Cookie & Tracking Technologies Policy
Effective October 1, 2026 · Last updated September 30, 2026
This Policy explains how Enzo Custom Florida Inc. and its commonly controlled Enzo Group affiliates use cookies and similar technologies on websites, appointment and order interfaces, customer portals and applications, and digital communications that link to it. It should be read with our Privacy Policy and California Privacy Notice.
At a glance
Strictly necessary technologies keep the site secure and working. They cannot be turned off through our preference center.
You may Accept All, Reject Nonessential, or Manage Preferences by category through our cookie banner and preference center.
You may change a nonessential choice at any time through Your Privacy Choices. Withdrawing consent is designed to be as easy as giving it.
Some advertising and analytics technologies may involve a "sale," "sharing," or targeted advertising under state privacy laws. Your Privacy Choices and qualifying universal opt-out signals, including Global Privacy Control, apply to those practices.
Browser controls and industry opt-out tools are supplemental. They do not replace our preference center or privacy-rights process.
1 Scope
This Policy applies to technologies used on Enzo websites (including enzocustom.com and sanpari.com), appointment and order interfaces, customer accounts, portals and applications, embedded media, and marketing emails that link to or are described in this Policy. It does not control technologies placed on a third party’s separate service after you leave an Enzo Service; that party’s notice governs its independent practices.
2 What cookies and similar technologies are
Cookies are small text files stored on a browser or device. Other technologies can perform similar functions:
Pixels and web beacons are small code elements that can report when a page, ad, or email is viewed or acted upon.
Tags and scripts collect interaction or conversion information and may load another provider's technology.
Local storage keeps information in a browser beyond a single page request.
Device and advertising identifiers help recognize a browser or device for analytics, preferences, or advertising.
Server logs record requests made to a website, including IP address, time, browser, requested page, and security events.
Session-interaction technologies can produce heatmaps or recordings of page interactions. They are disabled under our current program.
Call and form attribution technologies associate a call or inquiry with the page, campaign, search, or advertisement that preceded it. A tracking number does not itself mean a call is recorded. If recording, transcription, or AI summarization is enabled, we provide clear advance notice and obtain affirmative consent before it begins.
Email pixels and tracked links can indicate whether an email was opened or a link was selected.
Server-side conversion tools can transmit transaction or campaign events outside the browser. Customer-list uploads, enhanced conversions using customer data, matched-audience uploads, and automatic or manual hashed contact matching remain disabled across providers, including Google, Meta, and OpenAI. Any proposed change requires separate privacy, contract, data-field, and configuration review before activation; hashing does not make contact information anonymous. Browser and server-side controls must enforce the applicable opt-in, withdrawal, and opt-out choices.
Cookies may be first party, meaning set by Enzo Custom's domain, or third party, meaning set or accessed by another provider. A session cookie ordinarily expires when the browser session ends. A persistent cookie remains until its stated expiration, you delete it, or it is replaced. The preference center identifies active technologies, providers, purposes, and available duration information.
3 Categories of technologies we use
| Category | What it does | Typical information | Choice |
|---|---|---|---|
| Strictly necessary | Delivers requested pages and forms; maintains load balancing, security, fraud prevention, consent status, and session continuity; supports checkout and appointment functions | Session identifier, security token, consent status, IP address, device and browser data, request logs | Always active because the requested Services may not work without it |
| Functional and personalization | Remembers showroom, display, language, form, chat, or service preferences and enables optional site features | Preference identifiers, selected showroom, feature settings, limited interaction data | Manage through the preference center; disabling may reduce optional functionality |
| Analytics and performance | Measures visits, traffic sources, navigation, errors, campaign performance, and site usability | Cookie or device identifier, IP address, pages, clicks, timestamps, referrer, campaign parameters, browser, approximate region | Reject or withdraw through the preference center; state-law opt-outs may also apply |
| Session replay and experience recording | Produces heatmaps or selected masked interaction recordings to diagnose broken pages, accessibility barriers, and usability problems | Page and pointer events, masked text-field state, browser/device details, timestamps, and technical errors; excluded sensitive pages and fields are not intended to be captured | Disabled under the current program; any future activation requires separate approval, notice, and affirmative opt-in |
| Advertising and social media | Measures ad conversions, creates or suppresses audiences, limits repetition, supports interest-based advertising, and connects to social platforms | Cookie and advertising identifiers, IP address, page and product interactions, campaign data, limited conversion events, and inferences about interests | Reject or withdraw through the preference center; opt out of sale, sharing, and targeted advertising through Your Privacy Choices or a recognized universal opt-out signal |
We do not use measurements, fit notes, functional accommodation information, private feedback, service photographs, full payment-card data, or SMS consent records for cross-context behavioral advertising or targeted advertising.
4 Current technology and provider inventory
The preference center identifies enabled website technologies and their controls. The inventory below also identifies integrations or capabilities subject to disabled-by-default restrictions. It is not authorization to activate them. We review the deployed technology scan and actual data flows before activation and after material changes; a scan alone does not identify every server-side disclosure. For enabled technologies, the preference center supplies the provider, purpose, category, available duration information, and applicable control.
| Provider or integration | Primary role | Information that may be involved | Category and control |
|---|---|---|---|
| Google Analytics, Google Ads, Google Tag Manager, and Google call or conversion measurement | Site analytics, tag delivery, conversion attribution, audience measurement, and advertising | Online identifiers, IP address, device/browser details, page and campaign interactions, conversion events, and approximate region | Analytics and/or advertising; manage in the preference center and Your Privacy Choices |
| Meta Pixel | Advertising measurement, audience creation or suppression, and retargeting | Online identifiers, IP address, page interactions, campaign and limited conversion events | Advertising; manage in the preference center and Your Privacy Choices |
| OpenAI / ChatGPT Ads pixel and conversion measurement (planned) | Planned advertising attribution and conversion measurement; disabled pending review and testing | No data sent while disabled. Any approved event fields must be disclosed before activation; automatic and manual hashed contact matching stay off | Advertising; prior opt-in required before loading or initialization. Default denied. Enforce withdrawal and GPC in browser and server flows. No contact matching |
| TikTok Pixel | Advertising measurement, audience creation or suppression, and retargeting | Online identifiers, IP address, page interactions, campaign and limited conversion events | Advertising; manage in the preference center and Your Privacy Choices |
| Microsoft Advertising | Search-ad measurement and attribution | Online identifiers, IP address, device/browser details, page interactions, and campaign events, subject to consent and minimization | Advertising; affirmative opt-in and Your Privacy Choices |
| Microsoft Clarity | Session replay and heatmaps | No new collection while disabled | Disabled under the current program; ordinary analytics consent does not activate it |
| Pinterest Tag | Advertising measurement, audience creation or suppression, and retargeting | Online identifiers, IP address, page interactions, campaign and limited conversion events | Advertising; manage in the preference center and Your Privacy Choices |
| LinkedIn Insight Tag | Business-audience measurement, campaign analytics, and retargeting | Online identifiers, IP address, page interactions, campaign and limited conversion events | Advertising; manage in the preference center and Your Privacy Choices |
| X (formerly Twitter) advertising tag | Advertising measurement, audience creation or suppression, and retargeting | Online identifiers, IP address, page interactions, campaign and limited conversion events | Advertising; manage in the preference center and Your Privacy Choices |
| AdRoll/NextRoll | Retargeting, campaign measurement, and audience services | Cookie and advertising identifiers, IP address, pages, campaign interactions, and inferred interests | Advertising; manage in the preference center and Your Privacy Choices |
| The Trade Desk | Programmatic advertising, campaign measurement, and attribution | Cookie and advertising identifiers, IP address, campaign interactions, limited conversion events, and inferred interests | Advertising; manage in the preference center and Your Privacy Choices |
| Matomo Cloud | Website analytics and performance measurement | Online identifiers, IP address, pages, clicks, referrer, device/browser details, and approximate region | Analytics; manage in the preference center |
| ActiveCampaign and Prism | CRM, marketing automation, email engagement, form or website interaction analytics, and personalization | Contact or campaign identifier, pages and forms, email opens or clicks, referrer, and timestamps | Functional, analytics, and/or advertising depending on use; manage in the preference center and unsubscribe from marketing email |
| Attentive | Email or SMS subscription, preference management, campaign attribution, and marketing engagement | Contact information you submit, consent and opt-out status, online identifiers, pages, forms, campaign interactions, and limited conversion events | Functional and/or advertising; manage in the preference center, unsubscribe from email, or revoke SMS consent as described in the SMS Terms |
| CallRail | Dynamic phone-number insertion, call and form attribution, campaign reporting, and call recording, transcription, or AI summaries only when enabled after clear notice and affirmative consent | Online identifiers, IP address, page and campaign data, referring source, call metadata, contact-form activity, and call audio, transcript, or summary only if the feature is enabled and consented to | Functional and analytics; manage nonessential aspects in the preference center |
| Mixpanel | Product or interaction analytics, including analytics identifiers transmitted through enabled integrations | Online identifiers, device/browser details, page or feature interactions, referrer, and timestamps | Analytics; manage in the preference center |
| Gift Up | Gift-card purchase, delivery, balance, redemption, and related support | Purchaser and recipient details, message, gift-card and transaction identifiers, value, delivery status, balance, redemption, and limited device or transaction data | Strictly necessary or functional when the gift-card feature is used; transaction notice and provider terms also apply |
Providers may act as our service provider or contractor for one function and as an independent third party for another. Their processing is also governed by their own notices where they act independently. We review the inventory and update this Policy or the preference center when an integration materially changes.
Strictly necessary and functional technologies—including hosting, security, forms, appointment booking, payment, gift-card, consent-management, and customer-support integrations—appear in the live preference center or at the relevant transaction when active. A provider may appear only on pages where its feature is used.
If we offer a live-chat or helpdesk widget, we identify the provider and explain the data, purposes, storage, access, and retention before you start. After you select Start Chat, Enzo Custom and that provider may receive, transmit, store, and review submitted messages, contact details, and related device, browser, page, timestamp, and session information to respond, provide support, secure the service, and maintain support records. Chat content and keystrokes are not captured before that affirmative start. Routine support records generally expire three years after the last direct service contact; limited, justified dispute records follow the Privacy Policy. Chat content is excluded from replay and advertising or analytics payloads. Do not submit payment-card numbers, passwords, government identifiers, diagnoses, or unrelated health information through chat.
We do not collect, use, or sell personal information for the purpose of training large language models. We do not authorize providers to use personal information we supply to train large language models. Customer fitting photos, identifiable measurements, private client communications, and health or accommodation information are not used to train, fine-tune, or evaluate any AI model. Customer fitting-photo AI processing remains disabled.
5 Purposes for using these technologies
We use these technologies to:
1. deliver requested pages, forms, appointment tools, account functions, checkout, and customer-service features;
2. authenticate sessions, balance traffic, detect abuse, protect forms, prevent fraud, and maintain security;
3. remember consent, privacy choices, showroom selections, and optional preferences;
4. understand traffic, errors, navigation, page performance, and feature use;
5. diagnose technical and accessibility issues and improve usability;
6. measure marketing, calls, forms, appointments, and orders attributed to a campaign;
7. deliver, measure, or limit repetition of interest-based advertising where allowed;
8. create, match, suppress, or measure advertising audiences where contracts and applicable choices permit;
9. understand email delivery, opens, and clicks and honor unsubscribe choices; and
10. maintain evidence of consent, opt-outs, and universal opt-out signals.
6 Session interaction and heatmap tools
Session replay and heatmap tools are disabled across our websites, applications, booking, account, payment, and support workflows. We do not collect new session recordings or heatmaps under the current program. Any future activation requires a separate review, an updated notice, a distinct affirmative opt-in before any recording or transmission, sensitive-workflow exclusions, and tested retention and deletion controls. Enabling ordinary analytics does not enable session replay.
Any historical raw session recordings are deleted within their original schedule, generally no more than 30 days. Only material relevant to a documented legal requirement or active dispute may be preserved under restricted access, with periodic review; it is deleted when the basis ends. Historical aggregated analytics may follow the applicable analytics schedule. No new recording or heatmap collection is permitted under the current program.
7 Your controls
Cookie banner and preference center
On your first visit, the cookie banner provides equally accessible choices to Accept All, Reject Nonessential, or Manage Preferences. Under our nationwide policy, nonessential technologies are denied by default: their scripts, pixels, and SDKs must not load or initialize, and no related transmission, including a cookieless ping, begins before the relevant affirmative opt-in. Server-side endpoints apply the same consent, withdrawal, and Global Privacy Control restrictions; a browser setting alone is insufficient. You can revisit the controls through Your Privacy Choices. Rejecting nonessential technologies leaves them off. Strictly necessary technologies remain available.
By selecting Accept All or affirmatively enabling a nonessential category, you direct and consent to Enzo Custom and the providers identified for that category collecting, accessing, using, storing, and disclosing the information described for the stated purposes after your choice. You may withdraw that choice at any time through Cookie Preferences. Session Replay / Experience Recording is disabled and cannot be enabled through Accept All or an ordinary analytics choice under the current program. Consent must be obtained before the applicable nonessential transmission or recording begins.
Your choice generally applies to the browser and device where you make it. If you clear storage, use private browsing, switch browsers or devices, or if our consent technology materially changes, you may need to choose again.
Sale sharing and targeted advertising opt out
Some advertising and analytics disclosures may be considered a sale, sharing, or targeted advertising under state law. Use Your Privacy Choices to opt out. The control applies to browser-side and server-side advertising or audience disclosures associated with the identifier, account, or contact information that we can reasonably link to the request, as required by law.
An opt-out does not stop necessary disclosures to service providers that process information on our behalf under legally required restrictions. It also does not mean you will see no advertising; you may continue to see contextual advertising.
Universal opt out signals
We process qualifying Global Privacy Control and other legally recognized universal opt-out signals. A signal applies to the browser or device that sends it and to any related profile we can reasonably associate as required by law. We do not require identity verification to honor the signal. Our preference interface indicates Opt-Out Preference Signal Honored when a qualifying signal is recognized. We honor supported signals nationwide, do not create a special popup, charge a fee, or degrade the experience because of the signal, and do not treat a later absence of the signal as consent to opt back in.
Browser and device settings
Most browsers let you view, block, or delete cookies. Blocking all cookies may interfere with appointments, forms, checkout, saved preferences, or security. Browser controls affect that browser and may not prevent server-side processing or disclosures, so use Your Privacy Choices as well.
Legacy browser "Do Not Track" settings do not have a uniform industry standard, and we do not treat them as privacy requests. We honor qualifying universal opt-out signals such as Global Privacy Control nationwide as described above.
Email choices
Use the unsubscribe link in a marketing email to stop future marketing email. You may also disable automatic image loading in your email client, although that may not block tracked links. Transactional or service email may continue when needed for an appointment, order, security matter, privacy request, or customer-service issue.
Industry tools
The Digital Advertising Alliance's consumer tools at optout.aboutads.info and the Network Advertising Initiative's tools at optout.networkadvertising.org may provide additional advertising choices for participating companies. These tools are supplemental and may rely on cookies, so clearing cookies can reset them. They do not replace Your Privacy Choices or a state-law request.
8 Retention
Session cookies ordinarily expire when the browser session ends. Persistent-cookie duration varies by purpose and provider and is shown in the preference center when available. We configure durations to be proportionate to the purpose and periodically review them.
Consent and preference records follow the Privacy Policy schedule, including minimal suppression records needed to honor a continuing choice. No new session replay or heatmaps are collected. Historical raw recordings are generally retained no more than 30 days; security logs and other analytics generally up to 24 months; historical aggregated heatmaps and derived interaction analytics up to 24 months. Advertising-platform retention depends on the disclosed purpose, configured settings, and applicable legal obligations. Longer preservation requires a documented legal requirement or specific active dispute, restricted access, and periodic review; it ends when the basis ends. Deidentified or aggregated information may be retained only when it cannot reasonably identify a person.
9 Children and teens
Our Services are not directed to children under 13. We do not knowingly use personal information of anyone under 18 for sale, sharing, or targeted advertising. If you believe a minor's information has been collected contrary to this Policy, contact us at [email protected].
10 Changes to this Policy
We may update this Policy as technologies, providers, laws, or our practices change. We will post the revised version with a new Last updated date and provide additional notice or obtain consent when required. The preference center may be updated more frequently to reflect the technologies currently deployed.
11 Contact us
Privacy Office Enzo Custom Florida Inc. d/b/a Enzo Custom 501 E Las Olas Blvd., Suite 300 Fort Lauderdale, FL 33301 [email protected] 888-622-3696 Privacy Request Form Your Privacy Choices