Privacy Notice

1. Who we are

This Privacy Notice applies to CARPA NYC, operated by Christopher Naipaul, Sole Proprietor, New York, New York (“we”, “us”, “our”). We are the data controller for the personal information described below: we decide how and why it is processed. You can reach us at (646) 868-2028.

2. Personal information we collect

• Booking details: your name, email address, phone number, service address and ZIP code, selected appointment time, and any notes you include with your request.
• Communication records: the content of calls, texts, and emails between you and our team, including the confirmation call after checkout.
• Payment-related records: order confirmations and payment status for your session or program. Card details are collected and processed by our payment provider, not by us.
• Website and device data: IP address, browser type, device identifiers, and pages visited, collected as you use the website.
• Availability-administration data: for team members managing the schedule, sign-in identity and schedule changes.

3. How we use personal information, and why

• To provide the Service — creating and holding your appointment, confirming your time and address by phone, delivering in-home sessions, and processing remaining program visits. Legal basis: performance of a contract (or steps toward it).
• To communicate with you — returning your calls, answering questions, and sending booking-related messages. Legal basis: performance of a contract; for optional follow-ups, your consent.
• To run our business safely — fraud prevention, security, enforcing our terms, and keeping records. Legal basis: our legitimate interests.
• To improve the website and Service — understanding which pages are useful and fixing problems. Legal basis: our legitimate interests.
• To meet legal obligations — tax and accounting records and responses to lawful requests. Legal basis: legal obligation.

4. Who we share information with

• Service providers (subprocessors) — hosting, database, scheduling, and analytics providers that help us operate the website and booking flow, bound by contract to process data only on our instructions.
• Our Merchant of Record, Paddle — Paddle.com sells our sessions as reseller and handles payments, tax compliance, invoicing, and refunds, so it processes the information needed for those purposes.
• Professional advisers — lawyers and accountants, where their advice requires it.
• Authorities — where disclosure is required by law or necessary to protect rights, safety, or property.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

5. International transfers

We are based in the United States, and our providers may process information outside your home country, including in the US. Where personal information of UK or EEA residents is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an applicable adequacy decision.

6. How long we keep information

We keep booking and appointment records while your account or program is active, and afterwards only as long as needed for legal, accounting, or dispute-resolution purposes — typically up to seven years for payment and tax records. Information that is no longer needed is deleted or anonymized.

7. Your rights

Depending on where you live, you have the right to: access the personal information we hold about you; correct inaccurate information; delete information (subject to legal retention duties); restrict or object to certain processing; receive a portable copy of information you gave us; and withdraw consent where processing is based on consent. UK and EEA residents may also complain to their supervisory authority, and we respond to rights requests within one month (or as required by your local law, such as under the California Consumer Privacy Act). To exercise any right, call (646) 868-2028. We will not discriminate against you for exercising your rights.

8. Security

We use appropriate technical and organizational measures to protect personal information, including encryption in transit, access controls, and limiting access to the team members who need it. No method of transmission or storage is perfectly secure, but we work to keep your information safe.

9. Cookies

The website uses a small number of essential cookies and similar browser storage to keep your booking selection and checkout hold working during your visit. We do not currently use advertising cookies. If we add analytics or marketing cookies in the future, we will update this notice and give you a way to manage your preferences before they are used. You can also clear cookies and site data in your browser settings at any time.

10. Children

The Service is intended for adults. We do not knowingly collect personal information from children under 13. Sessions for younger family members are arranged and accompanied by a parent or guardian, whose information we collect instead.

11. Changes to this notice

We may update this Privacy Notice from time to time. The updated version will be posted on this page with a new “Last updated” date.