1. Scope and commitment.

This Privacy Policy describes how personal information is collected, used, shared, and protected in connection with this website and the orders placed through it. It applies to information collected through the website, through checkout and payment processing, through customer service communications, through return and refund requests, and through automated technologies such as cookies and analytics. It does not apply to third-party websites that may be linked from this site; those websites have their own privacy practices, and you should review them separately.

The policy is drafted to address the categories of personal information commonly collected by an ecommerce operation selling personal care products, including information that a customer may voluntarily share about a skin sensitivity or a reaction in the course of a service inquiry. It is drafted to reflect the disclosure requirements associated with the California Consumer Privacy Act as amended by the California Privacy Rights Act, and to provide transparency consistent with the expectation that a business covered by those laws update its privacy policy at least once every twelve months. The policy is not a representation that every law applies to every transaction; the application of a specific law depends on factors including residence, data volume, and the nature of the processing.

2. Categories of personal information collected.

We collect information you provide directly, information collected automatically, and information received from service providers, using the categories defined in applicable privacy law.

Information you provide directly includes: identifiers such as name, email address, shipping address, and phone number if provided; commercial information such as order contents, order history, and return or refund requests; and any information you voluntarily include in a customer service message, product review, or survey. If you choose to share information about a skin sensitivity, an allergic reaction, or a preference related to a product, that information is treated with the additional care described in Section 7. Payment card information is processed by a payment processor; we do not store full payment card numbers on our systems. The processor may provide us with a transaction identifier, the last four digits of a card, the card brand, and an authorization result so that we can confirm payment and handle refunds.

Information collected automatically includes: identifiers such as IP address and cookie identifiers; internet or electronic network activity such as pages viewed, referring URL, and browser type; and approximate geolocation derived from IP address. This information is used for site functionality, analytics, fraud prevention, and, where applicable, advertising measurement.

Information received from service providers includes: fraud screening results from payment and fraud-prevention providers; address verification results from carriers or address-validation services; and analytics or advertising measurement data from providers that support the site’s operation and marketing.

3. Purposes of processing.

Personal information is processed for the following business or commercial purposes: to fulfill orders, including processing payment, arranging shipping, and providing tracking information; to communicate about an order, a return, a refund, or a customer service request; to evaluate a damage or defect claim and arrange a replacement or refund; to evaluate a reported sensitivity or reaction for product safety and batch documentation purposes where a customer voluntarily provides that information; to detect and prevent fraud, unauthorized transactions, and abuse; to maintain and improve the website, including diagnosing technical issues and analyzing aggregate usage patterns; to comply with legal obligations, including tax, accounting, and consumer-protection requirements; to enforce the Terms of Purchase and other policies; and to send marketing communications where you have opted in or where applicable law permits without opt-in and you have not opted out.

We do not use personal information for purposes that are materially different from those described here without providing notice. We do not sell personal information in exchange for monetary consideration. If a future practice would constitute a “sale” or “sharing” under applicable law in a way that requires an opt-out, this policy will be updated and an opt-out mechanism will be provided before that practice begins. Information you voluntarily share about a sensitivity or reaction is used only to resolve the inquiry, to document the batch and the reported reaction for safety purposes, and to improve the product information on the site; it is not used for advertising targeting or for any eligibility determination beyond the transaction itself.

4. Sharing with service providers and third parties.

We share personal information with service providers that perform functions necessary to operate the store. The categories of third parties include payment processors, fraud-screening providers, shipping carriers and fulfillment partners, email and communication providers, analytics providers, and IT infrastructure providers. Service providers are permitted to use the information only to perform the services they are engaged to provide and are expected to maintain appropriate safeguards. A service provider that handles a return, a damage claim, or a reported sensitivity may receive the information necessary to process that matter, including photographs or a description you provide; it is not permitted to use that information for any other purpose.

We may disclose information where required by law, legal process, or a regulatory authority; where necessary to protect the rights, property, or safety of the store, its customers, or others; and in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets, where information may be transferred as part of the transaction subject to appropriate confidentiality protections. A reportable adverse event or a packaging hazard that triggers a reporting obligation to a consumer product safety or health authority will be disclosed to the extent required by applicable law.

We do not share personal information with third parties for their own independent marketing purposes unless you have been given a clear choice and have opted in. Where a third-party advertising or analytics provider collects information through cookies or similar technologies, the provider’s own privacy policy governs its use, and you may have opt-out rights through the provider’s tools or through your browser settings.

5. Cookies and similar technologies.

Cookies are used to keep items in a cart, maintain a logged-in session, remember preferences, measure site performance, and support advertising measurement where applicable. You can control cookies through your browser settings. Blocking certain cookies may affect site functionality, including the ability to complete a purchase. Where required by applicable law, a cookie consent mechanism will be presented before non-essential cookies are set.

Cookies do not collect the contents of a customer service message. Analytics cookies collect aggregate or pseudonymized data about site usage; they do not identify you by name or by the content of a message you send to customer service.

6. Data retention.

Personal information is retained for as long as necessary to fulfill the purposes described in this policy, to comply with legal and accounting obligations, to resolve disputes, and to enforce agreements. Order and transaction records are typically retained for a period consistent with tax and accounting requirements and the period during which a return or refund claim may be made. A customer service message that contains information about a sensitivity or reaction is retained only for as long as necessary to resolve the inquiry, to document the batch and the reported reaction for safety purposes where applicable, and to maintain a record of the resolution, and is then deleted or anonymized in accordance with routine data-management practices. Information that is no longer necessary is deleted or anonymized.

7. Sensitive information and reaction-related disclosures.

Because this store sells personal care products that are applied to the body, a customer service message may include information about a skin sensitivity, an allergic reaction, or a preference related to a product’s formulation. We treat that information as sensitive. It is used only to respond to the inquiry, to document the batch and the reported reaction for safety and quality purposes where applicable, and to maintain a record of the resolution. It is not used for marketing, is not sold, and is not shared with a third party except where necessary to resolve the inquiry or where required by law.

We do not ask you to provide health or sensitivity information as a condition of purchase. If you choose to share it, you do so voluntarily, and you may request deletion of that information after the inquiry is resolved by contacting us through the Contact page, subject to any recordkeeping obligation that requires retention. Do not include medical records, government identification numbers, or another person’s health information in a customer service message; if verification is needed, a secure method will be provided. A reported reaction is not a substitute for medical care; if a reaction is severe or persistent, seek appropriate medical attention.

8. Security.

Reasonable administrative, technical, and physical safeguards are used to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption of data in transit, access controls, and vendor oversight. No method of transmission or storage is completely secure, and no system can guarantee absolute security. If a security incident affects personal information, notification will be provided as required by applicable law.

9. Your rights and choices.

Depending on your residence and applicable law, you may have the right to know what personal information is collected, used, shared, or sold; the right to access a copy of the information; the right to correct inaccurate information; the right to delete information; the right to opt out of sale or sharing; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising these rights.

Requests to exercise these rights are made through the Contact page on this website. We will respond within the timeframe required by applicable law and may need to verify your identity before processing a request. An authorized agent may submit a request where applicable law permits, subject to verification of the agent’s authority. If a request is denied in whole or in part, the reason will be provided, along with information about how to appeal where an appeal process is required. A request to delete sensitive information provided in a customer service message will be honored to the extent consistent with recordkeeping obligations and the resolution of any pending safety or quality matter.

10. Children’s privacy.

The website is not directed to children, and personal information is not knowingly collected from children. The products sold on this website are intended for adults. If it comes to our attention that a child’s information has been collected without appropriate consent, reasonable steps will be taken to delete it. A parent or guardian who believes a child’s information has been provided may contact us through the Contact page.

11. International visitors and cross-border transfers.

The website is operated in connection with a business that may use service providers located in the United States and other jurisdictions. If you access the site from outside the United States, your information may be transferred to, stored in, and processed in the United States or another jurisdiction where the service provider operates. Where applicable law requires safeguards for cross-border transfers, appropriate measures will be used. By using the site and placing an order, you acknowledge that processing may occur in jurisdictions other than your own, subject to the protections described in this policy.

12. Changes and contact.

This policy may be updated to reflect changes in practices, technology, or legal requirements. The policy is reviewed and updated at least once every twelve months, consistent with the update expectation under applicable California privacy law. The updated version will be posted on this page, and material changes will be communicated through a notice on the site or through the contact method associated with your account where appropriate. Continued use of the site after an update constitutes acceptance of the updated policy to the extent permitted by law. Privacy questions, rights requests, and concerns about data handling are directed to the Contact page on this website.