Effective November 12, 2026

Privacy Policy

This policy explains how Solenne Atelier handles personal information collected through https://drmalot.com/. It describes the inquiry form, the session cookie that protects that form, and how long a saved inquiry is kept.

Introduction

Solenne Atelier uses this website to describe makeup services and to receive inquiries. The only personal information the site asks you to type is what you put in the contact form. Reading the other pages does not create an account and does not ask for your name.

Who we are

The site is operated by Solenne Atelier, a makeup studio in West Des Moines, Iowa. The business address is 2037 Grand Ave, West Des Moines, IA 50265, United States. Include the venue in your request. Send a privacy request through the contact form and choose “Privacy request.” Include the reference code and the same email address used on the inquiry.

Scope of this privacy policy

This policy covers https://drmalot.com/ and the inquiry form on that site. It does not control a social network, a payment page, or another business that happens to use a similar name. The site does not claim that every privacy statute in every state applies to a studio of this size. If a specific law applies to your request, the studio honors the rights that law requires.

Information we collect

The site collects two kinds of information: what you choose to type into the form, and a small amount of technical data needed to store that form safely and to limit repeated submissions.

Information you provide voluntarily

If you submit the form, the studio stores:

• Full name, so the studio knows who the request is from.
• Email address, so the studio can reply and so a later privacy request can be matched to the same person.
• Phone number, only if you choose to add one.
• Service, chosen from a fixed list that includes bridal, prom, event, photoshoot, natural, soft glam, lessons, “not sure,” and privacy request.
• Preferred date, only if you choose to add one.
• Your message, so the studio can understand the venue, the people, and the finish.
• A record that you checked the box agreeing to this storage.

Name, email, service, message, and the consent box are required. The form does not save a message when those checks fail. Phone and date are optional. Do not send payment card numbers, government ID numbers, or medical records. The form does not ask for them.

Automatically collected technical information

With a saved inquiry, the server also stores the time it was saved, a reference code that starts with MS-, a short note of whether an email notice was sent, a hashed version of the IP address, and the browser’s user-agent string trimmed to a short length. The readable IP address is not kept. The hash is used to limit repeated form posts, not to build an advertising profile.

A hidden field is there to catch automated spam. If that field is filled, the submission is rejected and is not stored as an inquiry.

The site does not use analytics cookies, advertising cookies, pixels, or a tag manager. Page scripts do not write tracking values into local storage or session storage.

How we use personal information

Inquiries are used to read and answer questions about makeup, to show you that a message was saved, and to recognize a follow-up when you quote the reference code. A privacy request is used to find, correct, export, or delete one inquiry. The IP hash and the user-agent string are used to limit abuse of the form. They are not used to sell advertising about you.

The studio does not sell personal information and does not use the form to enroll you in a newsletter. Asking about bridal makeup is not consent to marketing.

How inquiries are processed

You submit the form from the contact page. The browser checks the required fields, and the server checks them again. If the message is accepted, it is saved and the same page shows a reference code. That reference means the row was saved. It does not mean an appointment is confirmed and it does not charge a card.

If mail delivery is configured on the server, the studio is notified at its own address. The email address you typed is included in the body of that notice, not in the hidden mail headers. If mail is not configured, the inquiry is still saved for the studio to read. The site does not promise that a notice leaves the server.

Legal requirements and applicable rights

Iowa’s consumer privacy statute applies to businesses that meet published size thresholds, including the number of consumers whose data they process and, in one path, revenue from selling data. A studio that only stores inquiry forms should not assume those thresholds are met, and this policy does not claim that they are. The site does not sell personal information.

Whatever the threshold, you may ask for the inquiry tied to your email and reference code, ask for a correction of what you sent, or ask for that row to be deleted. If another U.S. privacy law applies to your particular request, the studio honors the rights that law requires. This page is not a statement that every federal or state privacy rule has been reviewed for every visitor.

Cookies and similar technologies

Public pages other than the contact page do not set a cookie by themselves. Opening the contact page starts one first-party session cookie named ms_session. It holds a security token so another site cannot submit the form for you, and it can carry an error or success message back without putting your message in the web address. The cookie is HTTP-only and uses SameSite=Lax. The Secure flag is added when the server recognizes the connection as HTTPS.

The browser is asked to drop the cookie when the browsing session ends. The server treats idle session data as expired after two hours. Removal of the session file on disk happens when the server’s session cleanup runs, which may be later than that two-hour mark. A fuller description is on the cookie policy.

When information is shared

The studio does not sell or rent the inquiry list. Information is available to the person who operates the studio and to the people who administer the server that hosts the site. If email delivery is turned on, the email provider that sends the notice can receive the contents of that notice. The studio does not give the database to advertisers.

Hosting and service providers

The website and the inquiry database are stored with the hosting provider that serves drmalot.com. That provider can technically access files on the server. When email notification is configured, the mail provider used for that notification processes the message. Those providers act so the site and the notice can function. The site does not use an outside analytics or advertising vendor.

Data storage and retention

Saved inquiries are kept in a database file outside the public website folder. There is no public page that lists them. The studio’s retention period for an inquiry is up to 24 months from the day it is saved. A maintenance script deletes older rows when that script is run. Installing the daily schedule is a step on the host. Until that schedule is running, an older row remains until the studio deletes it or you ask for deletion.

Short counters that limit repeated form posts last about ten minutes for attempts and about one hour for saved inquiries. They are not a browsing profile. A copy that was emailed may remain in the studio mailbox after the database row is deleted. Say so in a privacy request if you need that copy removed as well. The website cannot reach into a mailbox by itself.

Security

The form is checked in the browser and again on the server. Messages are length-limited. The database query that saves an inquiry uses parameters. Error text shown on the page is escaped. A per-session token is required. Submissions are rate-limited. Personal data is not placed in the page address. Visitors do not see PHP error details.

These steps reduce ordinary risk. They are not a promise that information can never be exposed. Do not send secrets you would not want a studio inbox to hold.

How to access, correct, or delete data

Use the contact form, choose “Privacy request,” and include the reference code and the same email address used on the original inquiry. Say whether you want a copy, a correction, or deletion.

The studio matches that reference and that email in an administrative tool. The tool returns a row only when both match. A reference code alone is not enough to pull someone else’s inquiry. Export files are written outside the public website folder. Deleting the database row does not delete an email copy.

Privacy requests and identity verification

The check is the reference code plus the email address stored on that inquiry. The comparison of the email is not case-sensitive. If either value does not match, the tool reports that no inquiry was found and does not show the row.

Children’s privacy

The site is not directed at children under 13, and the form does not ask for a date of birth. A parent or guardian sometimes writes about prom makeup or a lesson for a teenager. If you believe a child under 13 submitted a form, send a privacy request and the studio should delete that inquiry.

External links

A link to another website is not an endorsement, and this policy does not cover that site. The pages of this website do not embed outside video, advertising pixels, or remote fonts.

Changes to this policy

If the form, the cookie, the retention period, or the mail setup changes in a way that matters, this page will be updated and the date at the top will change. An inquiry already saved stays under the description that was accurate when it was stored, except where a newer law requires something else.

Contact information

Solenne Atelier. The business address is 2037 Grand Ave, West Des Moines, IA 50265, United States. Include the venue in your request. Send a privacy request through the contact form and choose “Privacy request.” Include the reference code and the same email address used on the inquiry. For a question about a request you already sent, include the reference code.