Privacy Policy

Last updated: September 10, 2026

This website is operated by Lorelia ("we", "us"). This Privacy Policy describes how we collect, use, and disclose your personal information when you visit this website, place an order, or otherwise communicate with us (the "Services"). If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read this Privacy Policy and understand how your information is collected, used, and disclosed as described here.

Personal information we collect

"Personal information" means information that identifies or can reasonably be linked to you. It does not include information collected anonymously or de-identified so that it cannot reasonably be linked to you. Depending on how you interact with the Services, we may collect:

• Contact details including your name, email address, phone number, and shipping and billing address.
• Payment information including the last four digits of your card, card brand, and payment confirmation. Full card numbers are entered directly with Stripe and never reach our servers.
• Transaction information including the items you buy, order totals, order numbers, refunds, and your order history with us.
• Communications with us including the content of messages you send through our contact form or by email.
• Device and usage information including your IP address, browser and device type, referring page, the pages you view, and how you navigate the Services.

We do not offer customer accounts, so we do not collect usernames, passwords, or account settings.

Where personal information comes from

• Directly from you when you place an order, complete checkout, use the contact form, or email us.
• Automatically through the Services from your device and browser when you visit, including through cookies and similar technologies.
• From our service providers such as Stripe, which passes us the details of your completed order, and Google Analytics, which reports how the site is used.

How we use your personal information

• Providing the Services. To process your payment, fulfil and ship your order, send order confirmations and shipping updates, handle returns and refunds, and answer your questions.
• Improving the Services. To understand which pages and features work, fix problems, and make the site better. We use aggregated analytics for this.
• Security and fraud prevention. To provide a secure checkout, and to detect, investigate, and prevent fraudulent, illegal, or malicious activity.
• Communicating with you. To respond to support requests and keep you informed about your order.
• Legal reasons. To comply with applicable law, respond to valid legal process, enforce our terms and policies, and protect our rights and the rights of others.

We do not use your personal information for marketing or advertising. We only email you about your order or in reply to a message you sent us, unless you have asked us for something else.

How we disclose personal information

We share personal information only with service providers who process it on our behalf to run the Services, and only as needed for that purpose:

• Stripe processes payments, and collects your card and address details at checkout.
• Vercel hosts this website.
• Supabase stores our order records.
• Resend delivers our order confirmation and contact emails.
• Google Analytics provides site usage analytics.
• Our shipping carrier receives your name, address, and phone number to deliver your order.

These providers process your data under their own privacy notices and contractual obligations to us. We may also disclose personal information when you direct us to, in connection with a business transaction such as a merger or sale, and where required to comply with legal obligations, enforce our terms, or protect the Services and the rights of our users or others.

We do not sell your personal information, and we do not share it with advertising networks or use it for targeted advertising. We do not use Meta, TikTok, or similar advertising pixels on this site.

Payments and Stripe

Checkout is handled by Stripe. When you pay, your card details, and the billing and shipping information you enter, are transmitted directly to Stripe, which processes them under the Stripe Privacy Policy at https://stripe.com/privacy. Stripe may use your information to detect fraud and, where you choose it, to offer payment methods such as Link that store your details for future purchases. We receive confirmation of the payment and the order details we need to ship to you.

Cookies and analytics

The Services use only the cookies needed to run checkout and to measure how the site is used. We use Google Analytics to understand traffic and page usage, including when a visitor begins checkout. Google may set cookies or use similar identifiers to do this. You can learn how Google uses this data at https://policies.google.com/technologies/partner-sites and opt out with the Google Analytics browser add-on at https://tools.google.com/dlpage/gaoptout. Blocking analytics cookies in your browser will not affect your ability to shop with us.

Third-party websites and links

The Services may link to websites operated by third parties, such as our social media pages. We are not responsible for the privacy or security practices of those sites, and their inclusion does not imply endorsement. Please review their policies before providing information.

Children's data

The Services are not intended for children, and we do not knowingly collect personal information from anyone under the age of majority in their jurisdiction. If you are a parent or guardian of a child who has provided us with personal information, contact us using the details below and we will delete it.

Security and retention

We use industry-standard safeguards to protect your information, including encrypted connections and access controls, but no security measure is perfect and we cannot guarantee absolute security. Please do not send sensitive information over unsecured channels.

We keep order records for as long as needed to fulfil your order, handle returns and refunds, resolve disputes, and meet our legal and accounting obligations. Contact form messages are kept for as long as needed to respond to you. Analytics data is retained according to the Google Analytics settings we control.

Your rights and choices

Depending on where you live, you may have some or all of the following rights. They are not absolute, may apply only in certain circumstances, and we may decline a request where the law permits.

• Access. Request access to the personal information we hold about you.
• Deletion. Request that we delete your personal information.
• Correction. Request that we correct inaccurate personal information.
• Portability. Receive a copy of your personal information in a portable format.
• Opt out of sale or sharing. We do not sell or share personal information for targeted advertising, so there is nothing to opt out of. We honour the Global Privacy Control signal where the law requires it and do not respond to other "Do Not Track" signals.
• Communication preferences. We do not send promotional email. Order-related emails are necessary to provide the Services and cannot be turned off.

To exercise any of these rights, email hello@lorelia.co. We may need to verify your identity before acting on a request, and you may designate an authorised agent to act on your behalf where the law allows. We will respond within 30 days, or sooner where applicable law requires. We will not discriminate against you for exercising your rights.

Complaints

If you have a complaint about how we handle your personal information, contact us first at the details below. Depending on where you live, you may also have the right to appeal our decision or lodge a complaint with your local data protection authority. UK residents may contact the Information Commissioner's Office at ico.org.uk.

International transfers

We and our service providers may store and process your personal information in countries other than the one you live in, including the United States. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses or the UK equivalent, unless the destination has been found to provide an adequate level of protection.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons. We will post the revised policy on this page and update the "Last updated" date.

Contact

Questions about this Privacy Policy or our privacy practices, or requests to exercise your rights, can be sent by email to hello@lorelia.co.