Privacy policy

Privacy policy — updated 6 November 2026 Love and Light operates this store. For privacy questions or requests, contact [email protected]. Information we use We use the contact, account, delivery, order and support details you provide to operate your account, arrange purchases and delivery, answer requests and prevent misuse. Payment card details are entered on Stripe’s hosted payment pages; our application receives payment references and status information rather than full card numbers. Stripe’s own privacy policy is available at https://stripe.com/privacy. Visits and privacy choices This store records page visits and shopping events to understand how it is used. A random first-party identifier can connect visits from the same browser and, after sign-in, subscription or a verified purchase, link them to your customer account. Journey records contain safe page paths, event times, referring hosts, campaign attribution and a coarse device category; they do not include form values, search text, chat text, full referring URLs or payment card details. Visit tracking starts when the store’s scripts run. Use “Privacy choices” in the footer and select “Don’t track my visits” to stop identifiable journey tracking. Dismissing the notice does not turn tracking off. Supported browser privacy signals also narrow tracking. Opted-out visits may contribute anonymous daily statistics. Blocking cookies or scripts may affect these features. Essential cookies support sign-in, security and your shopping bag. The visitor cookie is renewed for up to thirteen calendar months, and journey events are retained for thirteen calendar months, subject to deletion requests and security or legal requirements. Service providers and the assistant DigitalOcean hosts the application and database, Cloudflare provides delivery, security and private object storage, Postmark handles transactional email, and Stripe processes payments. Information needed for delivery may be shared with the selected supplier or carrier. When you use the shopping assistant, your messages may be processed by AI providers through OpenRouter to answer your request. Do not send card details or other sensitive information in chat. Providers may process information in countries outside your own; our current application and database region is Singapore. Security and retention Access is limited by staff permissions. Sensitive personal fields, database storage and recovery copies use encryption. Authorized administrators can access information needed to operate and support the service. We retain account, transaction and support records as needed for the service, security, disputes and applicable record-keeping duties. Closing an account or deleting analytics does not automatically remove transaction records with a separate retention duty. Protected backups may retain earlier copies until their retention periods expire. Your requests You can ask us for access, correction, deletion or an available export of your information, and raise concerns about its use. Available rights depend on the law that applies to you. We may verify your identity before acting. You may also contact your local data protection authority. This policy may change; the date above identifies the current version.