside the United States is transferred to secure domestic servers under standard contractual safeguards.
Primary Processing Location
All database storage, server logs, and sample records reside on secure servers located in the United States.
International Transfer Mechanisms
Transfers of European personal data rely upon European Commission Standard Contractual Clauses (SCCs) and adequacy frameworks where applicable.
Retention
Dermai does not store data indefinitely. We enforce fixed calendar retention schedules across every database table.
| Information Category | Mandatory Retention Limit | Disposal Protocol |
|---|---|---|
| Enquiries & Email Records | 36 Months | Permanent purge from active database tables and archived backup sets at conclusion of 3-year commercial cycle. |
| Live Chat Transcripts | 18 Months | Automatic deletion from chat session records and associated token bindings after 18 months. |
| Server Access & Error Logs | 90 Days | Automated log rotation and cryptographic overwriting every 90 days on production hosts. |
| Consent Banner Preference | 12 Months | Client-side localStorage key site_consent_v2 expires after 12 months, triggering re-prompt upon subsequent visit. |
Security
Technical safeguards are implemented across all application layers to prevent unauthorized access or alteration.
In-Transit Encryption
All connections enforce TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS) headers.
Input Sanitization
Every form field is validated server-side, stripped of malicious injection strings, and isolated from executable commands.
Access Restriction
Database access requires key-based authentication restricted to designated operations personnel led by Irina Petrova.
GDPR Rights
Visitors located within the European Economic Area possess statutory rights under the GDPR regarding their personal data.
| Statutory Right | Operational Substance | Execution Pathway |
|---|---|---|
| Right of Access | Request confirmation whether Dermai processes your personal data and obtain a structured export copy. | Submit written DSAR to office@dermai.click; fulfilled within 7 days. |
| Right to Rectification | Correct inaccurate business contact details, shipping addresses, or formulation requests in active files. | Notify support desk; records updated across active order files within 48 hours. |
| Right to Erasure | Request the permanent deletion of inquiry history, chat transcripts, and contact records ('right to be forgotten'). | Direct deletion request; data purged within 7 calendar days. |
| Right to Restriction | Limit processing of your records while an objection or accuracy contestation is being evaluated. | Inquiry records isolated from quotation pipelines upon receipt of notice. |
| Right to Portability | Receive submitted inquiry specifications and notes in a machine-readable JSON or CSV format. | Dispatched via secure encrypted email link within 7 days. |
| Right to Object | Object at any time to data processing carried out under the legitimate interest framework. | Ceases processing immediately unless overriding legitimate grounds are proven. |
| Withdrawal of Consent | Revoke consent for analytics or advertising storage at any time with immediate effect. | Click 'Consent Settings' in site footer to toggle status back to denied. |
US Rights
Residents of California, Oregon, and other US states enjoy enhanced protections under the CCPA/CPRA and state privacy enactments.
Right to Know & Delete
Under the California Consumer Privacy Act (CCPA), consumers may request disclosure of data categories collected, commercial sources, and request deletion of personal information.
Opt-Out of Sale or Sharing
Dermai does not sell personal information for monetary value. We do not exchange customer lists with marketing brokers. Cross-context behavioral advertising tags may be opted out through the consent interface.
Non-Discrimination
Exercising privacy rights will never result in altered pricing tiers, degraded service response times, or refusal of formulation quotations.
Global Privacy Control
Our web application listens for and honors automated browser opt-out signals without requiring manual user intervention.
Signal Protocol
Dermai recognizes the Global Privacy Control (Sec-GPC) browser header. When detected, advertising signals are suppressed automatically and storage keys remain set to denied.
Persistence Rule
A detected Global Privacy Control signal functions as an affirmative opt-out of ad personalization without asking the visitor to re-confirm.
Children
Dermai is a commercial catalog for aesthetic practitioners, laboratories, and adult skincare buyers.
Age Threshold
This site is not directed to individuals under eighteen (18) years of age. We do not knowingly collect, retain, or solicit personal information from minors.
Purge Commitment
If we identify that an inquiry was transmitted by a minor, the record is immediately and permanently purged from server storage.
Complaints
Visitors retain the right to lodge formal complaints with relevant supervisory and regulatory authorities.
United States Authorities
US residents may file complaints with their respective state Attorney General or the California Privacy Protection Agency (CPPA) for California inquiries.
European Authorities
EEA residents may submit complaints to their national Data Protection Authority (DPA) under Article 77 of the GDPR.
Data Request
Submit formal access, deletion, or correction requests directly to our data governance desk.
Postal Channel
Data Protection Desk, Dermai, 224 Southwest 1st Avenue, Portland, Oregon 97204, United States.
Electronic Channel
Direct email transmission to: office@dermai.click with subject line "Data Subject Access Request".
Response SLA
All verified requests receive a complete formal response within seven (7) calendar days of identity verification.
Changes
Modifications to regulatory requirements or operational procedures are reflected through public version updates.
Notice Procedure
Substantive amendments to data processing terms will be announced via a persistent banner notice on dermai.click at least fourteen (14) days prior to taking effect.
Archived Revisions
Prior versions of this document remain on file at our Portland administrative office and can be inspected upon written inquiry.
Contact
For inquiries concerning data security, consent records, or technical batch disclosures, contact our team directly.
Primary Human Point of Contact
Irina Petrova, Product Manager & Batch Oversight Lead.
Electronic Mail
Telephone Dispatch
Physical Facility Address
224 Southwest 1st Avenue, Portland, Oregon 97204, Portland, Oregon, United States.