Payment Security Policy
Effective Date: October 23, 2026
How You Pay
All card payments at our Irvine, Tustin, Santa Ana, Costa Mesa, and Newport Beach studios are taken in person at the front counter on Clover payment devices. You insert, tap, or swipe your own card or mobile wallet, and the device sends the payment directly to our payment processor.
We follow the Payment Card Industry Data Security Standard (PCI DSS) and keep a written information security policy that every team member who handles checkout is trained on.
We Do Not Store Card Numbers
- We never write down, photograph, copy, or save your card number, expiration date, security code, or PIN.
- We do not take card numbers by phone, text, email, or social media. We will never ask you to send card details that way.
- Receipts and reports show only the last four digits of your card.
- Our website and AI chat never ask for card numbers. Any online payment step runs on our payment provider's secure checkout, not on our servers.
How We Protect Payments
- Payment devices stay at the front counter in staff view and are checked for tampering every day.
- Devices connect over a password-protected business network that is separate from guest Wi-Fi.
- Each team member has their own login, and access is removed when they leave.
- Repairs and replacement devices come only through our payment processor.
- We review this policy at least once a year and whenever our payment setup changes.
If Something Looks Wrong
If a payment device looks damaged or altered, or you receive a message claiming to be from us that asks for card details, do not use it or reply. Tell a team member or contact us right away.
If we suspect a payment security problem, we take the affected device out of service, report it to our payment processor the same day, and follow its instructions, including any required notices.
Related Policies
How we handle other personal information is described in our Privacy Policy. Refunds are covered by our Refund Policy.