Privacy notice

Who we are

LuxeBloom Beauty LLC (“LuxeBloom Beauty”, “we”, “us”) operates this online store and is the controller of the personal information described in this notice.

LuxeBloom Beauty LLC
5102 Cholla Way, Apt 5, Orlando, FL 32808
Email: LuxeBloomBeautyLLC@outlook.com
Phone: (901) 445-3667

What information we collect

Information you give us

• Order and delivery details: first and last name, email address, phone number, delivery street address, city, state and ZIP code.
• Order contents: the products, quantities, prices, shipping method and any order note you add.
• Payment details: entered directly into Stripe's payment form. See Payments — we do not receive your full card number.
• Messages: anything you send through the contact form, by email or by phone, including the order number and topic you select.
• Marketing preferences: your email address and the fact that you consented, if you tick the marketing box.

Information collected automatically

• Session data: a cookie that remembers your bag, saved items and cookie choice.
• Technical and security logs: IP address, browser user agent, pages requested and timestamps, used to operate the site and detect abuse.

How we use your information

• To take, process, pack, ship and support your order.
• To send transactional messages: order confirmation, dispatch and tracking, refunds and problems with an order.
• To answer questions you send us.
• To prevent, detect and investigate fraud, card testing and abuse of the site.
• To meet our tax, accounting and consumer-law record-keeping obligations.
• To send marketing email, only where you have given consent, and only until you withdraw it.

We do not sell your personal information, and we do not share it with third parties for their own advertising.

Payments and Stripe

We use Stripe for payment processing. Stripe, Inc. acts as a data processor for the payment and as an independent controller for its own fraud-prevention and regulatory obligations.

When you pay, the following is collected and shared with Stripe to complete the transaction:

• Your name and email address.
• Your billing and delivery address.
• Your card details — card number, expiry date and security code — which you enter directly into Stripe's hosted payment page.
• The order contents, amount, currency and order number.
• Technical data about the device and session used to pay.

LuxeBloom Beauty never receives, processes or stores your full card number, expiry date or card security code. Our systems store only the order details, the payment status and a reference identifier returned by Stripe. Payments are processed by Stripe, which is certified to PCI-DSS Level 1 — the highest level of certification available.

Stripe's own privacy policy explains how it handles payment data and is available at stripe.com/privacy.

If we enable an additional payment provider such as Square, that provider will be named here before it is used, and the same principle applies: card details go to the provider, not to us.

Fraud detection and prevention

Payment data — including data from declined and failed transactions — may be used by us and by Stripe to detect and prevent fraud, card testing and other misuse. This includes analysing the card, device, IP address, address details and transaction pattern.

We also apply rate limits and automated abuse checks to our checkout, contact and newsletter forms. These record your IP address and request timing for a short period.

Incomplete and abandoned checkouts

Information you enter at checkout may be collected and retained even if you do not complete the purchase. If you begin a payment and abandon it, Stripe may retain the partial transaction record for its fraud-prevention and regulatory purposes, and we may retain the order record we created in a pending or cancelled state.

We will not email you about an abandoned checkout unless you separately consented to marketing. Starting a checkout is not consent to marketing.

Marketing and consent

We only send marketing email to people who have actively opted in — by ticking the consent box on the newsletter form, or the optional marketing box at checkout. Both are unticked by default.

Every marketing email contains a one-click unsubscribe link, which we action promptly. You can also withdraw consent at any time by emailing LuxeBloomBeautyLLC@outlook.com. Withdrawing marketing consent does not stop transactional emails about an order you have placed.

Who we share information with

International data transfers

LuxeBloom Beauty operates from the United States and our data is stored in the United States. Stripe may transfer and process personal data in the United States, India and other countries in which it or its service providers operate.

If you are in the European Economic Area or the United Kingdom, these transfers are made under the safeguards Stripe maintains for that purpose, including the European Commission's Standard Contractual Clauses and the UK Addendum. Stripe's transfer framework is described in its privacy policy.

How long we keep your information

• Order and transaction records: retained for at least seven years to meet tax, accounting, chargeback and consumer-law obligations. Transaction data may be retained for regulatory and fraud-prevention purposes even after you stop using the site, and even if you ask us to delete other data.
• Contact messages: up to three years from the last contact.
• Marketing subscribers: until you unsubscribe, plus a suppression record so we do not re-add you.
• Security and abuse logs: typically 90 days.
• Bag and session cookies: up to 14 days.

How we protect your information

• The entire site is served over HTTPS/TLS encryption.
• Card data is handled exclusively by Stripe on its PCI-DSS certified infrastructure.
• Forms are protected against cross-site request forgery, and cookies are HTTP-only, same-site and secure in production.
• The site sends a strict Content-Security-Policy and related browser security headers.
• Checkout, contact and newsletter endpoints are rate limited against automated abuse and card testing.
• Access to the order database is restricted to those who need it to run the business.

No system connected to the internet can be guaranteed completely secure, but these are the measures we take.

Your rights over your data

Depending on where you live, you have the right to:

• Access — ask for a copy of the personal information we hold about you.
• Correct — ask us to fix information that is wrong or incomplete.
• Delete — ask us to erase your information, subject to records we must keep by law.
• Port — receive your information in a portable, machine-readable format.
• Object or restrict — object to, or ask us to limit, certain processing.
• Withdraw consent — for marketing, at any time.
• Opt out — of your data being used for advertising or shared with third parties. We do not sell personal information or share it for cross-context behavioural advertising.
• Non-discrimination — we will not treat you differently for exercising any of these rights.

To make a request, email LuxeBloomBeautyLLC@outlook.com with the subject “Data rights request”, or write to us at the postal address above. We will acknowledge within 1 business day and respond substantively within 45 days. We may need to verify your identity before acting, and we will explain in writing if we cannot fulfil part of a request.

Children

Our services are not directed to individuals under the age of 13, and we do not knowingly collect personal information from them. Stripe's services may not be used by children under 13. If you believe a child has given us personal information, contact LuxeBloomBeautyLLC@outlook.com and we will delete it.

Cookies and tracking

We use strictly necessary cookies to operate your bag and protect checkout. Stripe sets its own cookies on the payment page for fraud detection and for its Link autofill feature. Optional analytics cookies are set only with your consent.

Full detail, including a table of every cookie, is in the cookie policy.

Changes to this notice

We update this notice when our practices, providers or legal obligations change. The “last updated” date at the top always reflects the current version. Material changes will be highlighted on the site.