Privacy policy
What we collect, why, and how to get it deleted.
Last updated: 25 August 2026
Who we are
Lunelle is an online shop selling one product: a heatless curling kit. The trader behind it, with its registered name, number and postal address, is identified on the legal notice — that page is the single place we keep those details, so they can never fall out of sync across the site.
For anything about your data, write to lunelle.shop.support@gmail.com. A person reads it and answers within two business days, and always inside the 30 days the law allows.
What we collect
- Order data: name, email, delivery address, phone, order contents. Needed to fulfil the contract.
- Payment data: handled by the payment provider. We never see or store full card numbers.
- Usage data: pages viewed, device and approximate location, via the analytics and advertising tools listed in the cookie policy.
- Anything you send us: emails, form messages, review text.
Why we're allowed to
Order data: performance of a contract. Marketing email: your consent, withdrawable in one click from any email. Analytics and advertising cookies: your consent through the cookie banner. Fraud prevention and accounting records: legal obligation and legitimate interest.
Who we share it with
Only the companies we need to actually run a shop. Each one handles your data under contract, only on our instructions, and none of them may use it for their own purposes. We never sell personal data, and we never pass your address to anyone who is not shipping you something.
| Who | What they get | Why |
|---|---|---|
| Shopify | Order, contact and browsing data | Runs the shop and the checkout |
| Shopify Payments / Stripe | Payment details, billing name and address | Takes the payment. We never see your full card number |
| PayPal | Name, email, amount | Only if you choose PayPal at checkout |
| Our fulfilment partner | Name, delivery address, phone, order contents | Packs the parcel and hands it to the carrier |
| The carrier | Name, delivery address, phone | Delivers it and lets you track it |
| Meta, Google, TikTok | Ad interaction and purchase events, matched with a hashed email | Measures which ad worked. Only with your advertising consent |
| Our email tool | Name and email | Order confirmations, and newsletters if you asked for them |
| Accountant and tax authorities | Invoice records | Because the law requires it |
If the business is ever sold, your data goes with it and you will be told before anything changes.
How long we keep it
| Data | Kept for |
|---|---|
| Orders and invoices | 7 years — the longest tax-record period that applies to us |
| Customer service emails | 3 years after the conversation ends |
| Newsletter contacts | Until you unsubscribe, then 30 days to honour the opt-out |
| Analytics and advertising | 14 months, then aggregated beyond recognition |
| Abandoned carts | 30 days |
Your rights
Access, correction, deletion, portability, objection, and withdrawal of consent. Email lunelle.shop.support@gmail.com and we respond within 30 days. If you are in the United States and you're not satisfied with how we handled your request, please tell us first — you may also contact the U.S. Federal Trade Commission at reportfraud.ftc.gov or the Attorney General of your state. This is also our designated request address for Nevada residents who wish to opt out of the sale of covered information.
International transfers
Your order is handled across several countries: the shop runs on servers in the United States and Europe, we operate from Spain, and the parcels are packed and dispatched in China. Your shipping details therefore leave the United States and are processed in China. We require our partners by contract to use your information only to fulfill your order and to protect it appropriately. We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not sell sensitive personal information, as those terms are used in U.S. state privacy laws.
U.S. privacy notice
What we collect: your name, email address, shipping address, phone number (optional), order history, and technical data such as IP address, device type, browser type and pages viewed.
Who we share it with: Shopify, our payment processor, and our manufacturing and shipping partner in China.
Do Not Track: we do not currently respond to "Do Not Track" browser signals.
Third parties: third-party services embedded in this site may collect information about your browsing activity over time and across other websites.
Reviewing and changing your information: email lunelle.shop.support@gmail.com and we will confirm, correct or delete what we hold.
Changes to this policy: we post any changes on this page and update the date above.
Where that transfer leaves the European Economic Area, it is covered by the European Commission's standard contractual clauses, which every processor above has signed. For Australian customers, Australian Privacy Principle 8 applies: we remain accountable for your data after it leaves the country, and we take reasonable steps to make sure whoever receives it protects it to the same standard. If you would rather not have your data leave Australia, we cannot fulfil an order — the parcel physically ships from overseas.
Security
The site is served over HTTPS, payments run through PCI-DSS certified providers, and admin access uses two-factor authentication. No system is perfect: if a breach ever affects you, we tell you and the relevant authority within 72 hours, in plain language, without waiting to be asked.
Children
This shop is not aimed at children under 16 and we do not knowingly collect their data. If you believe a child has given us information, write to us and we delete it.
Changes to this policy
If we change anything that matters, we update the date at the top and — for changes that affect how we use data you already gave us — tell you by email before it takes effect.